Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Computer freezing when i do a malwarebytes scan


  • Please log in to reply
40 replies to this topic

#1 lazystoner

lazystoner

  • Members
  • 68 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:58 AM

Posted 09 November 2017 - 03:10 PM

My computer keeps freezing when i try to do a malwarebytes scan, i think i may be infected with something. can someone please have a look thanx.


Edited by hamluis, 09 November 2017 - 05:57 PM.
Moved from MRL to Am I Infected, moved back - Hamluis.


BC AdBot (Login to Remove)

 


m

#2 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 10,253 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:11:58 PM

Posted 09 November 2017 - 05:09 PM

Hi

Welcome :)

I'll be helping you with your computer.

Please read this post completely before beginning. If there's anything that you do not understand, please don't hesitate to ask before proceeding.

Please take note of the guidelines for this fix:

  • Please note that I am a volunteer. I do have a family, a career, and other endeavors that may prevent immediate responses that meet your schedule. Do note that the differences in time zones could present a problem as well. Your patience and understanding will be greatly appreciated.
  • First of all, the procedures we are about to perform are specific to your problem and should only be used on this specific computer.
  • Do not make any changes to your computer that include installing/uninstalling programs, deleting files, modifying the registry, nor running scanners or tools of any kind unless specifically requested by me.
  • Please read ALL instructions carefully and perform the steps fully and in the order they are written.
  • If things appear to be better, let me know. Just because the symptoms no longer exist as before, does not mean that you are clean.
  • Continue to read and follow my instructions until I tell you that your machine is clean.
  • If you have any questions at all, please do not hesitate to ask before performing the task that I ask of you, and please wait for my reply before you proceed.
  • Scanning with programs and reading the logs do take a fair amount of time. Again, your patience will be necessary. :)

Let's begin... :)

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Make sure that under Optional Scans, there is a checkmark on Addition.txt.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The tool will also produce another log (Addition.txt ). Please attach this to your reply.


Under Hurricane Emergency, expect delays on my responses

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#3 lazystoner

lazystoner
  • Topic Starter

  • Members
  • 68 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:58 AM

Posted 09 November 2017 - 05:37 PM

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 02-11-2017
Ran by User (administrator) on THEBEAST (09-11-2017 22:27:15)
Running from C:\Users\User\Desktop
Loaded Profiles: User (Available Profiles: User)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
() C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsusFanControlService\1.01.19\AsusFanControlService.exe
(Cambridge Silicon Radio Limited) E:\bluetooth\BtSwitcherService.exe
(Cambridge Silicon Radio Limited) E:\bluetooth\CsrBtOBEXService.exe
(Cambridge Silicon Radio Limited) E:\bluetooth\CsrBtService.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Cambridge Silicon Radio Limited) E:\bluetooth\CsrBtAudioService.exe
(Malwarebytes) E:\Anti-Malware\MBAMService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Cambridge Silicon Radio Limited) E:\bluetooth\CsrHCRPServer.exe
(Cambridge Silicon Radio Limited) E:\bluetooth\CsrAudioguiCtrl.exe
() E:\bluetooth\CsrSyncMLServer.exe
(Cambridge Silicon Radio Limited) E:\bluetooth\vksts.exe
(Cambridge Silicon Radio Limited) E:\bluetooth\HarmonyUserStartup.exe
(Cambridge Silicon Radio Limited) C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe
(Cambridge Silicon Radio Limited) E:\bluetooth\TrayApplication.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
() E:\tp-link\TWCU.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Node.js) C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\ShadowPlay\nvsphelper64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
(Malwarebytes) E:\Anti-Malware\mbamtray.exe
(Mozilla Corporation) E:\Mozilla Firefox\firefox.exe
(Mozilla Corporation) E:\Mozilla Firefox\firefox.exe
(Mozilla Corporation) E:\Mozilla Firefox\firefox.exe
(Mozilla Corporation) E:\Mozilla Firefox\firefox.exe
(Mozilla Corporation) E:\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6827664 2012-08-07] (Realtek Semiconductor)
HKLM\...\Run: [CsrHCRPServer] => E:\bluetooth\CsrHCRPServer.exe [1134288 2012-03-22] (Cambridge Silicon Radio Limited)
HKLM\...\Run: [CsrAudioguiCtrl] => E:\bluetooth\CsrAudioguiCtrl.exe [511696 2012-03-22] (Cambridge Silicon Radio Limited)
HKLM\...\Run: [CsrSyncMLServer] => E:\bluetooth\CsrSyncMLServer.exe [244944 2012-03-22] ()
HKLM\...\Run: [vksts] => E:\bluetooth\vksts.exe [25792 2012-03-22] (Cambridge Silicon Radio Limited)
HKLM\...\Run: [HarmonyUserStartup] => E:\bluetooth\HarmonyUserStartup.exe [39128 2012-03-22] (Cambridge Silicon Radio Limited)
HKLM\...\Run: [CSRHarmonySkypePlugin] => C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe [146656 2012-03-22] (Cambridge Silicon Radio Limited)
HKLM\...\Run: [TrayApplication] => E:\bluetooth\TrayApplication.exe [529616 2012-03-22] (Cambridge Silicon Radio Limited)
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET NOD32 Antivirus\ecmdS.exe [324216 2017-10-29] (ESET)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648 2012-05-20] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)
HKLM-x32\...\Run: [GrooveMonitor] => E:\MicrosoftOffice\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [CanonQuickMenu] => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1282120 2013-05-02] (CANON INC.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-09-05] (Oracle Corporation)
HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\Run: [World of Tanks] => "E:\WOT\WargamingGameUpdater.exe"
HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [10021040 2017-10-18] (Piriform Ltd)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\TP-LINK Wireless Configuration Utility.lnk [2014-10-04]
ShortcutTarget: TP-LINK Wireless Configuration Utility.lnk -> E:\tp-link\TWCU.exe ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{170216C7-A7B0-4982-99BC-B8EA812B38C9}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{2A380D94-325E-470B-962D-D1DA11AC100D}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
BHO: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll [2016-02-23] (CANON INC.)
BHO-x32: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll [2016-02-23] (CANON INC.)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> E:\MicrosoftOffice\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\ssv.dll [2017-10-18] (Oracle Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\jp2ssv.dll [2017-10-18] (Oracle Corporation)
Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll [2016-02-23] (CANON INC.)
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll [2016-02-23] (CANON INC.)
Handler-x32: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - E:\MicrosoftOffice\Office12\GrooveSystemServices.dll [2009-02-26] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)

FireFox:
========
FF DefaultProfile: k4rjy2xr.default-1371916095909
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\k4rjy2xr.default-1371916095909 [2017-11-09]
FF Homepage: Mozilla\Firefox\Profiles\k4rjy2xr.default-1371916095909 -> google.com
FF Extension: (Adblock Plus) - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\k4rjy2xr.default-1371916095909\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2017-11-08]
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird => not found
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird => not found
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_27_0_0_183.dll [2017-10-25] ()
FF Plugin: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelogx64.dll [2015-01-13] (EA Digital Illusions CE AB)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_27_0_0_183.dll [2017-10-25] ()
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll [2011-11-30] (CANON INC.)
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll [No File]
FF Plugin-x32: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelog.dll [2015-01-13] (EA Digital Illusions CE AB)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.151.2 -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\dtplugin\npDeployJava1.dll [2017-10-18] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.151.2 -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\plugin2\npjp2.dll [2017-10-18] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2017-10-06] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2017-10-06] (NVIDIA Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 -> E:\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-07-31] (Adobe Systems Inc.)
StartMenuInternet: FIREFOX.EXE - E:\Mozilla Firefox\firefox.exe

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe [920736 2012-06-01] ()
R2 asHmComSvc; C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe [951936 2012-06-01] (ASUSTeK Computer Inc.)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe [149120 2012-02-17] (ASUSTeK Computer Inc.)
R2 AsusFanControlService; C:\Program Files (x86)\ASUS\AsusFanControlService\1.01.19\AsusFanControlService.exe [408960 2012-10-15] (ASUSTeK Computer Inc.)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [1547200 2017-11-05] ()
R2 BtSwitcherService; E:\bluetooth\BtSwitcherService.exe [64216 2012-03-22] (Cambridge Silicon Radio Limited)
R2 CSRBtAudioService; E:\bluetooth\CsrBtAudioService.exe [465624 2012-03-22] (Cambridge Silicon Radio Limited)
R2 CsrBtOBEXService; E:\bluetooth\CsrBtOBEXService.exe [1041616 2012-03-22] (Cambridge Silicon Radio Limited)
R2 CsrBtService; E:\bluetooth\CsrBtService.exe [825032 2012-03-22] (Cambridge Silicon Radio Limited)
S3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [372512 2017-04-14] (EasyAntiCheat Ltd)
R2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2648184 2017-10-29] (ESET)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [File not signed]
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
R2 MBAMService; E:\Anti-Malware\mbamservice.exe [6058960 2017-08-07] (Malwarebytes)
S3 Microsoft Office Groove Audit Service; E:\MicrosoftOffice\Office12\GrooveAuditService.exe [64856 2009-02-26] (Microsoft Corporation)
R2 NvContainerLocalSystem; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [518080 2017-10-11] (NVIDIA Corporation)
S3 NvContainerNetworkService; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [518080 2017-10-11] (NVIDIA Corporation)
R2 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [462968 2017-10-06] (NVIDIA Corporation)
R2 NvTelemetryContainer; C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe [460736 2017-10-11] (NVIDIA Corporation)
S3 Origin Client Service; E:\Origin\OriginClientService.exe [2122248 2016-08-25] (Electronic Arts)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2015-02-06] ()
S2 SkypeUpdate; E:\Skype\Updater\Updater.exe [327296 2015-07-09] (Skype Technologies)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) <==== ATTENTION (no ServiceDLL)
R0 asahci64; C:\Windows\System32\DRIVERS\asahci64.sys [49760 2012-01-06] (Asmedia Technology)
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2012-08-22] ()
S3 csravrcp; C:\Windows\System32\DRIVERS\csravrcp.sys [26304 2012-03-22] (Cambridge Silicon Radio Limited)
S3 CsrBthAudioHF; C:\Windows\System32\DRIVERS\CsrBthAudioHF.sys [39120 2012-03-22] (Cambridge Silicon Radio Limited)
S3 CsrBtPort; C:\Windows\System32\DRIVERS\CsrBtPort.sys [2784968 2012-03-22] (Cambridge Silicon Radio Limited)
S3 csrhfgcc; C:\Windows\System32\DRIVERS\csrhfgcc.sys [38080 2012-03-22] (Cambridge Silicon Radio Limited)
S3 csrpan; C:\Windows\System32\DRIVERS\csrpan.sys [39616 2012-03-22] (Cambridge Silicon Radio Limited)
S3 csrserial; C:\Windows\System32\DRIVERS\csrserial.sys [61128 2012-03-22] (Cambridge Silicon Radio Limited)
S3 csrusb; C:\Windows\System32\Drivers\csrusb.sys [47296 2012-03-22] (Cambridge Silicon Radio Limited)
S3 csrusbfilter; C:\Windows\System32\Drivers\csrusbfilter.sys [23752 2012-03-22] (Cambridge Silicon Radio Limited)
S3 csr_bthav; C:\Windows\System32\drivers\csrbthav.sys [99520 2012-03-22] (Cambridge Silicon Radio Limited)
S3 dg_ssudbus; C:\Windows\System32\DRIVERS\ssudbus.sys [131984 2017-05-18] (Samsung Electronics Co., Ltd.)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [132848 2017-10-29] (ESET)
U5 edevmon; C:\Windows\System32\Drivers\edevmon.sys [251632 2015-07-12] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [180088 2017-10-29] (ESET)
R1 epfwwfpr; C:\Windows\System32\DRIVERS\epfwwfpr.sys [77736 2017-10-29] (ESET)
R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [77440 2017-11-09] ()
R2 MBAMChameleon; C:\Windows\System32\Drivers\MbamChameleon.sys [192952 2017-11-09] (Malwarebytes)
R3 MBAMFarflt; C:\Windows\System32\DRIVERS\farflt.sys [110016 2017-11-09] (Malwarebytes)
R3 MBAMProtection; C:\Windows\System32\DRIVERS\mbam.sys [45504 2017-11-09] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [252232 2017-11-09] (Malwarebytes)
R3 MBAMWebProtection; C:\Windows\System32\DRIVERS\mwac.sys [84256 2017-11-09] (Malwarebytes)
S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [30144 2017-10-11] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [50624 2017-10-11] (NVIDIA Corporation)
R3 nvvhci; C:\Windows\System32\DRIVERS\nvvhci.sys [57976 2017-05-03] (NVIDIA Corporation)
S0 sptd; C:\Windows\System32\Drivers\sptd.sys [868848 2013-09-22] (Duplex Secure Ltd.)
S3 ssudmdm; C:\Windows\System32\DRIVERS\ssudmdm.sys [166288 2017-05-18] (Samsung Electronics Co., Ltd.)
R3 WirelessKeyboardFilter; C:\Windows\System32\DRIVERS\WirelessKeyboardFilter.sys [49896 2016-07-22] (Microsoft Corporation)
S3 XSplit_Dummy; C:\Windows\System32\drivers\xspltspk.sys [26200 2014-07-02] (SplitmediaLabs Limited)
S1 SDHookDriver; \??\C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHookDrv64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-11-09 22:27 - 2017-11-09 22:27 - 000019211 _____ C:\Users\User\Desktop\FRST.txt
2017-11-09 22:26 - 2017-11-09 22:26 - 002403328 _____ (Farbar) C:\Users\User\Desktop\FRST64.exe
2017-11-09 20:26 - 2017-11-09 20:26 - 000003872 _____ C:\Windows\System32\Tasks\CCleaner Update
2017-11-09 20:26 - 2017-11-09 20:26 - 000002788 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2017-11-09 20:26 - 2017-11-09 20:26 - 000000822 _____ C:\Users\Public\Desktop\CCleaner.lnk
2017-11-09 20:26 - 2017-11-09 20:26 - 000000000 ____D C:\Program Files\CCleaner
2017-11-08 16:43 - 2017-10-18 02:34 - 000134376 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2017-11-08 16:43 - 2017-10-18 02:30 - 000605184 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2017-11-08 16:43 - 2017-10-15 22:04 - 000407392 _____ (Microsoft Corporation) C:\Windows\system32\centel.dll
2017-11-08 16:43 - 2017-10-04 13:04 - 002023936 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2017-11-08 16:43 - 2017-10-04 13:04 - 001570304 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2017-11-08 16:43 - 2017-10-04 13:04 - 000670208 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2017-11-08 16:43 - 2017-10-04 13:04 - 000603648 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2017-11-08 16:43 - 2017-10-04 13:04 - 000370688 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2017-11-08 16:43 - 2017-10-04 13:04 - 000241664 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2017-11-08 16:43 - 2017-10-04 13:04 - 000181760 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2017-11-05 15:40 - 2017-11-05 15:40 - 000000000 ____D C:\Users\User\AppData\Local\FortniteGame
2017-11-05 15:03 - 2017-11-05 15:03 - 000000000 ____D C:\Users\User\AppData\Local\UnrealEngineLauncher
2017-11-05 15:03 - 2017-11-05 15:03 - 000000000 ____D C:\Users\User\AppData\Local\EpicGamesLauncher
2017-11-05 15:02 - 2017-11-05 15:03 - 000000000 ____D C:\ProgramData\Epic
2017-11-05 15:02 - 2017-11-05 15:02 - 000000805 _____ C:\Users\Public\Desktop\Epic Games Launcher.lnk
2017-11-05 15:02 - 2017-11-05 15:02 - 000000805 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk
2017-11-02 16:09 - 2017-11-02 16:09 - 000000000 ____D C:\Users\User\Documents\mods
2017-10-31 18:29 - 2017-10-31 18:29 - 000000000 ____D C:\ProgramData\Sophos
2017-10-31 16:33 - 2017-11-09 22:27 - 000000000 ____D C:\FRST
2017-10-30 16:17 - 2017-11-09 22:19 - 000084256 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
2017-10-30 16:17 - 2017-11-09 20:09 - 000192952 _____ (Malwarebytes) C:\Windows\system32\Drivers\MbamChameleon.sys
2017-10-30 16:17 - 2017-11-09 20:09 - 000110016 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
2017-10-30 16:17 - 2017-11-09 20:09 - 000077440 _____ C:\Windows\system32\Drivers\mbae64.sys
2017-10-30 16:17 - 2017-10-30 16:17 - 000000598 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-10-30 16:17 - 2017-10-30 16:17 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-10-30 16:16 - 2017-10-30 16:16 - 000000000 ____D C:\ProgramData\MB2Migration
2017-10-19 18:18 - 2017-09-07 15:07 - 000344064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2017-10-19 18:18 - 2017-09-07 15:07 - 000327168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2017-10-19 18:18 - 2017-09-07 15:07 - 000099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2017-10-19 18:18 - 2017-09-07 15:07 - 000056320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2017-10-19 18:18 - 2017-09-07 15:07 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2017-10-19 18:18 - 2017-09-07 15:07 - 000025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2017-10-19 18:18 - 2017-09-07 15:07 - 000007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2017-10-19 18:18 - 2017-09-07 13:05 - 000995272 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000922432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ucrtbase.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000066400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-private-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000063840 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000022368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-math-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000020832 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000019808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000019808 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000017760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-string-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000017760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000016224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000016224 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000015712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000015712 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000014176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-time-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000014176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000013664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000013664 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l2-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
2017-10-18 18:59 - 2017-10-18 18:59 - 000000000 ____D C:\Users\Public\Documents\uPlay
2017-10-18 15:58 - 2017-10-18 15:58 - 000000796 _____ C:\Users\Public\Desktop\South Park The Fractured but Whole.lnk
2017-10-17 16:51 - 2017-10-30 16:01 - 000000000 ____D C:\Users\User\Documents\WB Games
2017-10-17 14:38 - 2017-10-06 11:52 - 000136312 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2017-10-17 14:38 - 2017-09-13 23:20 - 000798008 _____ C:\Windows\SysWOW64\vulkan-1.dll
2017-10-17 14:38 - 2017-09-13 23:20 - 000490296 _____ C:\Windows\SysWOW64\vulkaninfo.exe
2017-10-17 14:38 - 2017-09-13 23:19 - 000927544 _____ C:\Windows\system32\vulkan-1.dll
2017-10-17 14:38 - 2017-09-13 23:19 - 000591160 _____ C:\Windows\system32\vulkaninfo.exe
2017-10-17 14:36 - 2017-10-09 12:20 - 000225208 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2017-10-17 14:36 - 2017-10-09 12:20 - 000045496 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 040237176 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 036184000 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 035156600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 029228480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 023261256 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 019035344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 018203456 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 016751224 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2017-10-17 14:36 - 2017-10-06 13:32 - 013863000 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 013251240 _____ (NVIDIA Corporation) C:\Windows\system32\nvptxJitCompiler.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 011777952 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 010880672 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvptxJitCompiler.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 003807864 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 003346368 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 001988216 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6438792.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 001606776 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6438792.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 001135280 _____ (NVIDIA Corporation) C:\Windows\system32\nvfatbinaryLoader.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 001098360 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 001030264 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 000981112 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 000932472 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 000885496 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvfatbinaryLoader.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 000615360 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 000527104 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 000505976 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 000444328 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 000407248 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 000171896 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 000154392 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 000149736 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 000132256 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 000000669 _____ C:\Windows\SysWOW64\nv-vk32.json
2017-10-17 14:36 - 2017-10-06 13:32 - 000000669 _____ C:\Windows\system32\nv-vk64.json
2017-10-16 19:35 - 2017-10-16 19:35 - 000000000 ____D C:\Users\User\AppData\Local\TangoGameworks
2017-10-16 19:34 - 2017-10-11 01:05 - 000050624 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2017-10-15 11:57 - 2017-10-15 11:57 - 000000000 ____D C:\Users\User\AppData\LocalLow\CodeHorizon
2017-10-10 18:42 - 2017-10-10 18:42 - 126925120 ____C (Microsoft Corporation) C:\Windows\system32\MRT-KB890830.exe
2017-10-10 18:39 - 2017-09-13 15:33 - 000631176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2017-10-10 18:39 - 2017-09-13 15:32 - 005547752 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2017-10-10 18:39 - 2017-09-13 15:32 - 000706792 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2017-10-10 18:39 - 2017-09-13 15:32 - 000154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2017-10-10 18:39 - 2017-09-13 15:32 - 000095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2017-10-10 18:39 - 2017-09-13 15:31 - 001732864 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2017-10-10 18:39 - 2017-09-13 15:28 - 001212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2017-10-10 18:39 - 2017-09-13 15:28 - 001068544 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2017-10-10 18:39 - 2017-09-13 15:28 - 000886272 _____ (Microsoft Corporation) C:\Windows\system32\wlansvc.dll
2017-10-10 18:39 - 2017-09-13 15:28 - 000503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2017-10-10 18:39 - 2017-09-13 15:28 - 000448512 _____ (Microsoft Corporation) C:\Windows\system32\wlansec.dll
2017-10-10 18:39 - 2017-09-13 15:28 - 000414208 _____ (Microsoft Corporation) C:\Windows\system32\wlanmsm.dll
2017-10-10 18:39 - 2017-09-13 15:28 - 000362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2017-10-10 18:39 - 2017-09-13 15:28 - 000345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2017-10-10 18:39 - 2017-09-13 15:28 - 000316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2017-10-10 18:39 - 2017-09-13 15:28 - 000312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2017-10-10 18:39 - 2017-09-13 15:28 - 000243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2017-10-10 18:39 - 2017-09-13 15:28 - 000215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2017-10-10 18:39 - 2017-09-13 15:28 - 000210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2017-10-10 18:39 - 2017-09-13 15:28 - 000190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2017-10-10 18:39 - 2017-09-13 15:28 - 000146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2017-10-10 18:39 - 2017-09-13 15:28 - 000135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2017-10-10 18:39 - 2017-09-13 15:28 - 000118784 _____ (Microsoft Corporation) C:\Windows\system32\wlanhlp.dll
2017-10-10 18:39 - 2017-09-13 15:28 - 000113664 _____ (Microsoft Corporation) C:\Windows\system32\wlanapi.dll
2017-10-10 18:39 - 2017-09-13 15:28 - 000086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2017-10-10 18:39 - 2017-09-13 15:28 - 000063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2017-10-10 18:39 - 2017-09-13 15:28 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2017-10-10 18:39 - 2017-09-13 15:28 - 000050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2017-10-10 18:39 - 2017-09-13 15:28 - 000028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2017-10-10 18:39 - 2017-09-13 15:28 - 000028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2017-10-10 18:39 - 2017-09-13 15:28 - 000016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2017-10-10 18:39 - 2017-09-13 15:28 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 001460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 001163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000731648 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:27 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:13 - 004001512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2017-10-10 18:39 - 2017-09-13 15:13 - 003945704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2017-10-10 18:39 - 2017-09-13 15:10 - 001314112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2017-10-10 18:39 - 2017-09-13 15:09 - 001114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2017-10-10 18:39 - 2017-09-13 15:09 - 000830464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2017-10-10 18:39 - 2017-09-13 15:09 - 000666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2017-10-10 18:39 - 2017-09-13 15:09 - 000428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlanmsm.dll
2017-10-10 18:39 - 2017-09-13 15:09 - 000392704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlansec.dll
2017-10-10 18:39 - 2017-09-13 15:09 - 000275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2017-10-10 18:39 - 2017-09-13 15:09 - 000261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2017-10-10 18:39 - 2017-09-13 15:09 - 000254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2017-10-10 18:39 - 2017-09-13 15:09 - 000223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2017-10-10 18:39 - 2017-09-13 15:09 - 000172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2017-10-10 18:39 - 2017-09-13 15:09 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2017-10-10 18:39 - 2017-09-13 15:09 - 000141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2017-10-10 18:39 - 2017-09-13 15:09 - 000096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2017-10-10 18:39 - 2017-09-13 15:09 - 000083968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlanhlp.dll
2017-10-10 18:39 - 2017-09-13 15:09 - 000082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2017-10-10 18:39 - 2017-09-13 15:09 - 000080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlanapi.dll
2017-10-10 18:39 - 2017-09-13 15:09 - 000065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2017-10-10 18:39 - 2017-09-13 15:09 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2017-10-10 18:39 - 2017-09-13 15:09 - 000043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2017-10-10 18:39 - 2017-09-13 15:09 - 000022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2017-10-10 18:39 - 2017-09-13 15:09 - 000005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2017-10-10 18:39 - 2017-09-13 15:08 - 000690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2017-10-10 18:39 - 2017-09-13 15:08 - 000644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2017-10-10 18:39 - 2017-09-13 15:08 - 000554496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2017-10-10 18:39 - 2017-09-13 15:08 - 000342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2017-10-10 18:39 - 2017-09-13 15:08 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2017-10-10 18:39 - 2017-09-13 15:08 - 000017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2017-10-10 18:39 - 2017-09-13 15:08 - 000006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2017-10-10 18:39 - 2017-09-13 15:08 - 000005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:08 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:08 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:08 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:08 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:08 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:08 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:08 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:08 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:08 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:08 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:08 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:08 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:08 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:08 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:08 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:08 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:08 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:08 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:08 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:08 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:08 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:08 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:08 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 15:05 - 000324608 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\nwifi.sys
2017-10-10 18:39 - 2017-09-13 15:00 - 000148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2017-10-10 18:39 - 2017-09-13 15:00 - 000064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2017-10-10 18:39 - 2017-09-13 15:00 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2017-10-10 18:39 - 2017-09-13 15:00 - 000017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2017-10-10 18:39 - 2017-09-13 14:57 - 000338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2017-10-10 18:39 - 2017-09-13 14:56 - 000296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2017-10-10 18:39 - 2017-09-13 14:53 - 000291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2017-10-10 18:39 - 2017-09-13 14:53 - 000159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2017-10-10 18:39 - 2017-09-13 14:53 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2017-10-10 18:39 - 2017-09-13 14:52 - 000112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2017-10-10 18:39 - 2017-09-13 14:52 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2017-10-10 18:39 - 2017-09-13 14:50 - 000050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2017-10-10 18:39 - 2017-09-13 14:47 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2017-10-10 18:39 - 2017-09-13 14:46 - 000036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2017-10-10 18:39 - 2017-09-13 14:46 - 000014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2017-10-10 18:39 - 2017-09-13 14:46 - 000007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2017-10-10 18:39 - 2017-09-13 14:46 - 000006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 14:46 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 14:46 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 14:46 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2017-10-10 18:39 - 2017-09-13 14:46 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2017-10-10 18:39 - 2017-09-09 00:45 - 000395984 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2017-10-10 18:39 - 2017-09-08 23:47 - 000347344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2017-10-10 18:39 - 2017-09-08 15:34 - 001680616 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2017-10-10 18:39 - 2017-09-08 15:30 - 002319872 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll
2017-10-10 18:39 - 2017-09-08 15:30 - 002222080 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll
2017-10-10 18:39 - 2017-09-08 15:30 - 002058240 _____ (Microsoft Corporation) C:\Windows\system32\Query.dll
2017-10-10 18:39 - 2017-09-08 15:30 - 000778240 _____ (Microsoft Corporation) C:\Windows\system32\mssvp.dll
2017-10-10 18:39 - 2017-09-08 15:30 - 000491520 _____ (Microsoft Corporation) C:\Windows\system32\mssph.dll
2017-10-10 18:39 - 2017-09-08 15:30 - 000405504 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2017-10-10 18:39 - 2017-09-08 15:30 - 000288256 _____ (Microsoft Corporation) C:\Windows\system32\mssphtb.dll
2017-10-10 18:39 - 2017-09-08 15:30 - 000149504 _____ (Microsoft Corporation) C:\Windows\system32\t2embed.dll
2017-10-10 18:39 - 2017-09-08 15:30 - 000115200 _____ (Microsoft Corporation) C:\Windows\system32\mssitlb.dll
2017-10-10 18:39 - 2017-09-08 15:30 - 000099840 _____ (Microsoft Corporation) C:\Windows\system32\mssprxy.dll
2017-10-10 18:39 - 2017-09-08 15:30 - 000075264 _____ (Microsoft Corporation) C:\Windows\system32\msscntrs.dll
2017-10-10 18:39 - 2017-09-08 15:30 - 000014336 _____ (Microsoft Corporation) C:\Windows\system32\msshooks.dll
2017-10-10 18:39 - 2017-09-08 15:14 - 000591872 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe
2017-10-10 18:39 - 2017-09-08 15:13 - 000249856 _____ (Microsoft Corporation) C:\Windows\system32\SearchProtocolHost.exe
2017-10-10 18:39 - 2017-09-08 15:13 - 000113664 _____ (Microsoft Corporation) C:\Windows\system32\SearchFilterHost.exe
2017-10-10 18:39 - 2017-09-08 15:10 - 001549824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tquery.dll
2017-10-10 18:39 - 2017-09-08 15:10 - 001363968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Query.dll
2017-10-10 18:39 - 2017-09-08 15:10 - 000312832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2017-10-10 18:39 - 2017-09-08 15:10 - 000109568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\t2embed.dll
2017-10-10 18:39 - 2017-09-08 15:09 - 001400320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssrch.dll
2017-10-10 18:39 - 2017-09-08 15:09 - 000666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssvp.dll
2017-10-10 18:39 - 2017-09-08 15:09 - 000337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssph.dll
2017-10-10 18:39 - 2017-09-08 15:09 - 000197120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssphtb.dll
2017-10-10 18:39 - 2017-09-08 15:09 - 000104448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssitlb.dll
2017-10-10 18:39 - 2017-09-08 15:09 - 000059392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscntrs.dll
2017-10-10 18:39 - 2017-09-08 15:09 - 000034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssprxy.dll
2017-10-10 18:39 - 2017-09-08 15:00 - 003222016 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2017-10-10 18:39 - 2017-09-08 15:00 - 000427520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchIndexer.exe
2017-10-10 18:39 - 2017-09-08 15:00 - 000164352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
2017-10-10 18:39 - 2017-09-08 14:59 - 000086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFilterHost.exe
2017-10-10 18:39 - 2017-09-08 14:59 - 000009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msshooks.dll
2017-10-10 18:39 - 2017-09-08 14:20 - 000640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswstr10.dll
2017-10-10 18:39 - 2017-09-08 14:20 - 000345088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msexcl40.dll
2017-10-10 18:39 - 2017-09-08 14:20 - 000008704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msjint40.dll
2017-10-10 18:39 - 2017-09-07 21:38 - 002724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2017-10-10 18:39 - 2017-09-07 21:37 - 000004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2017-10-10 18:39 - 2017-09-07 21:19 - 000066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2017-10-10 18:39 - 2017-09-07 21:18 - 000417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2017-10-10 18:39 - 2017-09-07 21:18 - 000048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2017-10-10 18:39 - 2017-09-07 21:17 - 000576512 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2017-10-10 18:39 - 2017-09-07 21:17 - 000088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2017-10-10 18:39 - 2017-09-07 21:15 - 002902528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2017-10-10 18:39 - 2017-09-07 21:08 - 025729536 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2017-10-10 18:39 - 2017-09-07 21:08 - 000054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2017-10-10 18:39 - 2017-09-07 21:07 - 000034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2017-10-10 18:39 - 2017-09-07 21:02 - 000615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2017-10-10 18:39 - 2017-09-07 21:01 - 000814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2017-10-10 18:39 - 2017-09-07 21:01 - 000144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2017-10-10 18:39 - 2017-09-07 21:01 - 000116224 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2017-10-10 18:39 - 2017-09-07 21:00 - 000817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2017-10-10 18:39 - 2017-09-07 20:52 - 000968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2017-10-10 18:39 - 2017-09-07 20:48 - 000489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2017-10-10 18:39 - 2017-09-07 20:40 - 005982208 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2017-10-10 18:39 - 2017-09-07 20:39 - 000077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-10-10 18:39 - 2017-09-07 20:38 - 000087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2017-10-10 18:39 - 2017-09-07 20:37 - 000107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2017-10-10 18:39 - 2017-09-07 20:33 - 000199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2017-10-10 18:39 - 2017-09-07 20:32 - 000092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2017-10-10 18:39 - 2017-09-07 20:29 - 000315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2017-10-10 18:39 - 2017-09-07 20:27 - 000152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2017-10-10 18:39 - 2017-09-07 20:13 - 000262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2017-10-10 18:39 - 2017-09-07 20:10 - 000807936 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2017-10-10 18:39 - 2017-09-07 20:10 - 000726528 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2017-10-10 18:39 - 2017-09-07 20:08 - 002134528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2017-10-10 18:39 - 2017-09-07 20:08 - 001359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2017-10-10 18:39 - 2017-09-07 19:44 - 015262720 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2017-10-10 18:39 - 2017-09-07 19:40 - 003240960 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2017-10-10 18:39 - 2017-09-07 19:27 - 002724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2017-10-10 18:39 - 2017-09-07 19:27 - 001548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2017-10-10 18:39 - 2017-09-07 19:17 - 000800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2017-10-10 18:39 - 2017-09-07 19:11 - 000062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2017-10-10 18:39 - 2017-09-07 19:10 - 000499200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2017-10-10 18:39 - 2017-09-07 19:10 - 000341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2017-10-10 18:39 - 2017-09-07 19:10 - 000047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2017-10-10 18:39 - 2017-09-07 19:09 - 000064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2017-10-10 18:39 - 2017-09-07 19:04 - 020267008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2017-10-10 18:39 - 2017-09-07 19:03 - 002292736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2017-10-10 18:39 - 2017-09-07 19:03 - 000047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2017-10-10 18:39 - 2017-09-07 19:02 - 000030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2017-10-10 18:39 - 2017-09-07 18:59 - 000476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2017-10-10 18:39 - 2017-09-07 18:58 - 000663040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2017-10-10 18:39 - 2017-09-07 18:58 - 000620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2017-10-10 18:39 - 2017-09-07 18:58 - 000115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2017-10-10 18:39 - 2017-09-07 18:49 - 000416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2017-10-10 18:39 - 2017-09-07 18:44 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2017-10-10 18:39 - 2017-09-07 18:44 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2017-10-10 18:39 - 2017-09-07 18:43 - 000091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2017-10-10 18:39 - 2017-09-07 18:40 - 000168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2017-10-10 18:39 - 2017-09-07 18:39 - 000076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2017-10-10 18:39 - 2017-09-07 18:37 - 000279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2017-10-10 18:39 - 2017-09-07 18:36 - 000130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2017-10-10 18:39 - 2017-09-07 18:29 - 004547072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2017-10-10 18:39 - 2017-09-07 18:29 - 000230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2017-10-10 18:39 - 2017-09-07 18:26 - 000694784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2017-10-10 18:39 - 2017-09-07 18:25 - 002058752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2017-10-10 18:39 - 2017-09-07 18:25 - 001155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2017-10-10 18:39 - 2017-09-07 18:17 - 013677568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2017-10-10 18:39 - 2017-09-07 18:01 - 002767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2017-10-10 18:39 - 2017-09-07 17:57 - 001316864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2017-10-10 18:39 - 2017-09-07 17:57 - 000710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2017-10-10 18:39 - 2017-09-07 15:31 - 002851328 _____ (Microsoft Corporation) C:\Windows\system32\themeui.dll
2017-10-10 18:39 - 2017-09-07 15:12 - 002755072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\themeui.dll
2017-10-10 18:39 - 2017-09-07 14:55 - 000461312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2017-10-10 18:39 - 2017-09-07 14:55 - 000405504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2017-10-10 18:39 - 2017-09-07 14:55 - 000168448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-11-09 22:26 - 2013-06-07 23:40 - 000000000 ____D C:\Users\User\AppData\Roaming\vlc
2017-11-09 22:19 - 2009-07-14 03:20 - 000000000 ____D C:\Windows\inf
2017-11-09 21:37 - 2016-01-17 15:10 - 000000000 ____D C:\Users\User\AppData\Roaming\uTorrent
2017-11-09 21:15 - 2016-11-18 09:05 - 000000000 ____D C:\Users\User\AppData\LocalLow\Mozilla
2017-11-09 20:35 - 2009-07-14 04:45 - 000029136 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-11-09 20:35 - 2009-07-14 04:45 - 000029136 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-11-09 20:28 - 2016-05-12 17:55 - 000000000 ____D C:\Users\User\AppData\Local\CrashDumps
2017-11-09 20:28 - 2014-03-10 13:56 - 000000000 ____D C:\Windows\Minidump
2017-11-09 20:28 - 2013-06-01 23:28 - 000000000 ____D C:\Windows\Panther
2017-11-09 20:12 - 2009-07-14 05:13 - 000782470 _____ C:\Windows\system32\PerfStringBackup.INI
2017-11-09 20:09 - 2014-07-17 16:17 - 000252232 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys
2017-11-09 20:09 - 2014-05-27 18:01 - 000045504 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2017-11-09 20:06 - 2013-06-01 15:03 - 000000000 ____D C:\ProgramData\NVIDIA
2017-11-09 20:06 - 2009-07-14 05:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2017-11-09 17:01 - 2017-06-04 13:03 - 000000000 ____D C:\Users\User\AppData\Roaming\techno4uk2lo.xyz
2017-11-08 16:45 - 2014-12-10 16:41 - 000000000 ____D C:\Windows\system32\appraiser
2017-11-05 15:40 - 2017-05-09 18:36 - 000000000 ____D C:\Users\User\AppData\Local\UnrealEngine
2017-11-05 15:03 - 2013-06-07 18:14 - 000000000 ____D C:\ProgramData\Package Cache
2017-11-04 15:47 - 2013-07-27 11:52 - 000000000 ____D C:\Users\User\AppData\Local\NVIDIA
2017-10-30 16:17 - 2014-05-27 18:01 - 000000000 ____D C:\ProgramData\Malwarebytes
2017-10-30 04:08 - 2009-07-14 05:08 - 000032608 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2017-10-29 17:11 - 2015-07-12 23:14 - 000180088 _____ (ESET) C:\Windows\system32\Drivers\ehdrv.sys
2017-10-29 17:11 - 2015-07-12 23:14 - 000132848 _____ (ESET) C:\Windows\system32\Drivers\eamonm.sys
2017-10-29 17:11 - 2015-07-12 23:14 - 000077736 _____ (ESET) C:\Windows\system32\Drivers\epfwwfpr.sys
2017-10-25 16:44 - 2014-09-15 19:57 - 000004312 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2017-10-25 16:44 - 2013-06-01 18:41 - 000803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-10-25 16:44 - 2013-06-01 18:41 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-10-25 16:44 - 2013-06-01 18:41 - 000000000 ____D C:\Windows\SysWOW64\Macromed
2017-10-25 16:44 - 2013-06-01 18:41 - 000000000 ____D C:\Windows\system32\Macromed
2017-10-20 14:17 - 2009-07-14 03:20 - 000000000 ____D C:\Windows\rescache
2017-10-19 18:19 - 2013-06-01 19:35 - 000766336 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2017-10-18 19:17 - 2015-11-12 17:00 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2017-10-18 19:17 - 2014-10-15 21:12 - 000000000 ____D C:\Program Files (x86)\Java
2017-10-18 19:16 - 2015-11-12 17:00 - 000097856 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2017-10-18 18:58 - 2013-06-07 18:15 - 000000000 ____D C:\Users\User\Documents\My Games
2017-10-17 14:39 - 2017-04-08 12:15 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2017-10-17 14:39 - 2013-06-01 15:03 - 000000000 ____D C:\ProgramData\NVIDIA Corporation
2017-10-17 14:38 - 2017-01-27 17:06 - 000000000 ____D C:\Program Files (x86)\VulkanRT
2017-10-17 14:38 - 2013-06-01 20:53 - 000000000 ____D C:\Users\User\AppData\Roaming\NVIDIA
2017-10-17 14:37 - 2013-06-01 15:03 - 000000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2017-10-17 14:37 - 2013-06-01 15:02 - 000000000 ____D C:\Program Files\NVIDIA Corporation
2017-10-16 19:34 - 2017-05-10 17:43 - 000003814 _____ C:\Windows\System32\Tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-10-16 19:34 - 2017-04-11 15:40 - 000004146 _____ C:\Windows\System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-10-16 19:34 - 2017-04-11 15:40 - 000003798 _____ C:\Windows\System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-10-16 19:34 - 2017-04-11 15:40 - 000003738 _____ C:\Windows\System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-10-16 19:34 - 2017-04-11 15:40 - 000003738 _____ C:\Windows\System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-10-16 19:34 - 2017-04-11 15:40 - 000003730 _____ C:\Windows\System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-10-16 19:34 - 2017-04-11 15:40 - 000003554 _____ C:\Windows\System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-10-16 19:34 - 2017-04-11 15:40 - 000003494 _____ C:\Windows\System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-10-16 19:34 - 2017-04-11 15:40 - 000001416 _____ C:\Users\Public\Desktop\GeForce Experience.lnk
2017-10-16 19:32 - 2013-06-06 20:42 - 000000000 ____D C:\Windows\SysWOW64\directx
2017-10-11 01:05 - 2017-06-25 19:30 - 000186304 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
2017-10-11 01:05 - 2017-06-25 19:30 - 000152512 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2017-10-11 01:05 - 2017-04-11 15:40 - 001796032 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2017-10-11 01:05 - 2017-04-11 15:40 - 001577920 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2017-10-11 01:05 - 2017-04-11 15:40 - 000918976 _____ (NVIDIA Corporation) C:\Windows\system32\NvRtmpStreamer64.dll
2017-10-10 23:26 - 2017-04-08 12:15 - 000001951 _____ C:\Windows\NvTelemetryContainerRecovery.bat
2017-10-10 18:44 - 2009-07-14 04:45 - 000410984 _____ C:\Windows\system32\FNTCACHE.DAT
2017-10-10 18:43 - 2013-07-10 17:24 - 000000000 ____D C:\Windows\system32\MRT
2017-10-10 18:42 - 2013-06-01 18:40 - 126925120 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe

==================== Files in the root of some directories =======

2014-11-10 16:12 - 2017-06-11 15:22 - 002032640 _____ () C:\Users\User\AppData\Local\file__0.localstorage
2015-05-22 18:34 - 2015-05-22 18:34 - 000000000 ___SH () C:\Users\User\AppData\Local\LumaEmu
2014-03-04 20:36 - 2017-09-17 14:58 - 000007600 _____ () C:\Users\User\AppData\Local\resmon.resmoncfg
2008-02-05 13:28 - 2008-02-05 13:28 - 000000051 _____ () C:\Users\User\AppData\Local\setup.txt

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-10-30 15:00

==================== End of FRST.txt ============================


How do i attach files? there was no option



#4 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 10,253 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:11:58 PM

Posted 09 November 2017 - 05:52 PM

I have requested the topic to be moved. Until then, just copy and paste the contents of the addition.txt on the reply.


Under Hurricane Emergency, expect delays on my responses

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#5 lazystoner

lazystoner
  • Topic Starter

  • Members
  • 68 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:58 AM

Posted 09 November 2017 - 05:55 PM

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-11-2017
Ran by User (09-11-2017 22:27:31)
Running from C:\Users\User\Desktop
Windows 7 Home Premium Service Pack 1 (X64) (2013-06-01 14:43:48)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-2683171744-3939096081-1905568632-500 - Administrator - Disabled)
Guest (S-1-5-21-2683171744-3939096081-1905568632-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2683171744-3939096081-1905568632-1003 - Limited - Enabled)
User (S-1-5-21-2683171744-3939096081-1905568632-1000 - Administrator - Enabled) => C:\Users\User

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
AV: ESET NOD32 Antivirus (Enabled - Up to date) {EC1D6F37-E411-475A-DF50-12FF7FE4AC70}
AS: ESET NOD32 Antivirus (Enabled - Up to date) {577C8ED3-C22B-48D4-E5E0-298D0463E6CD}
AS: Malwarebytes (Enabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\uTorrent) (Version: 3.5.0.44090 - BitTorrent Inc.)
Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 17.012.20098 - Adobe Systems Incorporated)
Adobe Flash Player 27 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 27.0.0.183 - Adobe Systems Incorporated)
Adobe Flash Player 27 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 27.0.0.183 - Adobe Systems Incorporated)
Ansel (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Ansel) (Version: 387.92 - NVIDIA Corporation) Hidden
Asmedia ASM104x USB 3.0 Host Controller Driver (HKLM-x32\...\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.14.3.0 - Asmedia Technology)
Asmedia ASM106x SATA Host Controller Driver (HKLM-x32\...\{61942EF5-2CD8-47D4-869C-2E9A8BB085F1}) (Version: 1.3.4.000 - Asmedia Technology)
Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 2.6.2 - EA Digital Illusions CE AB)
BattlEye for OA Uninstall (HKLM-x32\...\BattlEye for OA) (Version:  - )
BattlEye Uninstall (HKLM-x32\...\BattlEye for A2) (Version:  - )
Canon Easy-WebPrint EX (HKLM-x32\...\Easy-WebPrint EX) (Version: 1.7.0.0 - Canon Inc.)
Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version:  - Canon Inc.)
Canon MG2500 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG2500_series) (Version: 1.00 - Canon Inc.)
Canon MG2500 series On-screen Manual (HKLM-x32\...\Canon MG2500 series On-screen Manual) (Version: 7.6.1 - Canon Inc.)
Canon MG2500 series User Registration (HKLM-x32\...\Canon MG2500 series User Registration) (Version:  - ‭Canon Inc.)
Canon My Image Garden (HKLM-x32\...\Canon My Image Garden) (Version: 2.0.1 - Canon Inc.)
Canon My Image Garden Design Files (HKLM-x32\...\Canon My Image Garden Design Files) (Version: 2.0.0 - Canon Inc.)
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: 3.1.0 - Canon Inc.)
Canon Quick Menu (HKLM-x32\...\CanonQuickMenu) (Version: 2.2.1 - Canon Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.36 - Piriform)
CSR Harmony Wireless Software Stack (HKLM\...\{17DEA095-8EE1-49A2-AC5A-9663DB098FA9}) (Version: 2.1.63.0 - Cambridge Silicon Radio Limited.)
Epic Games Launcher (HKLM-x32\...\{6F15D7C1-3079-4135-B8E9-8D3EA033EE3A}) (Version: 1.1.129.0 - Epic Games, Inc.)
Epic Games Launcher Prerequisites (x64) (HKLM\...\{66C5838F-B854-4A55-89E6-A6138747A4DF}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden
ESET NOD32 Antivirus (HKLM\...\{3B4AB7BA-0734-4547-9604-3FCC40873B3D}) (Version: 10.1.219.0 - ESET, spol. s r.o.)
EVGA Precision X 4.2.1 (HKLM-x32\...\PrecisionX) (Version: 4.2.1 - EVGA Corporation)
Folder Size 3.4.0.0 (HKLM-x32\...\{2DFA85ED-588F-4CE3-A175-29E52C3804A8}_is1) (Version: 3.4.0.0 - MindGems, Inc.)
Geeks3D FurMark 1.19.0.0 (HKLM-x32\...\{2397CAD4-2263-4CD0-96BE-E43A980B9C9A}_is1) (Version:  - Geeks3D)
Intel® Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel® Network Connections 17.3.63.0 (HKLM\...\PROSetDX) (Version: 17.3.63.0 - Intel)
Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.1.0.1006 - Intel Corporation)
Intel® USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.5.235 - Intel Corporation)
Java 8 Update 151 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180151F0}) (Version: 8.0.1510.12 - Oracle Corporation)
Launcher Prerequisites (x64) (HKLM-x32\...\{c6c5a357-c7ca-4a5f-9789-3bb1af579253}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden
Malwarebytes version 3.2.2.2029 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.2.2.2029 - Malwarebytes)
Microsoft .NET Framework 4.7 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.7.02053 - Microsoft Corporation)
Microsoft Mouse and Keyboard Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.3.188.0 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{51adbf11-493f-431c-a862-967a0fae2944}) (Version: 12.0.21005.1 - Корпорация Майкрософт)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}) (Version: 12.0.21005.1 - Корпорация Майкрософт)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 (HKLM-x32\...\{d992c12e-cab2-426f-bde3-fb8c53950b0d}) (Version: 14.0.24215.1 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
Mozilla Firefox 56.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 56.0 (x86 en-US)) (Version: 56.0 - Mozilla)
Mozilla Firefox 56.0.2 (x64 en-US) (HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\Mozilla Firefox 56.0.2 (x64 en-US)) (Version: 56.0.2 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser and SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
NVIDIA 3D Vision Controller Driver 369.04 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 369.04 - NVIDIA Corporation)
NVIDIA 3D Vision Driver 387.92 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 387.92 - NVIDIA Corporation)
NVIDIA GeForce Experience 3.10.0.95 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 3.10.0.95 - NVIDIA Corporation)
NVIDIA Graphics Driver 387.92 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 387.92 - NVIDIA Corporation)
NVIDIA HD Audio Driver 1.3.35.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.35.1 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.17.0524 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.17.0524 - NVIDIA Corporation)
Origin (HKLM-x32\...\Origin) (Version: 9.3.11.2762 - Electronic Arts, Inc.)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.994 - Even Balance, Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6699 - Realtek Semiconductor Corp.)
Skype™ 7.18 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.18.112 - Skype Technologies S.A.)
South Park: The Fractured but Whole - Gold Edition (HKLM-x32\...\South Park: The Fractured but Whole - Gold Edition_is1) (Version:  - )
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
TeamSpeak 3 Client (HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\TeamSpeak 3 Client) (Version: 3.0.18 - TeamSpeak Systems GmbH)
techno4uk2lo.xyz (HKLM-x32\...\techno4uk2lo.xyz) (Version: 2.69.3-20160414 - Jo2003)
TP-LINK TL-WDN4800 Driver (HKLM-x32\...\{FDA7E907-6539-42C1-9721-0239C281B336}) (Version: 1.3.1 - TP-LINK)
TP-LINK Wireless Configuration Utility (HKLM-x32\...\{319D91C6-3D44-436C-9F79-36C0D22372DC}) (Version: 1.3.1 - TP-LINK)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.1 - VideoLAN)
Vulkan Run Time Libraries 1.0.61.0 (HKLM\...\VulkanRT1.0.61.0) (Version: 1.0.61.0 - LunarG, Inc.) Hidden
WinDirStat 1.1.2 (HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\WinDirStat) (Version:  - )
WinRAR 4.20 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

ShellIconOverlayIdentifiers-x32-x32: [Groove Explorer Icon Overlay 1 (GFS Unread Stub)] -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => E:\MicrosoftOffice\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32-x32-x32: [Groove Explorer Icon Overlay 2 (GFS Stub)] -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => E:\MicrosoftOffice\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32-x32-x32-x32: [Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)] -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => E:\MicrosoftOffice\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32-x32-x32-x32-x32: [Groove Explorer Icon Overlay 3 (GFS Folder)] -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => E:\MicrosoftOffice\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32-x32-x32-x32-x32-x32: [Groove Explorer Icon Overlay 4 (GFS Unread Mark)] -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => E:\MicrosoftOffice\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
ContextMenuHandlers1: [ESET Smart Security - Context Menu Shell Extension] -> {B089FE88-FB52-11D3-BDF1-0050DA34150D} => C:\Program Files\ESET\ESET NOD32 Antivirus\shellExt.dll [2017-10-29] (ESET)
ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext64.dll [2012-06-09] (Alexander Roshal)
ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext.dll [2012-06-09] (Alexander Roshal)
ContextMenuHandlers1-x32-x32: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} => E:\MicrosoftOffice\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
ContextMenuHandlers2: [ESET Smart Security - Context Menu Shell Extension] -> {B089FE88-FB52-11D3-BDF1-0050DA34150D} => C:\Program Files\ESET\ESET NOD32 Antivirus\shellExt.dll [2017-10-29] (ESET)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => E:\Anti-Malware\mbshlext.dll [2017-08-30] (Malwarebytes)
ContextMenuHandlers3-x32: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} => E:\MicrosoftOffice\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
ContextMenuHandlers4: [Offline Files] -> {474C98EE-CF3D-41f5-80E3-4AAB0AB04301} =>  -> No File
ContextMenuHandlers4: [PowerISO] -> {967B2D40-8B7D-4127-9049-61EA0C2C6DCE} =>  -> No File
ContextMenuHandlers4-x32: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} => E:\MicrosoftOffice\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\Windows\system32\nvshext.dll [2017-10-06] (NVIDIA Corporation)
ContextMenuHandlers5-x32: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} => E:\MicrosoftOffice\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
ContextMenuHandlers6: [ESET Smart Security - Context Menu Shell Extension] -> {B089FE88-FB52-11D3-BDF1-0050DA34150D} => C:\Program Files\ESET\ESET NOD32 Antivirus\shellExt.dll [2017-10-29] (ESET)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => E:\Anti-Malware\mbshlext.dll [2017-08-30] (Malwarebytes)
ContextMenuHandlers6: [Offline Files] -> {474C98EE-CF3D-41f5-80E3-4AAB0AB04301} =>  -> No File
ContextMenuHandlers6: [PowerISO] -> {967B2D40-8B7D-4127-9049-61EA0C2C6DCE} =>  -> No File
ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext64.dll [2012-06-09] (Alexander Roshal)
ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext.dll [2012-06-09] (Alexander Roshal)
ContextMenuHandlers6-x32-x32: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} => E:\MicrosoftOffice\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0B342792-F328-4F4B-90C5-8A60277C6C2E} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {1BB487E2-0FD4-41B9-AE95-9EA5803A32D5} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2017-07-19] (Adobe Systems Incorporated)
Task: {3F1E01A6-49AE-49F4-AAFE-B06EFE4BC172} - System32\Tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA GeForce Experience.exe [2017-10-11] (NVIDIA Corporation)
Task: {413706F3-199B-4651-8C7C-79DBD5D93B1B} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-10-11] (NVIDIA Corporation)
Task: {565356D4-C74B-4AFA-99CC-7E9D44F5E638} - System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe [2017-10-11] (NVIDIA Corporation)
Task: {5FDCB098-28B4-4AC4-BEAE-EE7ABDBC8945} - System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-10-11] (NVIDIA Corporation)
Task: {607116DA-D525-45C9-B985-78A879C682B9} - System32\Tasks\Steam-S-1-8-22-9865GUI => C:\Users\User\AppData\Roaming\Steam\Reversed\steam.exe <==== ATTENTION
Task: {6B99D22A-F921-4EEE-BB6A-515C241BA40D} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2014-03-19] (Microsoft)
Task: {84D04AC6-9617-4D84-AD25-FF1A89E814CA} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [2017-10-18] (Piriform Ltd)
Task: {84D573FE-9525-4BA0-9FF8-2DB082998866} - System32\Tasks\{17C10AA8-4CA2-4799-8B4F-673DBE45A03B} => C:\Windows\system32\pcalua.exe -a E:\Steam\steam.exe -c steam://uninstall/43160
Task: {993DC09E-12DC-43B1-A394-5B5E971B750F} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {9EC3CD14-EAFB-400E-BE19-83BA03339966} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-10-25] (Adobe Systems Incorporated)
Task: {AA8F2C72-FAF1-4411-80CD-34F9B5EBB594} - System32\Tasks\{7A829E15-74B1-44C9-B062-EC93DDD53EC1} => "e:\mozilla firefox\firefox.exe" hxxp://ui.skype.com/ui/0/6.22.81.104/ru/abandoninstall?source=lightinstaller&page=tsMain
Task: {AC420625-BCAE-44B7-84B9-9EB4AB267BC9} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {BADFEC94-DCFA-473A-863B-F7A75EC67DE3} - System32\Tasks\{E449AFBF-45C9-40E7-8FA1-F093B3540501} => C:\Windows\system32\pcalua.exe -a C:\Users\User\AppData\Roaming\uTorrent\uTorrent.exe -c /UNINSTALL
Task: {CCA2BA1C-5AC1-47F9-A387-F04486C482DA} - System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-10-11] (NVIDIA Corporation)
Task: {CEEB82B7-8C03-44AC-B4CC-F9488548D95F} - System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe [2017-10-11] (NVIDIA Corporation)
Task: {DD3CB9A7-B0BA-4A08-8755-B1494633260C} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2017-10-18] (Piriform Ltd)
Task: {F190A37F-7A76-4C3A-AF35-84C16B5FFD26} - System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [2017-10-11] (NVIDIA Corporation)
Task: {F50E190C-042C-4989-B247-F2EF160702E3} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-10-11] (NVIDIA Corporation)
Task: {F7DCAA97-48F7-4411-8853-3700665D6D3E} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {FC550B83-8007-4548-AEFE-A4C2DF6F3D2C} - System32\Tasks\{3AC56530-5A21-4BEB-A3E9-3E81C0E5012F} => C:\Windows\system32\pcalua.exe -a "E:\EVGA Precision X\uninstall.exe"

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


Shortcut: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\techno4uk2lo.xyz\Clear Cache.lnk -> E:\techno4uk2lo.xyz\clearcache.bat ()

==================== Loaded Modules (Whitelisted) ==============

2013-07-14 20:08 - 2012-06-01 16:42 - 000920736 _____ () C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe
2017-04-11 15:40 - 2017-10-11 01:05 - 001267136 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\libprotobuf.dll
2013-12-01 23:58 - 2015-02-06 17:41 - 000076152 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2017-10-30 16:17 - 2017-11-09 20:09 - 002289096 _____ () E:\ANTI-MALWARE\SelfProtectionSdk.dll
2017-10-30 16:17 - 2017-11-09 20:09 - 002358728 _____ () E:\ANTI-MALWARE\MwacLib.dll
2012-03-22 21:11 - 2012-03-22 21:11 - 000244944 _____ () E:\bluetooth\CsrSyncMLServer.exe
2014-10-04 13:21 - 2013-04-09 10:05 - 000846848 _____ () E:\tp-link\TWCU.exe
2013-07-14 20:08 - 2017-11-09 20:06 - 000033280 _____ () C:\Program Files (x86)\ASUS\AXSP\1.00.19\PEbiosinterface32.dll
2013-07-14 20:08 - 2010-06-29 09:58 - 000104448 _____ () C:\Program Files (x86)\ASUS\AXSP\1.00.19\ATKEX.dll
2017-04-11 15:40 - 2017-10-11 01:05 - 001040320 _____ () C:\Program Files (x86)\NVIDIA Corporation\NvContainer\libprotobuf.dll
2014-10-04 13:21 - 2013-01-22 13:40 - 001411072 _____ () E:\tp-link\nicLan.dll
2014-10-04 13:21 - 2013-04-02 12:41 - 000193024 _____ () E:\tp-link\DC_WFF.dll
2014-10-04 13:21 - 2013-04-02 12:41 - 000138752 _____ () E:\tp-link\WJWF\WJWF.dll
2014-10-04 13:21 - 2013-02-28 10:42 - 000115712 _____ () E:\tp-link\WJWF\WJWF_WPS_WIN7.DLL
2017-04-11 15:40 - 2017-10-11 01:05 - 070805952 _____ () C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\libcef.dll
2017-09-13 15:24 - 2017-09-13 15:24 - 000172032 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\af090eae04eb9e9104769a5c03783afc\IsdiInterop.ni.dll
2013-06-01 14:51 - 2012-02-01 15:25 - 000059904 _____ () C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IsdiInterop.dll
2013-06-01 14:49 - 2012-06-25 09:41 - 001198912 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\ACE.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\.DEFAULT\...\clonewarsadventures.com -> clonewarsadventures.com
IE trusted site: HKU\.DEFAULT\...\freerealms.com -> freerealms.com
IE trusted site: HKU\.DEFAULT\...\soe.com -> soe.com
IE trusted site: HKU\.DEFAULT\...\sony.com -> sony.com
IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

There are 7866 more sites.

IE trusted site: HKU\S-1-5-19\...\clonewarsadventures.com -> clonewarsadventures.com
IE trusted site: HKU\S-1-5-19\...\freerealms.com -> freerealms.com
IE trusted site: HKU\S-1-5-19\...\soe.com -> soe.com
IE trusted site: HKU\S-1-5-19\...\sony.com -> sony.com
IE trusted site: HKU\S-1-5-20\...\clonewarsadventures.com -> clonewarsadventures.com
IE trusted site: HKU\S-1-5-20\...\freerealms.com -> freerealms.com
IE trusted site: HKU\S-1-5-20\...\soe.com -> soe.com
IE trusted site: HKU\S-1-5-20\...\sony.com -> sony.com
IE trusted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\clonewarsadventures.com -> clonewarsadventures.com
IE trusted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\freerealms.com -> freerealms.com
IE trusted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\soe.com -> soe.com
IE trusted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\sony.com -> sony.com
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\123simsen.com -> www.123simsen.com

There are 7866 more sites.


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 02:34 - 2015-05-19 23:33 - 000449968 ____R C:\Windows\system32\Drivers\etc\hosts

127.0.0.1    localhost
127.0.0.1    www.007guard.com
127.0.0.1    007guard.com
127.0.0.1    008i.com
127.0.0.1    www.008k.com
127.0.0.1    008k.com
127.0.0.1    www.00hq.com
127.0.0.1    00hq.com
127.0.0.1    010402.com
127.0.0.1    www.032439.com
127.0.0.1    032439.com
127.0.0.1    www.0scan.com
127.0.0.1    0scan.com
127.0.0.1    1000gratisproben.com
127.0.0.1    www.1000gratisproben.com
127.0.0.1    1001namen.com
127.0.0.1    www.1001namen.com
127.0.0.1    100888290cs.com
127.0.0.1    www.100888290cs.com
127.0.0.1    www.100sexlinks.com
127.0.0.1    100sexlinks.com
127.0.0.1    10sek.com
127.0.0.1    www.10sek.com
127.0.0.1    www.1-2005-search.com
127.0.0.1    1-2005-search.com
127.0.0.1    123fporn.info
127.0.0.1    www.123fporn.info
127.0.0.1    123haustiereundmehr.com
127.0.0.1    www.123haustiereundmehr.com
127.0.0.1    123moviedownload.com

There are 15466 more lines.


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\User\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{B54ED444-BFDD-4DED-B476-AE915C7F427F}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{9F189A5C-9F95-474F-AD49-23E2D0A64138}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [TCP Query User{86FFE791-CC78-487F-B892-C838848D1854}E:\deusex\system\deusex.exe] => (Allow) E:\deusex\system\deusex.exe
FirewallRules: [UDP Query User{61538EBD-7E20-47E8-B16D-930CB92DAF8C}E:\deusex\system\deusex.exe] => (Allow) E:\deusex\system\deusex.exe
FirewallRules: [{7B44C1DA-58D2-4376-882C-7ACD00888F3D}] => (Allow) E:\Steam\SteamApps\common\Metro Last Light\MetroLL.exe
FirewallRules: [{4C921237-59C5-4162-8366-634275B4C283}] => (Allow) E:\Steam\SteamApps\common\Metro Last Light\MetroLL.exe
FirewallRules: [TCP Query User{AFE4F543-4304-48EF-B1D7-7B6F65B79184}C:\users\user\appdata\roaming\utorrent\utorrent.exe] => (Allow) C:\users\user\appdata\roaming\utorrent\utorrent.exe
FirewallRules: [UDP Query User{7D0C8834-19A8-4407-B972-10322B02F0BD}C:\users\user\appdata\roaming\utorrent\utorrent.exe] => (Allow) C:\users\user\appdata\roaming\utorrent\utorrent.exe
FirewallRules: [{EBDC33FF-6D03-4957-BAA4-6455BE8E4114}] => (Allow) E:\Cracked Steam\steam.exe
FirewallRules: [{A09D1319-BF1C-44AA-B1E3-9E900E1240ED}] => (Allow) E:\Cracked Steam\steam.exe
FirewallRules: [{1BD4F689-7706-4B55-9A0D-20128F7E824B}] => (Allow) E:\Steam\Steam.exe
FirewallRules: [{60E7B069-9246-452F-98A1-582F5A3B2C58}] => (Allow) E:\Steam\Steam.exe
FirewallRules: [TCP Query User{6F852477-2A62-40DF-B4BA-4F2A0BB487BC}E:\planetside 2 psg\planetside2.exe] => (Block) E:\planetside 2 psg\planetside2.exe
FirewallRules: [UDP Query User{164C75E5-254B-4A34-9071-F278492259A1}E:\planetside 2 psg\planetside2.exe] => (Block) E:\planetside 2 psg\planetside2.exe
FirewallRules: [TCP Query User{AD88D92C-DB6E-4C9A-842B-5BED0E01CB72}E:\r.g. catalyst\dmc - devil may cry\binaries\win32\dmc-devilmaycry.exe] => (Block) E:\r.g. catalyst\dmc - devil may cry\binaries\win32\dmc-devilmaycry.exe
FirewallRules: [UDP Query User{DBE49FAB-D60D-4B0F-8A6A-74953C2E88B3}E:\r.g. catalyst\dmc - devil may cry\binaries\win32\dmc-devilmaycry.exe] => (Block) E:\r.g. catalyst\dmc - devil may cry\binaries\win32\dmc-devilmaycry.exe
FirewallRules: [TCP Query User{589F22CB-D377-4780-BF76-A8988461F8FB}E:\milestone\motogp13\motogp13.exe] => (Block) E:\milestone\motogp13\motogp13.exe
FirewallRules: [UDP Query User{CAA1B3B9-EDA3-45CF-B170-06BE6BF9471C}E:\milestone\motogp13\motogp13.exe] => (Block) E:\milestone\motogp13\motogp13.exe
FirewallRules: [TCP Query User{B5104680-1E65-484E-AB71-0E4F5A0CC8CC}E:\games\need for speed most wanted\nfs13.exe] => (Block) E:\games\need for speed most wanted\nfs13.exe
FirewallRules: [UDP Query User{8F760181-62E0-4EAE-B811-B133EF85845A}E:\games\need for speed most wanted\nfs13.exe] => (Block) E:\games\need for speed most wanted\nfs13.exe
FirewallRules: [TCP Query User{373091A7-DE42-4719-9334-C972DA98FE2E}E:\deadpool\updater.exe] => (Allow) E:\deadpool\updater.exe
FirewallRules: [UDP Query User{96A12E9B-4F70-46E6-8FBD-090B263A55B1}E:\deadpool\updater.exe] => (Allow) E:\deadpool\updater.exe
FirewallRules: [TCP Query User{9E8E4EE4-CFD3-4784-80C8-E48CE807196F}E:\sniper ghost warrior 2\bin32\sniperghostwarrior2.exe] => (Allow) E:\sniper ghost warrior 2\bin32\sniperghostwarrior2.exe
FirewallRules: [UDP Query User{09ED14C6-CA31-477F-A080-1471EE7E445F}E:\sniper ghost warrior 2\bin32\sniperghostwarrior2.exe] => (Allow) E:\sniper ghost warrior 2\bin32\sniperghostwarrior2.exe
FirewallRules: [{B44EEDD0-3D9F-443B-84D6-9704AB87C44C}] => (Allow) E:\Crysis 3\Bin32\Crysis3.exe
FirewallRules: [{E607770D-6B19-4640-984E-90E9A88E9EAC}] => (Allow) E:\Crysis 3\Bin32\Crysis3.exe
FirewallRules: [{AED537BB-5F8F-4E96-B260-7C1BD2F83A1D}] => (Allow) E:\Thermal Radar\AI Suite II\AI Suite II.exe
FirewallRules: [{8196553C-95EC-40EE-9539-0A7E5BF15E7C}] => (Allow) E:\Thermal Radar\AI Suite II\AI Suite II.exe
FirewallRules: [TCP Query User{FDEC58E5-4ABD-4712-A541-901D6CE80683}E:\payday\payday 2 beta\payday2_win32_release.exe] => (Block) E:\payday\payday 2 beta\payday2_win32_release.exe
FirewallRules: [UDP Query User{51793186-396D-421F-8163-989BD01BBD80}E:\payday\payday 2 beta\payday2_win32_release.exe] => (Block) E:\payday\payday 2 beta\payday2_win32_release.exe
FirewallRules: [TCP Query User{A6529DA7-DBB3-47EC-B365-408FA710FDAF}E:\payday\payday2_win32_release.exe] => (Allow) E:\payday\payday2_win32_release.exe
FirewallRules: [UDP Query User{2A122569-8F6F-41CB-B117-4AA2F75567ED}E:\payday\payday2_win32_release.exe] => (Allow) E:\payday\payday2_win32_release.exe
FirewallRules: [TCP Query User{4EB34602-DA9F-4246-A0C7-0CF87DEA29D5}E:\games\saints row iv\saintsrowiv.exe] => (Allow) E:\games\saints row iv\saintsrowiv.exe
FirewallRules: [UDP Query User{31CCFC7A-9F1E-4D89-9A2D-CEF550A34B9E}E:\games\saints row iv\saintsrowiv.exe] => (Allow) E:\games\saints row iv\saintsrowiv.exe
FirewallRules: [TCP Query User{D0CBDD17-293E-49FB-BAA8-AF5D6B0B0CC3}E:\splinter cell blacklist\src\system\blacklist_game.exe] => (Allow) E:\splinter cell blacklist\src\system\blacklist_game.exe
FirewallRules: [UDP Query User{204D8240-F54F-4C7C-B548-389BB2EC472A}E:\splinter cell blacklist\src\system\blacklist_game.exe] => (Allow) E:\splinter cell blacklist\src\system\blacklist_game.exe
FirewallRules: [TCP Query User{1588583C-8EDF-4290-9D2B-8B1FC46D7E27}E:\saints row iv\saintsrowiv.exe] => (Allow) E:\saints row iv\saintsrowiv.exe
FirewallRules: [UDP Query User{54263A7C-97E1-496F-830E-82800E9AD4A5}E:\saints row iv\saintsrowiv.exe] => (Allow) E:\saints row iv\saintsrowiv.exe
FirewallRules: [TCP Query User{43927F7D-DCEF-4F51-B66C-234C3DB70E53}E:\total war rome ii\rome2.exe] => (Allow) E:\total war rome ii\rome2.exe
FirewallRules: [UDP Query User{DAA603C5-FAFA-44A2-AF93-0E760C3D481A}E:\total war rome ii\rome2.exe] => (Allow) E:\total war rome ii\rome2.exe
FirewallRules: [TCP Query User{6F05EF35-70F1-4873-9692-FBF292A8F774}E:\outlast\outlast\binaries\win64\olgame.exe] => (Allow) E:\outlast\outlast\binaries\win64\olgame.exe
FirewallRules: [UDP Query User{019C643C-37A5-427A-8743-23D78D126F16}E:\outlast\outlast\binaries\win64\olgame.exe] => (Allow) E:\outlast\outlast\binaries\win64\olgame.exe
FirewallRules: [{FB9566D1-86BD-46E0-AD6E-C756B3184C4E}] => (Allow) E:\Steam\SteamApps\common\Warframe\Tools\Launcher.exe
FirewallRules: [{417CF7D8-E160-4454-AAEE-8F18A0608289}] => (Allow) E:\Steam\SteamApps\common\Warframe\Tools\Launcher.exe
FirewallRules: [{94C6E4CC-9D39-4BB9-A6D4-9CE2DB5186F1}] => (Allow) E:\Steam\steamapps\common\Warframe\Warframe.exe
FirewallRules: [{1071CAE9-F129-4A04-9478-3AE5ED37EDB0}] => (Allow) E:\Steam\steamapps\common\Warframe\Warframe.x64.exe
FirewallRules: [{5E39ADFB-8BA4-4058-8031-2740350ECB77}] => (Allow) E:\Steam\steamapps\common\Warframe\Warframe.exe
FirewallRules: [{8D9C917C-BD20-4D83-B295-9841C4E22D94}] => (Allow) E:\Steam\steamapps\common\Warframe\Warframe.x64.exe
FirewallRules: [{0F81E64F-2532-4DA3-B2DF-3D4210B4EC9D}] => (Allow) E:\Steam\steamapps\common\Warframe\Warframe.exe
FirewallRules: [{18CC0051-2A32-4373-8031-AD252521451B}] => (Allow) E:\Steam\steamapps\common\Warframe\Warframe.x64.exe
FirewallRules: [{E071A8D2-ADF7-4652-AB41-509AEA9B5728}] => (Allow) E:\Steam\steamapps\common\Warframe\Tools\Launcher.exe
FirewallRules: [{B29889B2-E5A9-4CE9-B97A-82E4AB23701D}] => (Allow) E:\Battlefield 4\bf4_x86.exe
FirewallRules: [{F63DD5F3-5E95-45E2-914B-DBE7A4BCE729}] => (Allow) E:\Battlefield 4\bf4_x86.exe
FirewallRules: [{734ED45A-3CC4-4F32-A01C-E0439052D383}] => (Allow) E:\Battlefield 4\bf4.exe
FirewallRules: [{0008FFB2-00CC-4002-9C52-7068A3D0F465}] => (Allow) E:\Battlefield 4\bf4.exe
FirewallRules: [{715E6657-0F48-4D09-BC02-C96D0BB95403}] => (Allow) E:\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{86EDCAD8-9C01-42FC-BC81-DC0F1B752FB8}] => (Allow) E:\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{7FF36C2C-7180-4DA7-9897-3637351E60C6}] => (Allow) E:\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{0D091239-00F4-48E4-AFD1-064049411BBA}] => (Allow) E:\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{9FE3936C-CE4B-43CB-BD3A-81BE79580A62}] => (Allow) E:\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{9E9080B1-37A0-4857-A264-3A7F09E147CF}] => (Allow) E:\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{CC45EADD-9DB8-4D09-A4D7-D062A090778A}] => (Allow) E:\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{8A5568FE-72A8-4ACD-8827-2FD03D807537}] => (Allow) E:\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{5C98876B-6E7A-4A28-82E3-FC6D55C2D5EC}] => (Allow) E:\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{E5C516E8-C25F-4960-85E1-739384D082C9}] => (Allow) E:\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{C8201F37-9B0F-4A9E-AAEC-C5EE7CB2EFBA}] => (Allow) E:\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{775E524A-7166-4D00-B054-834D8FD35393}] => (Allow) E:\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{82104CDC-3744-46A7-8E03-132A579416B5}] => (Allow) E:\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{75BC6C0A-C9BD-4473-B5B1-B6BD649E944E}] => (Allow) E:\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{03DCB2F7-F077-496B-B217-46AE734A2FB8}] => (Allow) E:\MicrosoftOffice\Office12\outlook.exe
FirewallRules: [{9F15FDAD-4B72-41E7-838B-15329184ECAE}] => (Allow) E:\MicrosoftOffice\Office12\GROOVE.EXE
FirewallRules: [{A44E7C1A-CC01-4805-A6BF-D8840257C6E0}] => (Allow) E:\MicrosoftOffice\Office12\GROOVE.EXE
FirewallRules: [{57FD847B-C385-4700-9857-CCA3FE633D95}] => (Allow) E:\MicrosoftOffice\Office12\ONENOTE.EXE
FirewallRules: [{7130F193-1A71-4B46-8924-BC9A5E5AF421}] => (Allow) E:\MicrosoftOffice\Office12\ONENOTE.EXE
FirewallRules: [{F977D01C-40FE-4397-A1CB-ABBE4673AFCA}] => (Allow) E:\Steam\SteamApps\common\rust\rustlauncher.exe
FirewallRules: [{6D6959F3-C503-4D68-8C33-BCE91EF0EDE6}] => (Allow) E:\Steam\SteamApps\common\rust\rustlauncher.exe
FirewallRules: [TCP Query User{1600A18A-C607-485F-9DB9-A2A55DA3448C}E:\games\age of wonders iii\aow3.exe] => (Block) E:\games\age of wonders iii\aow3.exe
FirewallRules: [UDP Query User{053AC47C-9F36-46CD-843E-C7DF8CD82A04}E:\games\age of wonders iii\aow3.exe] => (Block) E:\games\age of wonders iii\aow3.exe
FirewallRules: [TCP Query User{9C3682D6-885F-4A14-8190-5B6EC2581BAC}E:\outlast whistleblower\binaries\win64\olgame.exe] => (Block) E:\outlast whistleblower\binaries\win64\olgame.exe
FirewallRules: [UDP Query User{0EF92391-32E9-4D18-A117-D25AC09E7818}E:\outlast whistleblower\binaries\win64\olgame.exe] => (Block) E:\outlast whistleblower\binaries\win64\olgame.exe
FirewallRules: [TCP Query User{39FD5B66-8073-458C-BA48-C41A9544C8DF}E:\wolfenstein the new order\wolfneworder_x64.exe] => (Block) E:\wolfenstein the new order\wolfneworder_x64.exe
FirewallRules: [UDP Query User{149747EC-10EA-4FA6-9CEA-8654A74C0ADD}E:\wolfenstein the new order\wolfneworder_x64.exe] => (Block) E:\wolfenstein the new order\wolfneworder_x64.exe
FirewallRules: [TCP Query User{BF9C55C3-3C1A-4C4E-AE84-98E9656B3947}E:\games\watch_dogs-digital.deluxe-skidrowcrack\bin\watch_dogs.exe] => (Block) E:\games\watch_dogs-digital.deluxe-skidrowcrack\bin\watch_dogs.exe
FirewallRules: [UDP Query User{64A3D138-CEE7-46CD-87FE-DB4E9F4BA14E}E:\games\watch_dogs-digital.deluxe-skidrowcrack\bin\watch_dogs.exe] => (Block) E:\games\watch_dogs-digital.deluxe-skidrowcrack\bin\watch_dogs.exe
FirewallRules: [TCP Query User{DB797780-E543-4550-A65A-19CF0E974E70}E:\games\watch\bin\watch_dogs.exe] => (Block) E:\games\watch\bin\watch_dogs.exe
FirewallRules: [UDP Query User{BEDDA29B-08CF-474F-AD7A-038D07B440D2}E:\games\watch\bin\watch_dogs.exe] => (Block) E:\games\watch\bin\watch_dogs.exe
FirewallRules: [TCP Query User{FD7B9B7A-95DB-4AE0-AA6E-75DB3AFCE78A}E:\watch dogs\bin\watch_dogs.exe] => (Block) E:\watch dogs\bin\watch_dogs.exe
FirewallRules: [UDP Query User{ED158EA9-15AE-4633-9AB8-35CBD786DDE5}E:\watch dogs\bin\watch_dogs.exe] => (Block) E:\watch dogs\bin\watch_dogs.exe
FirewallRules: [{F8DB68ED-2166-4EF7-BCA9-53743B03EF51}] => (Allow) E:\WATCH_DOGS\bin\Watch_Dogs.exe
FirewallRules: [{B585500F-A89A-4450-A720-E1962FF12B13}] => (Allow) E:\WATCH_DOGS\bin\Watch_Dogs.exe
FirewallRules: [TCP Query User{79BCD06F-CF0D-447F-8ACF-3861FEA57295}E:\abyss odyssey\binaries\win32\ao.exe] => (Block) E:\abyss odyssey\binaries\win32\ao.exe
FirewallRules: [UDP Query User{D18A025A-491C-4B7D-838F-C160CFD9063E}E:\abyss odyssey\binaries\win32\ao.exe] => (Block) E:\abyss odyssey\binaries\win32\ao.exe
FirewallRules: [{F089DCC2-2296-4FFF-AE17-0CBF4D434FE8}] => (Allow) E:\Steam\SteamApps\common\theHunter\launcher\launcher.exe
FirewallRules: [{4B0C5F2D-5B25-4789-A708-8F11D39F2E14}] => (Allow) E:\Steam\SteamApps\common\theHunter\launcher\launcher.exe
FirewallRules: [TCP Query User{CF7AD264-A0BB-445E-8EF2-D112195C9D1B}E:\steam\steamapps\common\thehunter\game\thehunter.exe] => (Block) E:\steam\steamapps\common\thehunter\game\thehunter.exe
FirewallRules: [UDP Query User{160E8EA6-B18A-41C7-B388-10A8D3101636}E:\steam\steamapps\common\thehunter\game\thehunter.exe] => (Block) E:\steam\steamapps\common\thehunter\game\thehunter.exe
FirewallRules: [{A093A7D2-128F-455B-B382-67A02CD8CBC5}] => (Allow) E:\Steam\SteamApps\common\rust\experimental\Rust.exe
FirewallRules: [{225BB74B-4FAF-4A86-BC99-C8A5C351344E}] => (Allow) E:\Steam\SteamApps\common\rust\experimental\Rust.exe
FirewallRules: [{DDF29D9E-0A40-48EA-A902-0562134BFB7D}] => (Allow) E:\Steam\bin\steamwebhelper.exe
FirewallRules: [{504FF56D-9005-4015-8142-5F95AAAA4447}] => (Allow) E:\Steam\bin\steamwebhelper.exe
FirewallRules: [TCP Query User{837DDA74-1040-4A82-A317-D6B6EF2736B6}E:\alien isolation\ai.exe] => (Block) E:\alien isolation\ai.exe
FirewallRules: [UDP Query User{19D78DEB-A0C5-4369-9647-B1786C8CE251}E:\alien isolation\ai.exe] => (Block) E:\alien isolation\ai.exe
FirewallRules: [{1F7CD295-DD87-4540-A7A9-684305F91C22}] => (Allow) E:\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{CCFC10A4-E0E4-46F4-ABA6-456C3B339F98}E:\far cry 4\bin\farcry4.exe] => (Block) E:\far cry 4\bin\farcry4.exe
FirewallRules: [UDP Query User{8755D7BB-8075-4B88-856D-D36464CF5818}E:\far cry 4\bin\farcry4.exe] => (Block) E:\far cry 4\bin\farcry4.exe
FirewallRules: [{55FCB341-1049-4A93-8841-1828D77E3115}] => (Allow) E:\Steam\SteamApps\common\DayZ\DayZ_BE.exe
FirewallRules: [{2F66701D-82AE-40CA-8D84-CDFD9EC6686B}] => (Allow) E:\Steam\SteamApps\common\DayZ\DayZ_BE.exe
FirewallRules: [TCP Query User{8E079106-CEC3-4A50-B151-5A6B6A427695}E:\steam\steamapps\common\h1z1\h1z1.exe] => (Allow) E:\steam\steamapps\common\h1z1\h1z1.exe
FirewallRules: [UDP Query User{35DDA8C7-AF94-42A8-8895-246944711391}E:\steam\steamapps\common\h1z1\h1z1.exe] => (Allow) E:\steam\steamapps\common\h1z1\h1z1.exe
FirewallRules: [TCP Query User{F891B3B7-3268-4857-8273-2601736BCD16}E:\dying light\dyinglightgame.exe] => (Block) E:\dying light\dyinglightgame.exe
FirewallRules: [UDP Query User{29A3B83A-C2AF-4217-8EB1-66D4CA14A7B1}E:\dying light\dyinglightgame.exe] => (Block) E:\dying light\dyinglightgame.exe
FirewallRules: [{908D3CAD-C308-4627-A748-EE7401A44522}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{E50D1761-428C-4B4A-B0E9-670D6B68B9CE}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{2C431BAF-55F5-4988-8FA4-8046680EE278}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{85BC975B-B496-4816-B4E2-B8ACEDBE0E12}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{F749449E-5DDD-48F4-933F-1198D3B57803}] => (Allow) E:\Steam\SteamApps\common\Rust\Legacy\rust.exe
FirewallRules: [{59F2C995-4A55-4463-936C-84A7C5277AB9}] => (Allow) E:\Steam\SteamApps\common\Rust\Legacy\rust.exe
FirewallRules: [TCP Query User{85BA0801-3573-4773-8BF2-6093F47BBF7A}E:\mozilla firefox\firefox.exe] => (Allow) E:\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{7CB0A528-35C9-448B-B3F5-FA475EA036C5}E:\mozilla firefox\firefox.exe] => (Allow) E:\mozilla firefox\firefox.exe
FirewallRules: [TCP Query User{EC572C17-BFA6-42AA-84F1-1A35C4587C93}E:\oddworld - new 'n' tasty\nnt.exe] => (Block) E:\oddworld - new 'n' tasty\nnt.exe
FirewallRules: [UDP Query User{775EDA9F-A462-4219-A795-306733BF2AD0}E:\oddworld - new 'n' tasty\nnt.exe] => (Block) E:\oddworld - new 'n' tasty\nnt.exe
FirewallRules: [TCP Query User{AE572A96-0583-4B5A-BB6E-2F8D500FDFD8}E:\ride\ride.exe] => (Block) E:\ride\ride.exe
FirewallRules: [UDP Query User{B1584C63-740A-46AE-96FD-D9B599B99D1B}E:\ride\ride.exe] => (Block) E:\ride\ride.exe
FirewallRules: [TCP Query User{0992C118-E8FE-4E65-BC60-E3E3BCA2A952}E:\mozilla firefox\firefox.exe] => (Allow) E:\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{4BE46A10-A07B-4849-BD76-2471D32413B5}E:\mozilla firefox\firefox.exe] => (Allow) E:\mozilla firefox\firefox.exe
FirewallRules: [TCP Query User{EA16F3BB-29C7-48B8-B7DB-3525D16BB2F9}E:\grand theft auto v\gta5.exe] => (Block) E:\grand theft auto v\gta5.exe
FirewallRules: [UDP Query User{3E168728-80D3-4D6D-9754-2D672C915E10}E:\grand theft auto v\gta5.exe] => (Block) E:\grand theft auto v\gta5.exe
FirewallRules: [TCP Query User{9E580029-CD92-48FE-AA19-F3BC2C5CF5D2}E:\homesick\binaries\win32\udk.exe] => (Block) E:\homesick\binaries\win32\udk.exe
FirewallRules: [UDP Query User{81F541DB-E13F-478D-B854-A2EEE51B4FFC}E:\homesick\binaries\win32\udk.exe] => (Block) E:\homesick\binaries\win32\udk.exe
FirewallRules: [TCP Query User{E2650989-A5E2-42BA-8159-05974B40EFCA}E:\games\new folder\basement.v0.2.1\64 bit\basement_64.exe] => (Block) E:\games\new folder\basement.v0.2.1\64 bit\basement_64.exe
FirewallRules: [UDP Query User{1B3381FE-35FE-44D8-A31A-CB6EB2CC9380}E:\games\new folder\basement.v0.2.1\64 bit\basement_64.exe] => (Block) E:\games\new folder\basement.v0.2.1\64 bit\basement_64.exe
FirewallRules: [TCP Query User{E03ACFDF-BB9F-4F08-8A0C-866B6B3F79C3}E:\grand ages medieval\grandagesmedieval.exe] => (Block) E:\grand ages medieval\grandagesmedieval.exe
FirewallRules: [UDP Query User{997F27C8-18D8-4909-B9AC-CEB258E6DD39}E:\grand ages medieval\grandagesmedieval.exe] => (Block) E:\grand ages medieval\grandagesmedieval.exe
FirewallRules: [{9C2CE1AE-5AB9-4655-B86D-6E43E83DE63D}] => (Allow) C:\Users\User\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{6E92F72D-CA9C-4C09-93E0-5AEF1B824C37}] => (Allow) C:\Users\User\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{9B07195F-2994-4A8A-8AF0-59559764FCEC}] => (Allow) C:\Users\User\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{18D3BB8B-438F-4207-9FB6-675A2C6655DC}] => (Allow) C:\Users\User\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{FC3B94AE-AFF8-456B-9E97-F1A8DEDD3A85}] => (Allow) C:\Users\User\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{B7FF6E27-C5F3-4082-A971-09B7D5F0C284}] => (Allow) C:\Users\User\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [TCP Query User{0EE78189-D18D-47D3-8254-276CAFD78774}E:\starcraft ii\versions\base39576\sc2_x64.exe] => (Allow) E:\starcraft ii\versions\base39576\sc2_x64.exe
FirewallRules: [UDP Query User{8DEE1412-2003-4893-BFA2-0CC8A68EF8E9}E:\starcraft ii\versions\base39576\sc2_x64.exe] => (Allow) E:\starcraft ii\versions\base39576\sc2_x64.exe
FirewallRules: [TCP Query User{303A4E6C-6F53-4DEB-9AD8-7AF0E3314E1A}E:\firewatch\firewatch.exe] => (Block) E:\firewatch\firewatch.exe
FirewallRules: [UDP Query User{473E6623-9935-4523-8B78-AB032225BC70}E:\firewatch\firewatch.exe] => (Block) E:\firewatch\firewatch.exe
FirewallRules: [{1E595172-5A0C-4277-BA0B-BE8EE6197931}] => (Allow) C:\Steam\steamapps\common\Rust\Rust.exe
FirewallRules: [{D9BA9CE4-9F37-46D5-B8AF-6D40D670A4F2}] => (Allow) C:\Steam\steamapps\common\Rust\Rust.exe
FirewallRules: [{A9E90F00-FD9F-44EF-88BB-A7289D22DB5D}] => (Allow) E:\Steam\SteamApps\common\EvolveGame\bin64_SteamRetail\Evolve.exe
FirewallRules: [{21EC669D-0DDB-4377-B290-ADB70C6DD402}] => (Allow) E:\Steam\SteamApps\common\EvolveGame\bin64_SteamRetail\Evolve.exe
FirewallRules: [{B12FF2F8-1AD2-4F1B-B82B-EFB33A8C14A9}] => (Allow) E:\Steam\SteamApps\common\Euro Truck Simulator 2\bin\win_x86\eurotrucks2.exe
FirewallRules: [{07D77411-72AA-40FA-A211-F54E50EA7A87}] => (Allow) E:\Steam\SteamApps\common\Euro Truck Simulator 2\bin\win_x86\eurotrucks2.exe
FirewallRules: [{5AAC4337-C775-44DB-9815-B438D7B61030}] => (Allow) E:\Steam\SteamApps\common\Euro Truck Simulator 2\bin\win_x64\eurotrucks2.exe
FirewallRules: [{01A45039-9AC5-4C40-B611-22C844319E7C}] => (Allow) E:\Steam\SteamApps\common\Euro Truck Simulator 2\bin\win_x64\eurotrucks2.exe
FirewallRules: [TCP Query User{FDF94FDD-1F0D-454B-AB08-3B20E5DD38D6}E:\mafia iii\launcher.exe] => (Block) E:\mafia iii\launcher.exe
FirewallRules: [UDP Query User{B2DFCA2D-9BD1-4BB4-8813-BB530FA45998}E:\mafia iii\launcher.exe] => (Block) E:\mafia iii\launcher.exe
FirewallRules: [TCP Query User{A9729D5A-0402-4160-8997-AB3BBFE0D65F}E:\mafia iii\mafia3.exe] => (Allow) E:\mafia iii\mafia3.exe
FirewallRules: [UDP Query User{C919FC0E-DB39-49C1-B3F2-AAC935164EAF}E:\mafia iii\mafia3.exe] => (Allow) E:\mafia iii\mafia3.exe
FirewallRules: [{694C29B6-6650-4211-ACD8-996864D1D2C1}] => (Allow) E:\WOT\WoTLauncher.exe
FirewallRules: [{C0A848A0-0F51-4114-A267-241A1FFF893D}] => (Allow) E:\WOT\WoTLauncher.exe
FirewallRules: [{CC7B8C6F-3F6F-41D7-85A9-BE78F2905D31}] => (Allow) E:\WOT\worldoftanks.exe
FirewallRules: [{DF660665-0588-4615-A5D3-2C34DEB9044A}] => (Allow) E:\WOT\worldoftanks.exe
FirewallRules: [TCP Query User{DECB8213-C4B1-41DC-B08B-6152B7EF88EF}E:\games\new folder\farming.simulator.17.v1.2.0.0\dedicatedserver.exe] => (Block) E:\games\new folder\farming.simulator.17.v1.2.0.0\dedicatedserver.exe
FirewallRules: [UDP Query User{31A014F6-45B2-4BA7-B91D-9761F2953A80}E:\games\new folder\farming.simulator.17.v1.2.0.0\dedicatedserver.exe] => (Block) E:\games\new folder\farming.simulator.17.v1.2.0.0\dedicatedserver.exe
FirewallRules: [{2903A95A-C6A6-4249-846F-BB07A6A7AC29}] => (Allow) E:\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{15B9A300-AF37-48F7-A427-15D02F1FB5DA}] => (Allow) E:\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{FE1EBB9D-3564-48BE-B330-166AD716DC80}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{CF9B9BFC-D39D-4BA9-976F-D107FB77BDFD}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{A02C7CB2-E68C-4154-8CF4-8BD6C6712F59}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
FirewallRules: [{237391FC-F868-4B0B-9BD0-89A80871A034}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{213FA747-ECF5-440F-B4A3-8E3F6B5D5F46}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [TCP Query User{6769C8A8-FA80-45D4-B3D4-FB98D2FCAFEC}E:\ubisoft game launcher\games\forhonor\forhonor.exe] => (Allow) E:\ubisoft game launcher\games\forhonor\forhonor.exe
FirewallRules: [UDP Query User{5A68D267-E6DE-406F-AD96-B04B3C299F24}E:\ubisoft game launcher\games\forhonor\forhonor.exe] => (Allow) E:\ubisoft game launcher\games\forhonor\forhonor.exe
FirewallRules: [TCP Query User{F44D96F7-2127-4C11-9065-A584037293B2}E:\battlefield 1\bf1.exe] => (Block) E:\battlefield 1\bf1.exe
FirewallRules: [UDP Query User{E64DFF75-F5C1-427F-8870-F0D9DDF35D6E}E:\battlefield 1\bf1.exe] => (Block) E:\battlefield 1\bf1.exe
FirewallRules: [{4978D042-FB26-48F3-8513-3070EF7BC915}] => (Allow) E:\Steam\SteamApps\common\rocketleague\Binaries\Win32\RocketLeague.exe
FirewallRules: [{21E8A477-4304-4642-8E05-10721F216D3C}] => (Allow) E:\Steam\SteamApps\common\rocketleague\Binaries\Win32\RocketLeague.exe
FirewallRules: [TCP Query User{A0704AE3-CFCD-494A-8F61-0447B718E9E1}E:\sniper ghost warrior 3\win_x64\sgw3.exe] => (Block) E:\sniper ghost warrior 3\win_x64\sgw3.exe
FirewallRules: [UDP Query User{2173B086-B806-46F7-AB48-31F6480783D1}E:\sniper ghost warrior 3\win_x64\sgw3.exe] => (Block) E:\sniper ghost warrior 3\win_x64\sgw3.exe
FirewallRules: [TCP Query User{848E94BA-0871-4B5F-8BB4-D24EE9C71761}E:\steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe] => (Allow) E:\steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe
FirewallRules: [UDP Query User{B7107250-4BAE-4DBB-AFF3-81F718290424}E:\steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe] => (Allow) E:\steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe
FirewallRules: [TCP Query User{4065FBF0-8E89-45FE-A6C0-A63D085F3822}E:\steam\steamapps\common\pubg_test\tslgame\binaries\win64\tslgame.exe] => (Allow) E:\steam\steamapps\common\pubg_test\tslgame\binaries\win64\tslgame.exe
FirewallRules: [UDP Query User{13A063B8-B01E-4F55-BDD4-1C821BD00EDB}E:\steam\steamapps\common\pubg_test\tslgame\binaries\win64\tslgame.exe] => (Allow) E:\steam\steamapps\common\pubg_test\tslgame\binaries\win64\tslgame.exe
FirewallRules: [{4A6C4573-AE18-4ECA-9A52-1B9C3ABFC20E}] => (Allow) E:\Steam\SteamApps\common\Rust\Rust.exe
FirewallRules: [{19616245-6110-420F-8BC9-C46C0568715A}] => (Allow) E:\Steam\SteamApps\common\Rust\Rust.exe
FirewallRules: [TCP Query User{161DE0B1-2373-4AD2-82BA-DADDB72DC5E1}C:\steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe] => (Allow) C:\steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe
FirewallRules: [UDP Query User{88D47919-A191-4839-B9CD-43CCA773A380}C:\steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe] => (Allow) C:\steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe
FirewallRules: [TCP Query User{251159B2-FC80-4A48-9387-D96CD8066F23}E:\thehunter call of the wild\thehuntercotw_f.exe] => (Block) E:\thehunter call of the wild\thehuntercotw_f.exe
FirewallRules: [UDP Query User{C720CFA2-5CE8-4B55-97B0-8B3E14AFB27F}E:\thehunter call of the wild\thehuntercotw_f.exe] => (Block) E:\thehunter call of the wild\thehuntercotw_f.exe
FirewallRules: [{98B5DA6E-9A59-4D16-B4E1-D015263EF6AB}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{7DEE7CB7-F906-45EA-8EE9-C19C3B112922}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{614076A3-9627-4056-A9FC-FA86FC8275B9}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{C825FA0B-861B-4C6F-A96F-61A50399FC28}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{B867B349-1DB0-43DF-9576-31847A212825}] => (Allow) C:\Steam\steamapps\common\PUBG\TslGame\Binaries\Win64\TslGame_BE.exe
FirewallRules: [{DB92DC18-5133-41A9-AE9F-2E94AF6308F2}] => (Allow) C:\Steam\steamapps\common\PUBG\TslGame\Binaries\Win64\TslGame_BE.exe
FirewallRules: [{452BD8A4-B1F5-42A8-8C11-B80FD667F5E2}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [TCP Query User{C18A4E3E-B101-49BE-803D-E5B6C3A82BF9}E:\epic games\launcher\portal\binaries\win32\epicgameslauncher.exe] => (Allow) E:\epic games\launcher\portal\binaries\win32\epicgameslauncher.exe
FirewallRules: [UDP Query User{C629E187-1FB3-4196-ABA2-8C0B0749D400}E:\epic games\launcher\portal\binaries\win32\epicgameslauncher.exe] => (Allow) E:\epic games\launcher\portal\binaries\win32\epicgameslauncher.exe
FirewallRules: [TCP Query User{80D3F534-00B8-442E-9E93-BCF656B8B225}E:\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe] => (Allow) E:\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe
FirewallRules: [UDP Query User{6C9E7920-4911-4A5E-86DB-A81152801DD2}E:\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe] => (Allow) E:\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe
FirewallRules: [TCP Query User{09F605C9-F2DD-4003-ADCB-CCE312A61709}E:\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe] => (Allow) E:\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe
FirewallRules: [UDP Query User{FFC3D11D-5505-4089-BE3F-76DB2F59F3AE}E:\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe] => (Allow) E:\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe

==================== Restore Points =========================

05-11-2017 15:02:58 Installed DirectX
05-11-2017 15:03:32 Installed DirectX
08-11-2017 16:43:32 Windows Update

==================== Faulty Device Manager Devices =============

Name: Hook Test Driver
Description: Hook Test Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: SDHookDriver
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (11/09/2017 08:07:51 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (11/09/2017 08:02:29 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: CsrBtOBEXService.exe, version: 2.1.63.0, time stamp: 0x4f68683b
Faulting module name: CsrBtOBEXService.exe, version: 2.1.63.0, time stamp: 0x4f68683b
Exception code: 0xc0000005
Fault offset: 0x0000000000006f58
Faulting process id: 0x7d8
Faulting application start time: 0x01d3599546c08f34
Faulting application path: E:\bluetooth\CsrBtOBEXService.exe
Faulting module path: E:\bluetooth\CsrBtOBEXService.exe
Report Id: e983e265-c588-11e7-b2ae-08606e7c329b

Error: (11/09/2017 08:01:26 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (11/09/2017 03:21:57 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (11/08/2017 11:11:10 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: CsrBtOBEXService.exe, version: 2.1.63.0, time stamp: 0x4f68683b
Faulting module name: CsrBtOBEXService.exe, version: 2.1.63.0, time stamp: 0x4f68683b
Exception code: 0xc0000005
Fault offset: 0x0000000000006f58
Faulting process id: 0x764
Faulting application start time: 0x01d358b11476873b
Faulting application path: E:\bluetooth\CsrBtOBEXService.exe
Faulting module path: E:\bluetooth\CsrBtOBEXService.exe
Report Id: 1af2e5d6-c4da-11e7-a5a4-08606e7c329b

Error: (11/08/2017 04:47:56 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (11/08/2017 04:45:04 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: CsrBtOBEXService.exe, version: 2.1.63.0, time stamp: 0x4f68683b
Faulting module name: CsrBtOBEXService.exe, version: 2.1.63.0, time stamp: 0x4f68683b
Exception code: 0xc0000005
Fault offset: 0x0000000000006f58
Faulting process id: 0x7d4
Faulting application start time: 0x01d358a85f746def
Faulting application path: E:\bluetooth\CsrBtOBEXService.exe
Faulting module path: E:\bluetooth\CsrBtOBEXService.exe
Report Id: 2b056643-c4a4-11e7-99e1-08606e7c329b

Error: (11/08/2017 03:45:37 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (11/07/2017 10:05:44 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: CsrBtOBEXService.exe, version: 2.1.63.0, time stamp: 0x4f68683b
Faulting module name: CsrBtOBEXService.exe, version: 2.1.63.0, time stamp: 0x4f68683b
Exception code: 0xc0000005
Fault offset: 0x0000000000006f58
Faulting process id: 0x7d8
Faulting application start time: 0x01d357e736ca272e
Faulting application path: E:\bluetooth\CsrBtOBEXService.exe
Faulting module path: E:\bluetooth\CsrBtOBEXService.exe
Report Id: cc752881-c407-11e7-ac1e-08606e7c329b

Error: (11/07/2017 04:42:56 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.


System errors:
=============
Error: (11/09/2017 08:25:45 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: The following fatal alert was received: 40.

Error: (11/09/2017 08:25:45 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: The following fatal alert was received: 70.

Error: (11/09/2017 08:14:36 PM) (Source: atapi) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Ide\IdePort3.

Error: (11/09/2017 08:12:10 PM) (Source: atapi) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Ide\IdePort3.

Error: (11/09/2017 08:06:06 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
SDHookDriver
sptd

Error: (11/09/2017 08:05:53 PM) (Source: sptd) (EventID: 4) (User: )
Description: Driver detected an internal error in its data structures for .

Error: (11/09/2017 08:03:12 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
SDHookDriver
sptd

Error: (11/09/2017 08:02:59 PM) (Source: sptd) (EventID: 4) (User: )
Description: Driver detected an internal error in its data structures for .

Error: (11/09/2017 08:02:30 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The CSR OBEX Service service terminated unexpectedly.  It has done this 1 time(s).

Error: (11/09/2017 07:59:41 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
SDHookDriver
sptd


CodeIntegrity:
===================================
  Date: 2017-09-06 18:00:08.158
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\ProgramData\ESET\ESET NOD32 Antivirus\updfiles\base_nonnups\nod7F8F.dll.nup.raw because the set of per-page image hashes could not be found on the system.

  Date: 2017-09-06 18:00:07.988
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\ProgramData\ESET\ESET NOD32 Antivirus\updfiles\base_nonnups\nod7F8F.dll.nup.raw because the set of per-page image hashes could not be found on the system.

  Date: 2017-09-06 18:00:07.850
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\ProgramData\ESET\ESET NOD32 Antivirus\updfiles\base_nonnups\nod7F8F.dll.nup.raw because the set of per-page image hashes could not be found on the system.

  Date: 2017-09-06 18:00:07.687
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\ProgramData\ESET\ESET NOD32 Antivirus\updfiles\base_nonnups\nod7F8F.dll.nup.raw because the set of per-page image hashes could not be found on the system.

  Date: 2017-09-06 18:00:07.519
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\ProgramData\ESET\ESET NOD32 Antivirus\updfiles\base_nonnups\nod7F8F.dll.nup.raw because the set of per-page image hashes could not be found on the system.

  Date: 2017-09-06 18:00:07.380
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\ProgramData\ESET\ESET NOD32 Antivirus\updfiles\base_nonnups\nod7F8F.dll.nup.raw because the set of per-page image hashes could not be found on the system.

  Date: 2017-09-06 17:58:42.440
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\ESET\ESET NOD32 Antivirus\Modules\em023_64\10844\em023_64.dll.raw because the set of per-page image hashes could not be found on the system.

  Date: 2017-09-06 17:58:42.258
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\ESET\ESET NOD32 Antivirus\Modules\em023_64\10844\em023_64.dll.raw because the set of per-page image hashes could not be found on the system.

  Date: 2017-09-06 17:58:42.106
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\ESET\ESET NOD32 Antivirus\Modules\em023_64\10844\em023_64.dll.raw because the set of per-page image hashes could not be found on the system.

  Date: 2017-09-06 17:58:41.932
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\ESET\ESET NOD32 Antivirus\Modules\em023_64\10844\em023_64.dll.raw because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Processor: Intel® Core™ i7-3770K CPU @ 3.50GHz
Percentage of memory in use: 29%
Total physical RAM: 12234.91 MB
Available physical RAM: 8679.6 MB
Total Virtual: 24468 MB
Available Virtual: 20850.71 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:119.14 GB) (Free:45.81 GB) NTFS
Drive e: () (Fixed) (Total:931.51 GB) (Free:671.17 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 119.2 GB) (Disk ID: 24136AD3)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=119.1 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 952C201B)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================



#6 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 10,253 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:11:58 PM

Posted 09 November 2017 - 06:14 PM

I see no issues with malware. You do however have some issue with Windows Management Instrumentation (WMI). Try this fix, and after a restart try Malwarebytes antimalware.

 

If the issue continues, we can always repair WMI.


Under Hurricane Emergency, expect delays on my responses

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#7 lazystoner

lazystoner
  • Topic Starter

  • Members
  • 68 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:58 AM

Posted 09 November 2017 - 06:26 PM

Hello just stuck a little bit, how do i complete these actions?

 

6) Change Directory to the one containing workaround.vbs: ( Example CD c:\users\%username%

7) Run cscript workaround.vbs



#8 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 10,253 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:11:58 PM

Posted 09 November 2017 - 07:08 PM

Let me see if I can explain it better.

  • Copy the entire contents of the Quote Box below to Notepad (not the word Quote).

strComputer = "."

Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" _
& strComputer & "\root\subscription")

Set obj1 = objWMIService.ExecQuery("select * from __eventfilter where name='BVTFilter' and query='SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA ""Win32_Processor"" AND TargetInstance.LoadPercentage > 99'")

For Each obj1elem in obj1

set obj2set = obj1elem.Associators_("__FilterToConsumerBinding")

set obj3set = obj1elem.References_("__FilterToConsumerBinding")

For each obj2 in obj2set

WScript.echo "Deleting the object"

WScript.echo obj2.GetObjectText_

obj2.Delete_

next

For each obj3 in obj3set

WScript.echo "Deleting the object"

WScript.echo obj3.GetObjectText_

obj3.Delete_

next

WScript.echo "Deleting the object"

WScript.echo obj1elem.GetObjectText_

obj1elem.Delete_

Next

  • Name the file as Workaround.vbs
  • Change the Save as Type to All Files
  • and Save it on the desktop

Once saved, open an Administrator Command Prompt (Start -> type CMD, right click on the CMD file showing in the start menu and select Run as administrator)
 
At the command prompt type the following and press Enter:
 
CHDir /d "%userprofile%\desktop"
 
The prompt will change to the desktop. Then type,
 
cscript workaround.vbs
 
Press Enter.

 

Type Exit to leave the prompt and press Enter. Restart the computer.
 
Let me know the outcome.


Under Hurricane Emergency, expect delays on my responses

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#9 lazystoner

lazystoner
  • Topic Starter

  • Members
  • 68 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:58 AM

Posted 09 November 2017 - 07:23 PM

i did all of that and restarted



#10 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 10,253 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:11:58 PM

Posted 09 November 2017 - 07:28 PM

Run Malwarebytes antimalware and let me know if it freezes


Under Hurricane Emergency, expect delays on my responses

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#11 lazystoner

lazystoner
  • Topic Starter

  • Members
  • 68 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:58 AM

Posted 09 November 2017 - 07:31 PM

yea it froze



#12 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 10,253 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:11:58 PM

Posted 09 November 2017 - 07:38 PM

Print these instruction as the tool we are about to run may restart the computer various times.

Download version mbar-1.10.3.1001-nr.exe of Malwarebytes Anti Rootkit (MBAR)

  • Run the exe as administrator by right clicking and select run as administrator.
  • Click ok to extract.
  • After extraction MBAR should start.
  • If unable to run, rename the file to mypoppy and retry.
  • Click next.
  • Update by hitting the update button.
  • After the update completes hit next.
  • Deselect sectors and system below. Hit the scan button. Please let it finish the scan. This rootkit may slow your machine down and MBAR may look like it will freeze but it will continue to scan. Please allow it to do so.
  • If you get the following error message:

Could not load DDA driver

  • Click Yes and your computer will reboot.
  • After the reboot, the MBAR window should automatically open.

Note: If your Desktop is missing/black, do not worry. This is normal. Please proceed with the remaining instructions below.

  • Click Next followed by Next.
  • Uncheck System and Sectors. Click Scan.
  • If the scan successfully completes, please skip to the Remediation bullet points below.
  • If you receive the same message, "Could not load DDA driver", click Yes.
  • Click OK. Your computer will automatically boot into the Recovery Environment. Proceed with the instructions below afterwards.
  • If Windows did not boot into the recovery environment hold the SHIFT key and click restart computer while holding the shift key down. You should then boot into the boot options menu. Select repair your computer from the list and follow the instructions below.
  • If still not successful from an administrator command prompt in normal windows run the following command:

bcdedit.exe /set {bootmgr} displaybootmenu yes

  • Windows 7:

    Select your desired keyboard layout and click Next.

    Select your user account, enter your user account password (leave blank if you don't have one and click OK.

    Click Command Prompt.

 

  • Windows 10:

    Click Troubleshoot.

    Click Advanced Options followed by Command Prompt.

    Select your account and enter your password if you have one.

 

  • Command Prompt in Recovery Environment:

 

  • Type the following text below into the Command Prompt and press Enter on the keyboard:

BCDEDIT | Find "osdevice"

Note the osdevice partition letter, then type.

X:\mbstart.cmd

Where X is the osdevice letter, and press Enter

  • The tool will start to run.
  • The MBAR window should automatically open.
  • Click Next followed by Next.
  • Uncheck System and Sectors. Click Scan.

 

  • Remediation:

If threats are detected, click the Cleanup button.

If you are prompted to restart, please hit Yes

Upon completion of the scan or after the reboot, two files named  mbar-log.txt and system-log.txt will be created.

Both files can be found in the extracted MBAR folder on your Desktop.

Please attach both files in your next reply.

 


Under Hurricane Emergency, expect delays on my responses

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#13 lazystoner

lazystoner
  • Topic Starter

  • Members
  • 68 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:58 AM

Posted 09 November 2017 - 07:44 PM

no malware found



#14 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 10,253 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:11:58 PM

Posted 09 November 2017 - 08:24 PM

It may be due to low resources. Run Malwarebytes in Safe Mode. That will give you more resources for the application to run properly. If that wont work, remove the application and reinstall.


Under Hurricane Emergency, expect delays on my responses

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#15 lazystoner

lazystoner
  • Topic Starter

  • Members
  • 68 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:58 AM

Posted 10 November 2017 - 12:51 PM

i reinstalled the application but its still keeps on freezing on scans :(






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users