Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Computer freezing when i do a malwarebytes scan


  • Please log in to reply
40 replies to this topic

#16 lazystoner

lazystoner
  • Topic Starter

  • Members
  • 68 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:17 PM

Posted 10 November 2017 - 01:08 PM

wow got a blue screen while trying another scan. says had to shut down pc



BC AdBot (Login to Remove)

 


m

#17 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 10,250 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:06:17 PM

Posted 10 November 2017 - 01:31 PM

Please follow these steps:

1. Uninstall Malwarebytes' Anti-Malware using Add/Remove programs in the control panel.
2. Restart your computer (very important).
3. Download and run this utility. mbam-clean.exe
4. It will ask to restart your computer (please allow it to).
5. After the computer restarts, install the latest version from here. mbam-setup.exe

Launch the program. Then go to the UPDATE tab if not done during installation and check for updates.
Restart the computer again and verify that you can run a quick scan.


Under Hurricane Emergency, expect delays on my responses

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#18 lazystoner

lazystoner
  • Topic Starter

  • Members
  • 68 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:17 PM

Posted 10 November 2017 - 01:49 PM

Ok did all that, quick scan works and it keeps scanning but when i do custom scan and tick "scan for rootkits" it freezes when its scanning for rootkits on file 334 all the time



#19 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 10,250 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:06:17 PM

Posted 10 November 2017 - 05:41 PM

Do you still have Spybot Search and Destroy? If you do, remove it as will interfere with other programs. If you don't, let me know so I can remove some of its entries shown in FRST.


Under Hurricane Emergency, expect delays on my responses

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#20 lazystoner

lazystoner
  • Topic Starter

  • Members
  • 68 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:17 PM

Posted 10 November 2017 - 10:03 PM

no i don't have spybot



#21 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 10,250 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:06:17 PM

Posted 11 November 2017 - 04:02 PM

  • Highlight the entire content of the quote box below.

Start::  
HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
C:\Program Files\Common Files\AV\Spybot - Search and Destroy
C:\Program Files (x86)\Spybot - Search & Destroy 2
S1 SDHookDriver; \??\C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHookDrv64.sys [X]
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) <==== ATTENTION (no ServiceDLL)
HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
Task: {607116DA-D525-45C9-B985-78A879C682B9} - System32\Tasks\Steam-S-1-8-22-9865GUI => C:\Users\User\AppData\Roaming\Steam\Reversed\steam.exe <==== ATTENTION
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll [No File]
ContextMenuHandlers4: [Offline Files] -> {474C98EE-CF3D-41f5-80E3-4AAB0AB04301} =>  -> No File
ContextMenuHandlers4: [PowerISO] -> {967B2D40-8B7D-4127-9049-61EA0C2C6DCE} =>  -> No File
ContextMenuHandlers6: [Offline Files] -> {474C98EE-CF3D-41f5-80E3-4AAB0AB04301} =>  -> No File
ContextMenuHandlers6: [PowerISO] -> {967B2D40-8B7D-4127-9049-61EA0C2C6DCE} =>  -> No File
CMD: winmgmt.exe /verifyrepository
EMPTYTEMP:
Reboot:
End::

  • Right click on the highlighted text and select Copy.
  • Start FRST (FRST64) with Administrator privileges
  • Press the Fix button. FRST will process the lines copied above from the clipboard.
  • When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please copy and paste its contents in your next reply.
 

Please create an mbam-check log:
 

  • Download mbam-check.exe from here and save it to your desktop
  • Double-click on mbam-check.exe to run it, it should then open a log file
  • Please do not copy and paste the entire contents of the log into your next post, instead please attach the log CheckResults.txt file which should now be located on your desktop to your next post

Under Hurricane Emergency, expect delays on my responses

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#22 lazystoner

lazystoner
  • Topic Starter

  • Members
  • 68 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:17 PM

Posted 12 November 2017 - 07:43 AM

Fix result of Farbar Recovery Scan Tool (x64) Version: 12-11-2017
Ran by User (12-11-2017 12:38:59) Run:1
Running from C:\Users\User\Desktop
Loaded Profiles: User (Available Profiles: User)
Boot Mode: Normal
==============================================

fixlist content:
*****************
 
HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
C:\Program Files\Common Files\AV\Spybot - Search and Destroy
C:\Program Files (x86)\Spybot - Search & Destroy 2
S1 SDHookDriver; \??\C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHookDrv64.sys [X]
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) <==== ATTENTION (no ServiceDLL)
HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
Task: {607116DA-D525-45C9-B985-78A879C682B9} - System32\Tasks\Steam-S-1-8-22-9865GUI => C:\Users\User\AppData\Roaming\Steam\Reversed\steam.exe <==== ATTENTION
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll [No File]
ContextMenuHandlers4: [Offline Files] -> {474C98EE-CF3D-41f5-80E3-4AAB0AB04301} =>  -> No File
ContextMenuHandlers4: [PowerISO] -> {967B2D40-8B7D-4127-9049-61EA0C2C6DCE} =>  -> No File
ContextMenuHandlers6: [Offline Files] -> {474C98EE-CF3D-41f5-80E3-4AAB0AB04301} =>  -> No File
ContextMenuHandlers6: [PowerISO] -> {967B2D40-8B7D-4127-9049-61EA0C2C6DCE} =>  -> No File
CMD: winmgmt.exe /verifyrepository
EMPTYTEMP:
Reboot:

*****************

HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\Software\Microsoft\Windows\CurrentVersion\Run\\SpybotPostWindows10UpgradeReInstall => value removed successfully
C:\Program Files\Common Files\AV\Spybot - Search and Destroy => moved successfully
"C:\Program Files (x86)\Spybot - Search & Destroy 2" => not found.
HKLM\System\CurrentControlSet\Services\SDHookDriver => key removed successfully
SDHookDriver => service removed successfully
HKLM\System\CurrentControlSet\Services\AppMgmt => key removed successfully
AppMgmt => service removed successfully
HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\Software\Microsoft\Windows\CurrentVersion\Run\\SpybotPostWindows10UpgradeReInstall => value not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{607116DA-D525-45C9-B985-78A879C682B9} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{607116DA-D525-45C9-B985-78A879C682B9} => key removed successfully
C:\Windows\System32\Tasks\Steam-S-1-8-22-9865GUI => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Steam-S-1-8-22-9865GUI => key removed successfully
HKLM\Software\Wow6432Node\MozillaPlugins\@esn/npbattlelog,version=2.3.2 => key removed successfully
HKLM\Software\Classes\Directory\ShellEx\ContextMenuHandlers\Offline Files => key removed successfully
HKLM\Software\Classes\CLSID\{474C98EE-CF3D-41f5-80E3-4AAB0AB04301} => key not found.
HKLM\Software\Classes\Directory\ShellEx\ContextMenuHandlers\PowerISO => key removed successfully
HKLM\Software\Classes\CLSID\{967B2D40-8B7D-4127-9049-61EA0C2C6DCE} => key not found.
HKLM\Software\Classes\Folder\ShellEx\ContextMenuHandlers\Offline Files => key removed successfully
HKLM\Software\Classes\CLSID\{474C98EE-CF3D-41f5-80E3-4AAB0AB04301} => key not found.
HKLM\Software\Classes\Folder\ShellEx\ContextMenuHandlers\PowerISO => key removed successfully
HKLM\Software\Classes\CLSID\{967B2D40-8B7D-4127-9049-61EA0C2C6DCE} => key not found.

========= winmgmt.exe /verifyrepository =========

WMI repository is consistent

========= End of CMD: =========


=========== EmptyTemp: ==========

BITS transfer queue => 0 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 25492378 B
Java, Flash, Steam htmlcache => 743202937 B
Windows/system/drivers => 542362 B
Edge => 0 B
Chrome => 0 B
Firefox => 387261696 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Users => 0 B
Default => 0 B
Public => 0 B
ProgramData => 0 B
systemprofile => 128 B
systemprofile32 => 38249 B
LocalService => 128 B
NetworkService => 2658 B
User => 21310843 B
UpdatusUser => 0 B
UpdatusUser => 0 B

RecycleBin => 0 B
EmptyTemp: => 1.1 GB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 12:39:08 ====



#23 lazystoner

lazystoner
  • Topic Starter

  • Members
  • 68 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:17 PM

Posted 12 November 2017 - 07:45 AM

You didnt want me to paste that txt into FRST?

 

That link to mbam check says page not found



#24 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 10,250 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:06:17 PM

Posted 12 November 2017 - 12:53 PM

That link to mbam check says page not found

 

Was there yesterday as I run it in my own computer. Will need to ask why was removed. Will post soon.


Under Hurricane Emergency, expect delays on my responses

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#25 lazystoner

lazystoner
  • Topic Starter

  • Members
  • 68 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:17 PM

Posted 12 November 2017 - 12:56 PM

ok thanx



#26 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 10,250 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:06:17 PM

Posted 12 November 2017 - 12:57 PM

Please open FRST, make sure there is a check-mark under addition.txt and click on Scan. Post the new FRST.txt and Addition.txt.


Under Hurricane Emergency, expect delays on my responses

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#27 lazystoner

lazystoner
  • Topic Starter

  • Members
  • 68 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:17 PM

Posted 12 November 2017 - 01:01 PM

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 12-11-2017
Ran by User (administrator) on THEBEAST (12-11-2017 17:59:41)
Running from C:\Users\User\Desktop
Loaded Profiles: User (Available Profiles: User)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
() C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsusFanControlService\1.01.19\AsusFanControlService.exe
(Cambridge Silicon Radio Limited) E:\bluetooth\BtSwitcherService.exe
(Cambridge Silicon Radio Limited) E:\bluetooth\CsrBtOBEXService.exe
(Cambridge Silicon Radio Limited) E:\bluetooth\CsrBtService.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Cambridge Silicon Radio Limited) E:\bluetooth\CsrBtAudioService.exe
(Malwarebytes) E:\Anti-Malware\MBAMService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Cambridge Silicon Radio Limited) E:\bluetooth\CsrHCRPServer.exe
(Cambridge Silicon Radio Limited) E:\bluetooth\CsrAudioguiCtrl.exe
() E:\bluetooth\CsrSyncMLServer.exe
(Cambridge Silicon Radio Limited) E:\bluetooth\vksts.exe
(Cambridge Silicon Radio Limited) E:\bluetooth\HarmonyUserStartup.exe
(Cambridge Silicon Radio Limited) C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe
(Cambridge Silicon Radio Limited) E:\bluetooth\TrayApplication.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
() E:\tp-link\TWCU.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Node.js) C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe
(Malwarebytes) E:\Anti-Malware\mbamtray.exe
(Mozilla Corporation) E:\Mozilla Firefox\firefox.exe
(Mozilla Corporation) E:\Mozilla Firefox\firefox.exe
(Mozilla Corporation) E:\Mozilla Firefox\firefox.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\ShadowPlay\nvsphelper64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe
(Mozilla Corporation) E:\Mozilla Firefox\firefox.exe
(Mozilla Corporation) E:\Mozilla Firefox\firefox.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) E:\Mozilla Firefox\firefox.exe
(Mozilla Corporation) E:\Mozilla Firefox\firefox.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6827664 2012-08-07] (Realtek Semiconductor)
HKLM\...\Run: [CsrHCRPServer] => E:\bluetooth\CsrHCRPServer.exe [1134288 2012-03-22] (Cambridge Silicon Radio Limited)
HKLM\...\Run: [CsrAudioguiCtrl] => E:\bluetooth\CsrAudioguiCtrl.exe [511696 2012-03-22] (Cambridge Silicon Radio Limited)
HKLM\...\Run: [CsrSyncMLServer] => E:\bluetooth\CsrSyncMLServer.exe [244944 2012-03-22] ()
HKLM\...\Run: [vksts] => E:\bluetooth\vksts.exe [25792 2012-03-22] (Cambridge Silicon Radio Limited)
HKLM\...\Run: [HarmonyUserStartup] => E:\bluetooth\HarmonyUserStartup.exe [39128 2012-03-22] (Cambridge Silicon Radio Limited)
HKLM\...\Run: [CSRHarmonySkypePlugin] => C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe [146656 2012-03-22] (Cambridge Silicon Radio Limited)
HKLM\...\Run: [TrayApplication] => E:\bluetooth\TrayApplication.exe [529616 2012-03-22] (Cambridge Silicon Radio Limited)
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET NOD32 Antivirus\ecmdS.exe [324216 2017-10-29] (ESET)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648 2012-05-20] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)
HKLM-x32\...\Run: [GrooveMonitor] => E:\MicrosoftOffice\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [CanonQuickMenu] => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1282120 2013-05-02] (CANON INC.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-09-05] (Oracle Corporation)
HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\Run: [World of Tanks] => "E:\WOT\WargamingGameUpdater.exe"
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\TP-LINK Wireless Configuration Utility.lnk [2014-10-04]
ShortcutTarget: TP-LINK Wireless Configuration Utility.lnk -> E:\tp-link\TWCU.exe ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{170216C7-A7B0-4982-99BC-B8EA812B38C9}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{2A380D94-325E-470B-962D-D1DA11AC100D}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
BHO: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll [2016-02-23] (CANON INC.)
BHO-x32: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll [2016-02-23] (CANON INC.)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> E:\MicrosoftOffice\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\ssv.dll [2017-10-18] (Oracle Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\jp2ssv.dll [2017-10-18] (Oracle Corporation)
Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll [2016-02-23] (CANON INC.)
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll [2016-02-23] (CANON INC.)
Handler-x32: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - E:\MicrosoftOffice\Office12\GrooveSystemServices.dll [2009-02-26] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)

FireFox:
========
FF DefaultProfile: k4rjy2xr.default-1371916095909
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\k4rjy2xr.default-1371916095909 [2017-11-12]
FF Homepage: Mozilla\Firefox\Profiles\k4rjy2xr.default-1371916095909 -> google.com
FF Extension: (Adblock Plus) - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\k4rjy2xr.default-1371916095909\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2017-11-08]
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird => not found
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird => not found
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_27_0_0_183.dll [2017-10-25] ()
FF Plugin: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelogx64.dll [2015-01-13] (EA Digital Illusions CE AB)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_27_0_0_183.dll [2017-10-25] ()
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll [2011-11-30] (CANON INC.)
FF Plugin-x32: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelog.dll [2015-01-13] (EA Digital Illusions CE AB)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.151.2 -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\dtplugin\npDeployJava1.dll [2017-10-18] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.151.2 -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\plugin2\npjp2.dll [2017-10-18] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2017-10-06] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2017-10-06] (NVIDIA Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 -> E:\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-07-31] (Adobe Systems Inc.)
StartMenuInternet: FIREFOX.EXE - E:\Mozilla Firefox\firefox.exe

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe [920736 2012-06-01] ()
R2 asHmComSvc; C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe [951936 2012-06-01] (ASUSTeK Computer Inc.)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe [149120 2012-02-17] (ASUSTeK Computer Inc.)
R2 AsusFanControlService; C:\Program Files (x86)\ASUS\AsusFanControlService\1.01.19\AsusFanControlService.exe [408960 2012-10-15] (ASUSTeK Computer Inc.)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [1547200 2017-11-05] ()
R2 BtSwitcherService; E:\bluetooth\BtSwitcherService.exe [64216 2012-03-22] (Cambridge Silicon Radio Limited)
R2 CSRBtAudioService; E:\bluetooth\CsrBtAudioService.exe [465624 2012-03-22] (Cambridge Silicon Radio Limited)
R2 CsrBtOBEXService; E:\bluetooth\CsrBtOBEXService.exe [1041616 2012-03-22] (Cambridge Silicon Radio Limited)
R2 CsrBtService; E:\bluetooth\CsrBtService.exe [825032 2012-03-22] (Cambridge Silicon Radio Limited)
S3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [372512 2017-04-14] (EasyAntiCheat Ltd)
R2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2648184 2017-10-29] (ESET)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [File not signed]
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
R2 MBAMService; E:\Anti-Malware\mbamservice.exe [6234056 2017-11-01] (Malwarebytes)
S3 Microsoft Office Groove Audit Service; E:\MicrosoftOffice\Office12\GrooveAuditService.exe [64856 2009-02-26] (Microsoft Corporation)
R2 NvContainerLocalSystem; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [518080 2017-10-11] (NVIDIA Corporation)
S3 NvContainerNetworkService; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [518080 2017-10-11] (NVIDIA Corporation)
R2 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [462968 2017-10-06] (NVIDIA Corporation)
R2 NvTelemetryContainer; C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe [460736 2017-10-11] (NVIDIA Corporation)
S3 Origin Client Service; E:\Origin\OriginClientService.exe [2122248 2016-08-25] (Electronic Arts)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2015-02-06] ()
S2 SkypeUpdate; E:\Skype\Updater\Updater.exe [327296 2015-07-09] (Skype Technologies)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R0 asahci64; C:\Windows\System32\DRIVERS\asahci64.sys [49760 2012-01-06] (Asmedia Technology)
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2012-08-22] ()
S3 csravrcp; C:\Windows\System32\DRIVERS\csravrcp.sys [26304 2012-03-22] (Cambridge Silicon Radio Limited)
S3 CsrBthAudioHF; C:\Windows\System32\DRIVERS\CsrBthAudioHF.sys [39120 2012-03-22] (Cambridge Silicon Radio Limited)
S3 CsrBtPort; C:\Windows\System32\DRIVERS\CsrBtPort.sys [2784968 2012-03-22] (Cambridge Silicon Radio Limited)
S3 csrhfgcc; C:\Windows\System32\DRIVERS\csrhfgcc.sys [38080 2012-03-22] (Cambridge Silicon Radio Limited)
S3 csrpan; C:\Windows\System32\DRIVERS\csrpan.sys [39616 2012-03-22] (Cambridge Silicon Radio Limited)
S3 csrserial; C:\Windows\System32\DRIVERS\csrserial.sys [61128 2012-03-22] (Cambridge Silicon Radio Limited)
S3 csrusb; C:\Windows\System32\Drivers\csrusb.sys [47296 2012-03-22] (Cambridge Silicon Radio Limited)
S3 csrusbfilter; C:\Windows\System32\Drivers\csrusbfilter.sys [23752 2012-03-22] (Cambridge Silicon Radio Limited)
S3 csr_bthav; C:\Windows\System32\drivers\csrbthav.sys [99520 2012-03-22] (Cambridge Silicon Radio Limited)
S3 dg_ssudbus; C:\Windows\System32\DRIVERS\ssudbus.sys [131984 2017-05-18] (Samsung Electronics Co., Ltd.)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [132848 2017-10-29] (ESET)
U5 edevmon; C:\Windows\System32\Drivers\edevmon.sys [251632 2015-07-12] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [180088 2017-10-29] (ESET)
R1 epfwwfpr; C:\Windows\System32\DRIVERS\epfwwfpr.sys [77736 2017-10-29] (ESET)
R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [77432 2017-11-01] ()
R2 MBAMChameleon; C:\Windows\System32\Drivers\MbamChameleon.sys [193464 2017-11-10] (Malwarebytes)
R3 MBAMFarflt; C:\Windows\System32\DRIVERS\farflt.sys [110016 2017-11-12] (Malwarebytes)
R3 MBAMProtection; C:\Windows\System32\DRIVERS\mbam.sys [46008 2017-11-12] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [253880 2017-11-12] (Malwarebytes)
R3 MBAMWebProtection; C:\Windows\System32\DRIVERS\mwac.sys [84256 2017-11-12] (Malwarebytes)
S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [30144 2017-10-11] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [50624 2017-10-11] (NVIDIA Corporation)
R3 nvvhci; C:\Windows\System32\DRIVERS\nvvhci.sys [57976 2017-05-03] (NVIDIA Corporation)
S0 sptd; C:\Windows\System32\Drivers\sptd.sys [868848 2013-09-22] (Duplex Secure Ltd.)
S3 ssudmdm; C:\Windows\System32\DRIVERS\ssudmdm.sys [166288 2017-05-18] (Samsung Electronics Co., Ltd.)
R3 WirelessKeyboardFilter; C:\Windows\System32\DRIVERS\WirelessKeyboardFilter.sys [49896 2016-07-22] (Microsoft Corporation)
S3 XSplit_Dummy; C:\Windows\System32\drivers\xspltspk.sys [26200 2014-07-02] (SplitmediaLabs Limited)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-11-12 17:59 - 2017-11-12 17:59 - 000018526 _____ C:\Users\User\Desktop\FRST.txt
2017-11-12 12:38 - 2017-11-12 12:39 - 000004710 _____ C:\Users\User\Desktop\Fixlog.txt
2017-11-12 12:37 - 2017-11-12 12:37 - 002392576 _____ (Farbar) C:\Users\User\Desktop\FRST64.exe
2017-11-10 18:42 - 2017-11-12 17:15 - 000084256 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
2017-11-10 18:42 - 2017-11-12 17:09 - 000253880 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys
2017-11-10 18:42 - 2017-11-12 17:09 - 000110016 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
2017-11-10 18:42 - 2017-11-12 17:09 - 000046008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2017-11-10 18:42 - 2017-11-10 18:42 - 000193464 _____ (Malwarebytes) C:\Windows\system32\Drivers\MbamChameleon.sys
2017-11-10 18:42 - 2017-11-10 18:42 - 000000598 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-11-10 18:42 - 2017-11-10 18:42 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-11-10 18:42 - 2017-11-01 08:54 - 000077432 _____ C:\Windows\system32\Drivers\mbae64.sys
2017-11-10 18:41 - 2017-11-10 18:41 - 000000000 ____D C:\ProgramData\Malwarebytes
2017-11-10 18:22 - 2017-11-10 18:22 - 000255928 _____ (Malwarebytes) C:\Windows\system32\Drivers\74621475.sys
2017-11-10 18:07 - 2017-11-10 18:07 - 768107630 ____N C:\Windows\MEMORY.DMP
2017-11-10 18:07 - 2017-11-10 18:07 - 000408472 _____ C:\Windows\Minidump\111017-27924-01.dmp
2017-11-10 18:01 - 2017-11-10 18:01 - 000566128 _____ (Malwarebytes) C:\Users\User\Desktop\mbam-clean-2.3.0.1001.exe
2017-11-10 17:43 - 2017-11-10 17:43 - 000255928 _____ (Malwarebytes) C:\Windows\system32\Drivers\34564651.sys
2017-11-10 00:41 - 2017-11-10 00:41 - 000255928 _____ (Malwarebytes) C:\Windows\system32\Drivers\F773B71F.sys
2017-11-10 00:40 - 2017-11-10 18:22 - 000000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2017-11-08 16:43 - 2017-10-18 02:34 - 000134376 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2017-11-08 16:43 - 2017-10-18 02:30 - 000605184 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2017-11-08 16:43 - 2017-10-15 22:04 - 000407392 _____ (Microsoft Corporation) C:\Windows\system32\centel.dll
2017-11-08 16:43 - 2017-10-04 13:04 - 002023936 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2017-11-08 16:43 - 2017-10-04 13:04 - 001570304 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2017-11-08 16:43 - 2017-10-04 13:04 - 000670208 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2017-11-08 16:43 - 2017-10-04 13:04 - 000603648 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2017-11-08 16:43 - 2017-10-04 13:04 - 000370688 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2017-11-08 16:43 - 2017-10-04 13:04 - 000241664 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2017-11-08 16:43 - 2017-10-04 13:04 - 000181760 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2017-11-05 15:40 - 2017-11-05 15:40 - 000000000 ____D C:\Users\User\AppData\Local\FortniteGame
2017-11-05 15:03 - 2017-11-05 15:03 - 000000000 ____D C:\Users\User\AppData\Local\UnrealEngineLauncher
2017-11-05 15:03 - 2017-11-05 15:03 - 000000000 ____D C:\Users\User\AppData\Local\EpicGamesLauncher
2017-11-05 15:02 - 2017-11-05 15:03 - 000000000 ____D C:\ProgramData\Epic
2017-11-05 15:02 - 2017-11-05 15:02 - 000000805 _____ C:\Users\Public\Desktop\Epic Games Launcher.lnk
2017-11-05 15:02 - 2017-11-05 15:02 - 000000805 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk
2017-11-02 16:09 - 2017-11-02 16:09 - 000000000 ____D C:\Users\User\Documents\mods
2017-10-31 18:29 - 2017-10-31 18:29 - 000000000 ____D C:\ProgramData\Sophos
2017-10-31 16:33 - 2017-11-12 17:59 - 000000000 ____D C:\FRST
2017-10-19 18:18 - 2017-09-07 15:07 - 000344064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2017-10-19 18:18 - 2017-09-07 15:07 - 000327168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2017-10-19 18:18 - 2017-09-07 15:07 - 000099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2017-10-19 18:18 - 2017-09-07 15:07 - 000056320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2017-10-19 18:18 - 2017-09-07 15:07 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2017-10-19 18:18 - 2017-09-07 15:07 - 000025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2017-10-19 18:18 - 2017-09-07 15:07 - 000007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2017-10-19 18:18 - 2017-09-07 13:05 - 000995272 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000922432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ucrtbase.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000066400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-private-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000063840 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000022368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-math-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000020832 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000019808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000019808 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000017760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-string-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000017760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000016224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000016224 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000015712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000015712 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000014176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-time-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000014176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000013664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000013664 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l2-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2017-10-19 18:18 - 2017-09-07 13:05 - 000011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
2017-10-18 18:59 - 2017-10-18 18:59 - 000000000 ____D C:\Users\Public\Documents\uPlay
2017-10-18 15:58 - 2017-10-18 15:58 - 000000796 _____ C:\Users\Public\Desktop\South Park The Fractured but Whole.lnk
2017-10-17 16:51 - 2017-10-30 16:01 - 000000000 ____D C:\Users\User\Documents\WB Games
2017-10-17 14:38 - 2017-10-06 11:52 - 000136312 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2017-10-17 14:38 - 2017-09-13 23:20 - 000798008 _____ C:\Windows\SysWOW64\vulkan-1.dll
2017-10-17 14:38 - 2017-09-13 23:20 - 000490296 _____ C:\Windows\SysWOW64\vulkaninfo.exe
2017-10-17 14:38 - 2017-09-13 23:19 - 000927544 _____ C:\Windows\system32\vulkan-1.dll
2017-10-17 14:38 - 2017-09-13 23:19 - 000591160 _____ C:\Windows\system32\vulkaninfo.exe
2017-10-17 14:36 - 2017-10-09 12:20 - 000225208 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2017-10-17 14:36 - 2017-10-09 12:20 - 000045496 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 040237176 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 036184000 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 035156600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 029228480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 023261256 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 019035344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 018203456 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 016751224 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2017-10-17 14:36 - 2017-10-06 13:32 - 013863000 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 013251240 _____ (NVIDIA Corporation) C:\Windows\system32\nvptxJitCompiler.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 011777952 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 010880672 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvptxJitCompiler.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 003807864 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 003346368 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 001988216 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6438792.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 001606776 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6438792.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 001135280 _____ (NVIDIA Corporation) C:\Windows\system32\nvfatbinaryLoader.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 001098360 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 001030264 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 000981112 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 000932472 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 000885496 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvfatbinaryLoader.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 000615360 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 000527104 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 000505976 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 000444328 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 000407248 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 000171896 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 000154392 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 000149736 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 000132256 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2017-10-17 14:36 - 2017-10-06 13:32 - 000000669 _____ C:\Windows\SysWOW64\nv-vk32.json
2017-10-17 14:36 - 2017-10-06 13:32 - 000000669 _____ C:\Windows\system32\nv-vk64.json
2017-10-16 19:35 - 2017-10-16 19:35 - 000000000 ____D C:\Users\User\AppData\Local\TangoGameworks
2017-10-16 19:34 - 2017-10-11 01:05 - 000050624 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2017-10-15 11:57 - 2017-10-15 11:57 - 000000000 ____D C:\Users\User\AppData\LocalLow\CodeHorizon

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-11-12 17:15 - 2009-07-14 05:13 - 000782470 _____ C:\Windows\system32\PerfStringBackup.INI
2017-11-12 17:15 - 2009-07-14 03:20 - 000000000 ____D C:\Windows\inf
2017-11-12 17:14 - 2009-07-14 04:45 - 000029136 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-11-12 17:14 - 2009-07-14 04:45 - 000029136 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-11-12 17:09 - 2016-11-18 09:05 - 000000000 ____D C:\Users\User\AppData\LocalLow\Mozilla
2017-11-12 17:09 - 2013-06-01 15:03 - 000000000 ____D C:\ProgramData\NVIDIA
2017-11-12 17:09 - 2009-07-14 05:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2017-11-12 12:39 - 2015-07-28 18:15 - 000000000 ____D C:\Program Files\Common Files\AV
2017-11-12 12:39 - 2013-07-14 22:38 - 000000000 ____D C:\Users\User\AppData\LocalLow\Temp
2017-11-10 18:07 - 2014-03-10 13:56 - 000000000 ____D C:\Windows\Minidump
2017-11-10 17:56 - 2016-05-12 17:55 - 000000000 ____D C:\Users\User\AppData\Local\CrashDumps
2017-11-10 00:21 - 2013-06-07 23:40 - 000000000 ____D C:\Users\User\AppData\Roaming\vlc
2017-11-09 21:37 - 2016-01-17 15:10 - 000000000 ____D C:\Users\User\AppData\Roaming\uTorrent
2017-11-09 20:28 - 2013-06-01 23:28 - 000000000 ____D C:\Windows\Panther
2017-11-09 17:01 - 2017-06-04 13:03 - 000000000 ____D C:\Users\User\AppData\Roaming\techno4uk2lo.xyz
2017-11-08 16:45 - 2014-12-10 16:41 - 000000000 ____D C:\Windows\system32\appraiser
2017-11-05 15:40 - 2017-05-09 18:36 - 000000000 ____D C:\Users\User\AppData\Local\UnrealEngine
2017-11-05 15:03 - 2013-06-07 18:14 - 000000000 ____D C:\ProgramData\Package Cache
2017-11-04 15:47 - 2013-07-27 11:52 - 000000000 ____D C:\Users\User\AppData\Local\NVIDIA
2017-10-30 04:08 - 2009-07-14 05:08 - 000032608 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2017-10-29 17:11 - 2015-07-12 23:14 - 000180088 _____ (ESET) C:\Windows\system32\Drivers\ehdrv.sys
2017-10-29 17:11 - 2015-07-12 23:14 - 000132848 _____ (ESET) C:\Windows\system32\Drivers\eamonm.sys
2017-10-29 17:11 - 2015-07-12 23:14 - 000077736 _____ (ESET) C:\Windows\system32\Drivers\epfwwfpr.sys
2017-10-25 16:44 - 2014-09-15 19:57 - 000004312 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2017-10-25 16:44 - 2013-06-01 18:41 - 000803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-10-25 16:44 - 2013-06-01 18:41 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-10-25 16:44 - 2013-06-01 18:41 - 000000000 ____D C:\Windows\SysWOW64\Macromed
2017-10-25 16:44 - 2013-06-01 18:41 - 000000000 ____D C:\Windows\system32\Macromed
2017-10-20 14:17 - 2009-07-14 03:20 - 000000000 ____D C:\Windows\rescache
2017-10-19 18:19 - 2013-06-01 19:35 - 000766336 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2017-10-18 19:17 - 2015-11-12 17:00 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2017-10-18 19:17 - 2014-10-15 21:12 - 000000000 ____D C:\Program Files (x86)\Java
2017-10-18 19:16 - 2015-11-12 17:00 - 000097856 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2017-10-18 18:58 - 2013-06-07 18:15 - 000000000 ____D C:\Users\User\Documents\My Games
2017-10-17 14:39 - 2017-04-08 12:15 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2017-10-17 14:39 - 2013-06-01 15:03 - 000000000 ____D C:\ProgramData\NVIDIA Corporation
2017-10-17 14:38 - 2017-01-27 17:06 - 000000000 ____D C:\Program Files (x86)\VulkanRT
2017-10-17 14:38 - 2013-06-01 20:53 - 000000000 ____D C:\Users\User\AppData\Roaming\NVIDIA
2017-10-17 14:37 - 2013-06-01 15:03 - 000000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2017-10-17 14:37 - 2013-06-01 15:02 - 000000000 ____D C:\Program Files\NVIDIA Corporation
2017-10-16 19:34 - 2017-05-10 17:43 - 000003814 _____ C:\Windows\System32\Tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-10-16 19:34 - 2017-04-11 15:40 - 000004146 _____ C:\Windows\System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-10-16 19:34 - 2017-04-11 15:40 - 000003798 _____ C:\Windows\System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-10-16 19:34 - 2017-04-11 15:40 - 000003738 _____ C:\Windows\System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-10-16 19:34 - 2017-04-11 15:40 - 000003738 _____ C:\Windows\System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-10-16 19:34 - 2017-04-11 15:40 - 000003730 _____ C:\Windows\System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-10-16 19:34 - 2017-04-11 15:40 - 000003554 _____ C:\Windows\System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-10-16 19:34 - 2017-04-11 15:40 - 000003494 _____ C:\Windows\System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-10-16 19:34 - 2017-04-11 15:40 - 000001416 _____ C:\Users\Public\Desktop\GeForce Experience.lnk
2017-10-16 19:32 - 2013-06-06 20:42 - 000000000 ____D C:\Windows\SysWOW64\directx

==================== Files in the root of some directories =======

2014-11-10 16:12 - 2017-06-11 15:22 - 002032640 _____ () C:\Users\User\AppData\Local\file__0.localstorage
2015-05-22 18:34 - 2015-05-22 18:34 - 000000000 ___SH () C:\Users\User\AppData\Local\LumaEmu
2014-03-04 20:36 - 2017-09-17 14:58 - 000007600 _____ () C:\Users\User\AppData\Local\resmon.resmoncfg
2008-02-05 13:28 - 2008-02-05 13:28 - 000000051 _____ () C:\Users\User\AppData\Local\setup.txt

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-11-10 13:04

==================== End of FRST.txt ============================

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-11-2017
Ran by User (12-11-2017 17:59:57)
Running from C:\Users\User\Desktop
Windows 7 Home Premium Service Pack 1 (X64) (2013-06-01 14:43:48)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-2683171744-3939096081-1905568632-500 - Administrator - Disabled)
Guest (S-1-5-21-2683171744-3939096081-1905568632-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2683171744-3939096081-1905568632-1003 - Limited - Enabled)
User (S-1-5-21-2683171744-3939096081-1905568632-1000 - Administrator - Enabled) => C:\Users\User

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
AV: ESET NOD32 Antivirus (Enabled - Up to date) {EC1D6F37-E411-475A-DF50-12FF7FE4AC70}
AS: ESET NOD32 Antivirus (Enabled - Up to date) {577C8ED3-C22B-48D4-E5E0-298D0463E6CD}
AS: Malwarebytes (Enabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\uTorrent) (Version: 3.5.0.44090 - BitTorrent Inc.)
Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 17.012.20098 - Adobe Systems Incorporated)
Adobe Flash Player 27 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 27.0.0.183 - Adobe Systems Incorporated)
Adobe Flash Player 27 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 27.0.0.183 - Adobe Systems Incorporated)
Ansel (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Ansel) (Version: 387.92 - NVIDIA Corporation) Hidden
Asmedia ASM104x USB 3.0 Host Controller Driver (HKLM-x32\...\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.14.3.0 - Asmedia Technology)
Asmedia ASM106x SATA Host Controller Driver (HKLM-x32\...\{61942EF5-2CD8-47D4-869C-2E9A8BB085F1}) (Version: 1.3.4.000 - Asmedia Technology)
Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 2.6.2 - EA Digital Illusions CE AB)
BattlEye for OA Uninstall (HKLM-x32\...\BattlEye for OA) (Version:  - )
BattlEye Uninstall (HKLM-x32\...\BattlEye for A2) (Version:  - )
Canon Easy-WebPrint EX (HKLM-x32\...\Easy-WebPrint EX) (Version: 1.7.0.0 - Canon Inc.)
Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version:  - Canon Inc.)
Canon MG2500 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG2500_series) (Version: 1.00 - Canon Inc.)
Canon MG2500 series On-screen Manual (HKLM-x32\...\Canon MG2500 series On-screen Manual) (Version: 7.6.1 - Canon Inc.)
Canon MG2500 series User Registration (HKLM-x32\...\Canon MG2500 series User Registration) (Version:  - ‭Canon Inc.)
Canon My Image Garden (HKLM-x32\...\Canon My Image Garden) (Version: 2.0.1 - Canon Inc.)
Canon My Image Garden Design Files (HKLM-x32\...\Canon My Image Garden Design Files) (Version: 2.0.0 - Canon Inc.)
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: 3.1.0 - Canon Inc.)
Canon Quick Menu (HKLM-x32\...\CanonQuickMenu) (Version: 2.2.1 - Canon Inc.)
CSR Harmony Wireless Software Stack (HKLM\...\{17DEA095-8EE1-49A2-AC5A-9663DB098FA9}) (Version: 2.1.63.0 - Cambridge Silicon Radio Limited.)
Epic Games Launcher (HKLM-x32\...\{6F15D7C1-3079-4135-B8E9-8D3EA033EE3A}) (Version: 1.1.129.0 - Epic Games, Inc.)
Epic Games Launcher Prerequisites (x64) (HKLM\...\{66C5838F-B854-4A55-89E6-A6138747A4DF}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden
ESET NOD32 Antivirus (HKLM\...\{3B4AB7BA-0734-4547-9604-3FCC40873B3D}) (Version: 10.1.219.0 - ESET, spol. s r.o.)
EVGA Precision X 4.2.1 (HKLM-x32\...\PrecisionX) (Version: 4.2.1 - EVGA Corporation)
Folder Size 3.4.0.0 (HKLM-x32\...\{2DFA85ED-588F-4CE3-A175-29E52C3804A8}_is1) (Version: 3.4.0.0 - MindGems, Inc.)
Geeks3D FurMark 1.19.0.0 (HKLM-x32\...\{2397CAD4-2263-4CD0-96BE-E43A980B9C9A}_is1) (Version:  - Geeks3D)
Intel® Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel® Network Connections 17.3.63.0 (HKLM\...\PROSetDX) (Version: 17.3.63.0 - Intel)
Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.1.0.1006 - Intel Corporation)
Intel® USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.5.235 - Intel Corporation)
Java 8 Update 151 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180151F0}) (Version: 8.0.1510.12 - Oracle Corporation)
Launcher Prerequisites (x64) (HKLM-x32\...\{c6c5a357-c7ca-4a5f-9789-3bb1af579253}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden
Malwarebytes version 3.3.1.2183 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.3.1.2183 - Malwarebytes)
Microsoft .NET Framework 4.7 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.7.02053 - Microsoft Corporation)
Microsoft Mouse and Keyboard Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.3.188.0 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{51adbf11-493f-431c-a862-967a0fae2944}) (Version: 12.0.21005.1 - Корпорация Майкрософт)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}) (Version: 12.0.21005.1 - Корпорация Майкрософт)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 (HKLM-x32\...\{d992c12e-cab2-426f-bde3-fb8c53950b0d}) (Version: 14.0.24215.1 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
Mozilla Firefox 56.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 56.0 (x86 en-US)) (Version: 56.0 - Mozilla)
Mozilla Firefox 56.0.2 (x64 en-US) (HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\Mozilla Firefox 56.0.2 (x64 en-US)) (Version: 56.0.2 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser and SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
NVIDIA 3D Vision Controller Driver 369.04 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 369.04 - NVIDIA Corporation)
NVIDIA 3D Vision Driver 387.92 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 387.92 - NVIDIA Corporation)
NVIDIA GeForce Experience 3.10.0.95 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 3.10.0.95 - NVIDIA Corporation)
NVIDIA Graphics Driver 387.92 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 387.92 - NVIDIA Corporation)
NVIDIA HD Audio Driver 1.3.35.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.35.1 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.17.0524 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.17.0524 - NVIDIA Corporation)
Origin (HKLM-x32\...\Origin) (Version: 9.3.11.2762 - Electronic Arts, Inc.)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.994 - Even Balance, Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6699 - Realtek Semiconductor Corp.)
Skype™ 7.18 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.18.112 - Skype Technologies S.A.)
South Park: The Fractured but Whole - Gold Edition (HKLM-x32\...\South Park: The Fractured but Whole - Gold Edition_is1) (Version:  - )
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
TeamSpeak 3 Client (HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\TeamSpeak 3 Client) (Version: 3.0.18 - TeamSpeak Systems GmbH)
techno4uk2lo.xyz (HKLM-x32\...\techno4uk2lo.xyz) (Version: 2.69.3-20160414 - Jo2003)
TP-LINK TL-WDN4800 Driver (HKLM-x32\...\{FDA7E907-6539-42C1-9721-0239C281B336}) (Version: 1.3.1 - TP-LINK)
TP-LINK Wireless Configuration Utility (HKLM-x32\...\{319D91C6-3D44-436C-9F79-36C0D22372DC}) (Version: 1.3.1 - TP-LINK)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.1 - VideoLAN)
Vulkan Run Time Libraries 1.0.61.0 (HKLM\...\VulkanRT1.0.61.0) (Version: 1.0.61.0 - LunarG, Inc.) Hidden
WinDirStat 1.1.2 (HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\WinDirStat) (Version:  - )
WinRAR 4.20 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

ShellIconOverlayIdentifiers-x32-x32: [Groove Explorer Icon Overlay 1 (GFS Unread Stub)] -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => E:\MicrosoftOffice\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32-x32-x32: [Groove Explorer Icon Overlay 2 (GFS Stub)] -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => E:\MicrosoftOffice\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32-x32-x32-x32: [Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)] -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => E:\MicrosoftOffice\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32-x32-x32-x32-x32: [Groove Explorer Icon Overlay 3 (GFS Folder)] -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => E:\MicrosoftOffice\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32-x32-x32-x32-x32-x32: [Groove Explorer Icon Overlay 4 (GFS Unread Mark)] -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => E:\MicrosoftOffice\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
ContextMenuHandlers1: [ESET Smart Security - Context Menu Shell Extension] -> {B089FE88-FB52-11D3-BDF1-0050DA34150D} => C:\Program Files\ESET\ESET NOD32 Antivirus\shellExt.dll [2017-10-29] (ESET)
ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext64.dll [2012-06-09] (Alexander Roshal)
ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext.dll [2012-06-09] (Alexander Roshal)
ContextMenuHandlers1-x32-x32: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} => E:\MicrosoftOffice\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
ContextMenuHandlers2: [ESET Smart Security - Context Menu Shell Extension] -> {B089FE88-FB52-11D3-BDF1-0050DA34150D} => C:\Program Files\ESET\ESET NOD32 Antivirus\shellExt.dll [2017-10-29] (ESET)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => E:\Anti-Malware\mbshlext.dll [2017-11-01] (Malwarebytes)
ContextMenuHandlers3-x32: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} => E:\MicrosoftOffice\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
ContextMenuHandlers4-x32: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} => E:\MicrosoftOffice\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\Windows\system32\nvshext.dll [2017-10-06] (NVIDIA Corporation)
ContextMenuHandlers5-x32: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} => E:\MicrosoftOffice\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
ContextMenuHandlers6: [ESET Smart Security - Context Menu Shell Extension] -> {B089FE88-FB52-11D3-BDF1-0050DA34150D} => C:\Program Files\ESET\ESET NOD32 Antivirus\shellExt.dll [2017-10-29] (ESET)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => E:\Anti-Malware\mbshlext.dll [2017-11-01] (Malwarebytes)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext64.dll [2012-06-09] (Alexander Roshal)
ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext.dll [2012-06-09] (Alexander Roshal)
ContextMenuHandlers6-x32-x32: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} => E:\MicrosoftOffice\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0B342792-F328-4F4B-90C5-8A60277C6C2E} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {1BB487E2-0FD4-41B9-AE95-9EA5803A32D5} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2017-07-19] (Adobe Systems Incorporated)
Task: {3F1E01A6-49AE-49F4-AAFE-B06EFE4BC172} - System32\Tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA GeForce Experience.exe [2017-10-11] (NVIDIA Corporation)
Task: {413706F3-199B-4651-8C7C-79DBD5D93B1B} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-10-11] (NVIDIA Corporation)
Task: {565356D4-C74B-4AFA-99CC-7E9D44F5E638} - System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe [2017-10-11] (NVIDIA Corporation)
Task: {5FDCB098-28B4-4AC4-BEAE-EE7ABDBC8945} - System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-10-11] (NVIDIA Corporation)
Task: {6B99D22A-F921-4EEE-BB6A-515C241BA40D} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2014-03-19] (Microsoft)
Task: {84D573FE-9525-4BA0-9FF8-2DB082998866} - System32\Tasks\{17C10AA8-4CA2-4799-8B4F-673DBE45A03B} => C:\Windows\system32\pcalua.exe -a E:\Steam\steam.exe -c steam://uninstall/43160
Task: {993DC09E-12DC-43B1-A394-5B5E971B750F} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {9EC3CD14-EAFB-400E-BE19-83BA03339966} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-10-25] (Adobe Systems Incorporated)
Task: {AA8F2C72-FAF1-4411-80CD-34F9B5EBB594} - System32\Tasks\{7A829E15-74B1-44C9-B062-EC93DDD53EC1} => "e:\mozilla firefox\firefox.exe" hxxp://ui.skype.com/ui/0/6.22.81.104/ru/abandoninstall?source=lightinstaller&page=tsMain
Task: {AC420625-BCAE-44B7-84B9-9EB4AB267BC9} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {BADFEC94-DCFA-473A-863B-F7A75EC67DE3} - System32\Tasks\{E449AFBF-45C9-40E7-8FA1-F093B3540501} => C:\Windows\system32\pcalua.exe -a C:\Users\User\AppData\Roaming\uTorrent\uTorrent.exe -c /UNINSTALL
Task: {CCA2BA1C-5AC1-47F9-A387-F04486C482DA} - System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-10-11] (NVIDIA Corporation)
Task: {CEEB82B7-8C03-44AC-B4CC-F9488548D95F} - System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe [2017-10-11] (NVIDIA Corporation)
Task: {F190A37F-7A76-4C3A-AF35-84C16B5FFD26} - System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [2017-10-11] (NVIDIA Corporation)
Task: {F50E190C-042C-4989-B247-F2EF160702E3} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-10-11] (NVIDIA Corporation)
Task: {F7DCAA97-48F7-4411-8853-3700665D6D3E} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {FC550B83-8007-4548-AEFE-A4C2DF6F3D2C} - System32\Tasks\{3AC56530-5A21-4BEB-A3E9-3E81C0E5012F} => C:\Windows\system32\pcalua.exe -a "E:\EVGA Precision X\uninstall.exe"

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


Shortcut: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\techno4uk2lo.xyz\Clear Cache.lnk -> E:\techno4uk2lo.xyz\clearcache.bat ()

==================== Loaded Modules (Whitelisted) ==============

2013-07-14 20:08 - 2012-06-01 16:42 - 000920736 _____ () C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe
2017-04-11 15:40 - 2017-10-11 01:05 - 001267136 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\libprotobuf.dll
2013-12-01 23:58 - 2015-02-06 17:41 - 000076152 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2017-11-10 18:42 - 2017-11-01 08:55 - 002299344 _____ () E:\ANTI-MALWARE\SelfProtectionSdk.dll
2017-11-10 18:42 - 2017-11-01 08:54 - 002358736 _____ () E:\ANTI-MALWARE\MwacLib.dll
2012-03-22 21:11 - 2012-03-22 21:11 - 000244944 _____ () E:\bluetooth\CsrSyncMLServer.exe
2014-10-04 13:21 - 2013-04-09 10:05 - 000846848 _____ () E:\tp-link\TWCU.exe
2013-07-14 20:08 - 2017-11-12 17:09 - 000033280 _____ () C:\Program Files (x86)\ASUS\AXSP\1.00.19\PEbiosinterface32.dll
2013-07-14 20:08 - 2010-06-29 09:58 - 000104448 _____ () C:\Program Files (x86)\ASUS\AXSP\1.00.19\ATKEX.dll
2017-04-11 15:40 - 2017-10-11 01:05 - 001040320 _____ () C:\Program Files (x86)\NVIDIA Corporation\NvContainer\libprotobuf.dll
2014-10-04 13:21 - 2013-01-22 13:40 - 001411072 _____ () E:\tp-link\nicLan.dll
2014-10-04 13:21 - 2013-04-02 12:41 - 000193024 _____ () E:\tp-link\DC_WFF.dll
2014-10-04 13:21 - 2013-04-02 12:41 - 000138752 _____ () E:\tp-link\WJWF\WJWF.dll
2014-10-04 13:21 - 2013-02-28 10:42 - 000115712 _____ () E:\tp-link\WJWF\WJWF_WPS_WIN7.DLL
2017-04-11 15:40 - 2017-10-11 01:05 - 070805952 _____ () C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\libcef.dll
2017-09-13 15:24 - 2017-09-13 15:24 - 000172032 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\af090eae04eb9e9104769a5c03783afc\IsdiInterop.ni.dll
2013-06-01 14:51 - 2012-02-01 15:25 - 000059904 _____ () C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IsdiInterop.dll
2013-06-01 14:49 - 2012-06-25 09:41 - 001198912 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\ACE.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\.DEFAULT\...\clonewarsadventures.com -> clonewarsadventures.com
IE trusted site: HKU\.DEFAULT\...\freerealms.com -> freerealms.com
IE trusted site: HKU\.DEFAULT\...\soe.com -> soe.com
IE trusted site: HKU\.DEFAULT\...\sony.com -> sony.com
IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

There are 7866 more sites.

IE trusted site: HKU\S-1-5-19\...\clonewarsadventures.com -> clonewarsadventures.com
IE trusted site: HKU\S-1-5-19\...\freerealms.com -> freerealms.com
IE trusted site: HKU\S-1-5-19\...\soe.com -> soe.com
IE trusted site: HKU\S-1-5-19\...\sony.com -> sony.com
IE trusted site: HKU\S-1-5-20\...\clonewarsadventures.com -> clonewarsadventures.com
IE trusted site: HKU\S-1-5-20\...\freerealms.com -> freerealms.com
IE trusted site: HKU\S-1-5-20\...\soe.com -> soe.com
IE trusted site: HKU\S-1-5-20\...\sony.com -> sony.com
IE trusted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\clonewarsadventures.com -> clonewarsadventures.com
IE trusted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\freerealms.com -> freerealms.com
IE trusted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\soe.com -> soe.com
IE trusted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\sony.com -> sony.com
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\...\123simsen.com -> www.123simsen.com

There are 7866 more sites.


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 02:34 - 2015-05-19 23:33 - 000449968 ____R C:\Windows\system32\Drivers\etc\hosts

127.0.0.1    localhost
127.0.0.1    www.007guard.com
127.0.0.1    007guard.com
127.0.0.1    008i.com
127.0.0.1    www.008k.com
127.0.0.1    008k.com
127.0.0.1    www.00hq.com
127.0.0.1    00hq.com
127.0.0.1    010402.com
127.0.0.1    www.032439.com
127.0.0.1    032439.com
127.0.0.1    www.0scan.com
127.0.0.1    0scan.com
127.0.0.1    1000gratisproben.com
127.0.0.1    www.1000gratisproben.com
127.0.0.1    1001namen.com
127.0.0.1    www.1001namen.com
127.0.0.1    100888290cs.com
127.0.0.1    www.100888290cs.com
127.0.0.1    www.100sexlinks.com
127.0.0.1    100sexlinks.com
127.0.0.1    10sek.com
127.0.0.1    www.10sek.com
127.0.0.1    www.1-2005-search.com
127.0.0.1    1-2005-search.com
127.0.0.1    123fporn.info
127.0.0.1    www.123fporn.info
127.0.0.1    123haustiereundmehr.com
127.0.0.1    www.123haustiereundmehr.com
127.0.0.1    123moviedownload.com

There are 15466 more lines.


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2683171744-3939096081-1905568632-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\User\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{B54ED444-BFDD-4DED-B476-AE915C7F427F}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{9F189A5C-9F95-474F-AD49-23E2D0A64138}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [TCP Query User{86FFE791-CC78-487F-B892-C838848D1854}E:\deusex\system\deusex.exe] => (Allow) E:\deusex\system\deusex.exe
FirewallRules: [UDP Query User{61538EBD-7E20-47E8-B16D-930CB92DAF8C}E:\deusex\system\deusex.exe] => (Allow) E:\deusex\system\deusex.exe
FirewallRules: [{7B44C1DA-58D2-4376-882C-7ACD00888F3D}] => (Allow) E:\Steam\SteamApps\common\Metro Last Light\MetroLL.exe
FirewallRules: [{4C921237-59C5-4162-8366-634275B4C283}] => (Allow) E:\Steam\SteamApps\common\Metro Last Light\MetroLL.exe
FirewallRules: [TCP Query User{AFE4F543-4304-48EF-B1D7-7B6F65B79184}C:\users\user\appdata\roaming\utorrent\utorrent.exe] => (Allow) C:\users\user\appdata\roaming\utorrent\utorrent.exe
FirewallRules: [UDP Query User{7D0C8834-19A8-4407-B972-10322B02F0BD}C:\users\user\appdata\roaming\utorrent\utorrent.exe] => (Allow) C:\users\user\appdata\roaming\utorrent\utorrent.exe
FirewallRules: [{EBDC33FF-6D03-4957-BAA4-6455BE8E4114}] => (Allow) E:\Cracked Steam\steam.exe
FirewallRules: [{A09D1319-BF1C-44AA-B1E3-9E900E1240ED}] => (Allow) E:\Cracked Steam\steam.exe
FirewallRules: [{1BD4F689-7706-4B55-9A0D-20128F7E824B}] => (Allow) E:\Steam\Steam.exe
FirewallRules: [{60E7B069-9246-452F-98A1-582F5A3B2C58}] => (Allow) E:\Steam\Steam.exe
FirewallRules: [TCP Query User{6F852477-2A62-40DF-B4BA-4F2A0BB487BC}E:\planetside 2 psg\planetside2.exe] => (Block) E:\planetside 2 psg\planetside2.exe
FirewallRules: [UDP Query User{164C75E5-254B-4A34-9071-F278492259A1}E:\planetside 2 psg\planetside2.exe] => (Block) E:\planetside 2 psg\planetside2.exe
FirewallRules: [TCP Query User{AD88D92C-DB6E-4C9A-842B-5BED0E01CB72}E:\r.g. catalyst\dmc - devil may cry\binaries\win32\dmc-devilmaycry.exe] => (Block) E:\r.g. catalyst\dmc - devil may cry\binaries\win32\dmc-devilmaycry.exe
FirewallRules: [UDP Query User{DBE49FAB-D60D-4B0F-8A6A-74953C2E88B3}E:\r.g. catalyst\dmc - devil may cry\binaries\win32\dmc-devilmaycry.exe] => (Block) E:\r.g. catalyst\dmc - devil may cry\binaries\win32\dmc-devilmaycry.exe
FirewallRules: [TCP Query User{589F22CB-D377-4780-BF76-A8988461F8FB}E:\milestone\motogp13\motogp13.exe] => (Block) E:\milestone\motogp13\motogp13.exe
FirewallRules: [UDP Query User{CAA1B3B9-EDA3-45CF-B170-06BE6BF9471C}E:\milestone\motogp13\motogp13.exe] => (Block) E:\milestone\motogp13\motogp13.exe
FirewallRules: [TCP Query User{B5104680-1E65-484E-AB71-0E4F5A0CC8CC}E:\games\need for speed most wanted\nfs13.exe] => (Block) E:\games\need for speed most wanted\nfs13.exe
FirewallRules: [UDP Query User{8F760181-62E0-4EAE-B811-B133EF85845A}E:\games\need for speed most wanted\nfs13.exe] => (Block) E:\games\need for speed most wanted\nfs13.exe
FirewallRules: [TCP Query User{373091A7-DE42-4719-9334-C972DA98FE2E}E:\deadpool\updater.exe] => (Allow) E:\deadpool\updater.exe
FirewallRules: [UDP Query User{96A12E9B-4F70-46E6-8FBD-090B263A55B1}E:\deadpool\updater.exe] => (Allow) E:\deadpool\updater.exe
FirewallRules: [TCP Query User{9E8E4EE4-CFD3-4784-80C8-E48CE807196F}E:\sniper ghost warrior 2\bin32\sniperghostwarrior2.exe] => (Allow) E:\sniper ghost warrior 2\bin32\sniperghostwarrior2.exe
FirewallRules: [UDP Query User{09ED14C6-CA31-477F-A080-1471EE7E445F}E:\sniper ghost warrior 2\bin32\sniperghostwarrior2.exe] => (Allow) E:\sniper ghost warrior 2\bin32\sniperghostwarrior2.exe
FirewallRules: [{B44EEDD0-3D9F-443B-84D6-9704AB87C44C}] => (Allow) E:\Crysis 3\Bin32\Crysis3.exe
FirewallRules: [{E607770D-6B19-4640-984E-90E9A88E9EAC}] => (Allow) E:\Crysis 3\Bin32\Crysis3.exe
FirewallRules: [{AED537BB-5F8F-4E96-B260-7C1BD2F83A1D}] => (Allow) E:\Thermal Radar\AI Suite II\AI Suite II.exe
FirewallRules: [{8196553C-95EC-40EE-9539-0A7E5BF15E7C}] => (Allow) E:\Thermal Radar\AI Suite II\AI Suite II.exe
FirewallRules: [TCP Query User{FDEC58E5-4ABD-4712-A541-901D6CE80683}E:\payday\payday 2 beta\payday2_win32_release.exe] => (Block) E:\payday\payday 2 beta\payday2_win32_release.exe
FirewallRules: [UDP Query User{51793186-396D-421F-8163-989BD01BBD80}E:\payday\payday 2 beta\payday2_win32_release.exe] => (Block) E:\payday\payday 2 beta\payday2_win32_release.exe
FirewallRules: [TCP Query User{A6529DA7-DBB3-47EC-B365-408FA710FDAF}E:\payday\payday2_win32_release.exe] => (Allow) E:\payday\payday2_win32_release.exe
FirewallRules: [UDP Query User{2A122569-8F6F-41CB-B117-4AA2F75567ED}E:\payday\payday2_win32_release.exe] => (Allow) E:\payday\payday2_win32_release.exe
FirewallRules: [TCP Query User{4EB34602-DA9F-4246-A0C7-0CF87DEA29D5}E:\games\saints row iv\saintsrowiv.exe] => (Allow) E:\games\saints row iv\saintsrowiv.exe
FirewallRules: [UDP Query User{31CCFC7A-9F1E-4D89-9A2D-CEF550A34B9E}E:\games\saints row iv\saintsrowiv.exe] => (Allow) E:\games\saints row iv\saintsrowiv.exe
FirewallRules: [TCP Query User{D0CBDD17-293E-49FB-BAA8-AF5D6B0B0CC3}E:\splinter cell blacklist\src\system\blacklist_game.exe] => (Allow) E:\splinter cell blacklist\src\system\blacklist_game.exe
FirewallRules: [UDP Query User{204D8240-F54F-4C7C-B548-389BB2EC472A}E:\splinter cell blacklist\src\system\blacklist_game.exe] => (Allow) E:\splinter cell blacklist\src\system\blacklist_game.exe
FirewallRules: [TCP Query User{1588583C-8EDF-4290-9D2B-8B1FC46D7E27}E:\saints row iv\saintsrowiv.exe] => (Allow) E:\saints row iv\saintsrowiv.exe
FirewallRules: [UDP Query User{54263A7C-97E1-496F-830E-82800E9AD4A5}E:\saints row iv\saintsrowiv.exe] => (Allow) E:\saints row iv\saintsrowiv.exe
FirewallRules: [TCP Query User{43927F7D-DCEF-4F51-B66C-234C3DB70E53}E:\total war rome ii\rome2.exe] => (Allow) E:\total war rome ii\rome2.exe
FirewallRules: [UDP Query User{DAA603C5-FAFA-44A2-AF93-0E760C3D481A}E:\total war rome ii\rome2.exe] => (Allow) E:\total war rome ii\rome2.exe
FirewallRules: [TCP Query User{6F05EF35-70F1-4873-9692-FBF292A8F774}E:\outlast\outlast\binaries\win64\olgame.exe] => (Allow) E:\outlast\outlast\binaries\win64\olgame.exe
FirewallRules: [UDP Query User{019C643C-37A5-427A-8743-23D78D126F16}E:\outlast\outlast\binaries\win64\olgame.exe] => (Allow) E:\outlast\outlast\binaries\win64\olgame.exe
FirewallRules: [{FB9566D1-86BD-46E0-AD6E-C756B3184C4E}] => (Allow) E:\Steam\SteamApps\common\Warframe\Tools\Launcher.exe
FirewallRules: [{417CF7D8-E160-4454-AAEE-8F18A0608289}] => (Allow) E:\Steam\SteamApps\common\Warframe\Tools\Launcher.exe
FirewallRules: [{94C6E4CC-9D39-4BB9-A6D4-9CE2DB5186F1}] => (Allow) E:\Steam\steamapps\common\Warframe\Warframe.exe
FirewallRules: [{1071CAE9-F129-4A04-9478-3AE5ED37EDB0}] => (Allow) E:\Steam\steamapps\common\Warframe\Warframe.x64.exe
FirewallRules: [{5E39ADFB-8BA4-4058-8031-2740350ECB77}] => (Allow) E:\Steam\steamapps\common\Warframe\Warframe.exe
FirewallRules: [{8D9C917C-BD20-4D83-B295-9841C4E22D94}] => (Allow) E:\Steam\steamapps\common\Warframe\Warframe.x64.exe
FirewallRules: [{0F81E64F-2532-4DA3-B2DF-3D4210B4EC9D}] => (Allow) E:\Steam\steamapps\common\Warframe\Warframe.exe
FirewallRules: [{18CC0051-2A32-4373-8031-AD252521451B}] => (Allow) E:\Steam\steamapps\common\Warframe\Warframe.x64.exe
FirewallRules: [{E071A8D2-ADF7-4652-AB41-509AEA9B5728}] => (Allow) E:\Steam\steamapps\common\Warframe\Tools\Launcher.exe
FirewallRules: [{B29889B2-E5A9-4CE9-B97A-82E4AB23701D}] => (Allow) E:\Battlefield 4\bf4_x86.exe
FirewallRules: [{F63DD5F3-5E95-45E2-914B-DBE7A4BCE729}] => (Allow) E:\Battlefield 4\bf4_x86.exe
FirewallRules: [{734ED45A-3CC4-4F32-A01C-E0439052D383}] => (Allow) E:\Battlefield 4\bf4.exe
FirewallRules: [{0008FFB2-00CC-4002-9C52-7068A3D0F465}] => (Allow) E:\Battlefield 4\bf4.exe
FirewallRules: [{715E6657-0F48-4D09-BC02-C96D0BB95403}] => (Allow) E:\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{86EDCAD8-9C01-42FC-BC81-DC0F1B752FB8}] => (Allow) E:\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{7FF36C2C-7180-4DA7-9897-3637351E60C6}] => (Allow) E:\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{0D091239-00F4-48E4-AFD1-064049411BBA}] => (Allow) E:\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{9FE3936C-CE4B-43CB-BD3A-81BE79580A62}] => (Allow) E:\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{9E9080B1-37A0-4857-A264-3A7F09E147CF}] => (Allow) E:\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{CC45EADD-9DB8-4D09-A4D7-D062A090778A}] => (Allow) E:\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{8A5568FE-72A8-4ACD-8827-2FD03D807537}] => (Allow) E:\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{5C98876B-6E7A-4A28-82E3-FC6D55C2D5EC}] => (Allow) E:\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{E5C516E8-C25F-4960-85E1-739384D082C9}] => (Allow) E:\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{C8201F37-9B0F-4A9E-AAEC-C5EE7CB2EFBA}] => (Allow) E:\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{775E524A-7166-4D00-B054-834D8FD35393}] => (Allow) E:\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{82104CDC-3744-46A7-8E03-132A579416B5}] => (Allow) E:\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{75BC6C0A-C9BD-4473-B5B1-B6BD649E944E}] => (Allow) E:\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{03DCB2F7-F077-496B-B217-46AE734A2FB8}] => (Allow) E:\MicrosoftOffice\Office12\outlook.exe
FirewallRules: [{9F15FDAD-4B72-41E7-838B-15329184ECAE}] => (Allow) E:\MicrosoftOffice\Office12\GROOVE.EXE
FirewallRules: [{A44E7C1A-CC01-4805-A6BF-D8840257C6E0}] => (Allow) E:\MicrosoftOffice\Office12\GROOVE.EXE
FirewallRules: [{57FD847B-C385-4700-9857-CCA3FE633D95}] => (Allow) E:\MicrosoftOffice\Office12\ONENOTE.EXE
FirewallRules: [{7130F193-1A71-4B46-8924-BC9A5E5AF421}] => (Allow) E:\MicrosoftOffice\Office12\ONENOTE.EXE
FirewallRules: [{F977D01C-40FE-4397-A1CB-ABBE4673AFCA}] => (Allow) E:\Steam\SteamApps\common\rust\rustlauncher.exe
FirewallRules: [{6D6959F3-C503-4D68-8C33-BCE91EF0EDE6}] => (Allow) E:\Steam\SteamApps\common\rust\rustlauncher.exe
FirewallRules: [TCP Query User{1600A18A-C607-485F-9DB9-A2A55DA3448C}E:\games\age of wonders iii\aow3.exe] => (Block) E:\games\age of wonders iii\aow3.exe
FirewallRules: [UDP Query User{053AC47C-9F36-46CD-843E-C7DF8CD82A04}E:\games\age of wonders iii\aow3.exe] => (Block) E:\games\age of wonders iii\aow3.exe
FirewallRules: [TCP Query User{9C3682D6-885F-4A14-8190-5B6EC2581BAC}E:\outlast whistleblower\binaries\win64\olgame.exe] => (Block) E:\outlast whistleblower\binaries\win64\olgame.exe
FirewallRules: [UDP Query User{0EF92391-32E9-4D18-A117-D25AC09E7818}E:\outlast whistleblower\binaries\win64\olgame.exe] => (Block) E:\outlast whistleblower\binaries\win64\olgame.exe
FirewallRules: [TCP Query User{39FD5B66-8073-458C-BA48-C41A9544C8DF}E:\wolfenstein the new order\wolfneworder_x64.exe] => (Block) E:\wolfenstein the new order\wolfneworder_x64.exe
FirewallRules: [UDP Query User{149747EC-10EA-4FA6-9CEA-8654A74C0ADD}E:\wolfenstein the new order\wolfneworder_x64.exe] => (Block) E:\wolfenstein the new order\wolfneworder_x64.exe
FirewallRules: [TCP Query User{BF9C55C3-3C1A-4C4E-AE84-98E9656B3947}E:\games\watch_dogs-digital.deluxe-skidrowcrack\bin\watch_dogs.exe] => (Block) E:\games\watch_dogs-digital.deluxe-skidrowcrack\bin\watch_dogs.exe
FirewallRules: [UDP Query User{64A3D138-CEE7-46CD-87FE-DB4E9F4BA14E}E:\games\watch_dogs-digital.deluxe-skidrowcrack\bin\watch_dogs.exe] => (Block) E:\games\watch_dogs-digital.deluxe-skidrowcrack\bin\watch_dogs.exe
FirewallRules: [TCP Query User{DB797780-E543-4550-A65A-19CF0E974E70}E:\games\watch\bin\watch_dogs.exe] => (Block) E:\games\watch\bin\watch_dogs.exe
FirewallRules: [UDP Query User{BEDDA29B-08CF-474F-AD7A-038D07B440D2}E:\games\watch\bin\watch_dogs.exe] => (Block) E:\games\watch\bin\watch_dogs.exe
FirewallRules: [TCP Query User{FD7B9B7A-95DB-4AE0-AA6E-75DB3AFCE78A}E:\watch dogs\bin\watch_dogs.exe] => (Block) E:\watch dogs\bin\watch_dogs.exe
FirewallRules: [UDP Query User{ED158EA9-15AE-4633-9AB8-35CBD786DDE5}E:\watch dogs\bin\watch_dogs.exe] => (Block) E:\watch dogs\bin\watch_dogs.exe
FirewallRules: [{F8DB68ED-2166-4EF7-BCA9-53743B03EF51}] => (Allow) E:\WATCH_DOGS\bin\Watch_Dogs.exe
FirewallRules: [{B585500F-A89A-4450-A720-E1962FF12B13}] => (Allow) E:\WATCH_DOGS\bin\Watch_Dogs.exe
FirewallRules: [TCP Query User{79BCD06F-CF0D-447F-8ACF-3861FEA57295}E:\abyss odyssey\binaries\win32\ao.exe] => (Block) E:\abyss odyssey\binaries\win32\ao.exe
FirewallRules: [UDP Query User{D18A025A-491C-4B7D-838F-C160CFD9063E}E:\abyss odyssey\binaries\win32\ao.exe] => (Block) E:\abyss odyssey\binaries\win32\ao.exe
FirewallRules: [{F089DCC2-2296-4FFF-AE17-0CBF4D434FE8}] => (Allow) E:\Steam\SteamApps\common\theHunter\launcher\launcher.exe
FirewallRules: [{4B0C5F2D-5B25-4789-A708-8F11D39F2E14}] => (Allow) E:\Steam\SteamApps\common\theHunter\launcher\launcher.exe
FirewallRules: [TCP Query User{CF7AD264-A0BB-445E-8EF2-D112195C9D1B}E:\steam\steamapps\common\thehunter\game\thehunter.exe] => (Block) E:\steam\steamapps\common\thehunter\game\thehunter.exe
FirewallRules: [UDP Query User{160E8EA6-B18A-41C7-B388-10A8D3101636}E:\steam\steamapps\common\thehunter\game\thehunter.exe] => (Block) E:\steam\steamapps\common\thehunter\game\thehunter.exe
FirewallRules: [{A093A7D2-128F-455B-B382-67A02CD8CBC5}] => (Allow) E:\Steam\SteamApps\common\rust\experimental\Rust.exe
FirewallRules: [{225BB74B-4FAF-4A86-BC99-C8A5C351344E}] => (Allow) E:\Steam\SteamApps\common\rust\experimental\Rust.exe
FirewallRules: [{DDF29D9E-0A40-48EA-A902-0562134BFB7D}] => (Allow) E:\Steam\bin\steamwebhelper.exe
FirewallRules: [{504FF56D-9005-4015-8142-5F95AAAA4447}] => (Allow) E:\Steam\bin\steamwebhelper.exe
FirewallRules: [TCP Query User{837DDA74-1040-4A82-A317-D6B6EF2736B6}E:\alien isolation\ai.exe] => (Block) E:\alien isolation\ai.exe
FirewallRules: [UDP Query User{19D78DEB-A0C5-4369-9647-B1786C8CE251}E:\alien isolation\ai.exe] => (Block) E:\alien isolation\ai.exe
FirewallRules: [{1F7CD295-DD87-4540-A7A9-684305F91C22}] => (Allow) E:\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{CCFC10A4-E0E4-46F4-ABA6-456C3B339F98}E:\far cry 4\bin\farcry4.exe] => (Block) E:\far cry 4\bin\farcry4.exe
FirewallRules: [UDP Query User{8755D7BB-8075-4B88-856D-D36464CF5818}E:\far cry 4\bin\farcry4.exe] => (Block) E:\far cry 4\bin\farcry4.exe
FirewallRules: [{55FCB341-1049-4A93-8841-1828D77E3115}] => (Allow) E:\Steam\SteamApps\common\DayZ\DayZ_BE.exe
FirewallRules: [{2F66701D-82AE-40CA-8D84-CDFD9EC6686B}] => (Allow) E:\Steam\SteamApps\common\DayZ\DayZ_BE.exe
FirewallRules: [TCP Query User{8E079106-CEC3-4A50-B151-5A6B6A427695}E:\steam\steamapps\common\h1z1\h1z1.exe] => (Allow) E:\steam\steamapps\common\h1z1\h1z1.exe
FirewallRules: [UDP Query User{35DDA8C7-AF94-42A8-8895-246944711391}E:\steam\steamapps\common\h1z1\h1z1.exe] => (Allow) E:\steam\steamapps\common\h1z1\h1z1.exe
FirewallRules: [TCP Query User{F891B3B7-3268-4857-8273-2601736BCD16}E:\dying light\dyinglightgame.exe] => (Block) E:\dying light\dyinglightgame.exe
FirewallRules: [UDP Query User{29A3B83A-C2AF-4217-8EB1-66D4CA14A7B1}E:\dying light\dyinglightgame.exe] => (Block) E:\dying light\dyinglightgame.exe
FirewallRules: [{908D3CAD-C308-4627-A748-EE7401A44522}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{E50D1761-428C-4B4A-B0E9-670D6B68B9CE}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{2C431BAF-55F5-4988-8FA4-8046680EE278}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{85BC975B-B496-4816-B4E2-B8ACEDBE0E12}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{F749449E-5DDD-48F4-933F-1198D3B57803}] => (Allow) E:\Steam\SteamApps\common\Rust\Legacy\rust.exe
FirewallRules: [{59F2C995-4A55-4463-936C-84A7C5277AB9}] => (Allow) E:\Steam\SteamApps\common\Rust\Legacy\rust.exe
FirewallRules: [TCP Query User{85BA0801-3573-4773-8BF2-6093F47BBF7A}E:\mozilla firefox\firefox.exe] => (Allow) E:\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{7CB0A528-35C9-448B-B3F5-FA475EA036C5}E:\mozilla firefox\firefox.exe] => (Allow) E:\mozilla firefox\firefox.exe
FirewallRules: [TCP Query User{EC572C17-BFA6-42AA-84F1-1A35C4587C93}E:\oddworld - new 'n' tasty\nnt.exe] => (Block) E:\oddworld - new 'n' tasty\nnt.exe
FirewallRules: [UDP Query User{775EDA9F-A462-4219-A795-306733BF2AD0}E:\oddworld - new 'n' tasty\nnt.exe] => (Block) E:\oddworld - new 'n' tasty\nnt.exe
FirewallRules: [TCP Query User{AE572A96-0583-4B5A-BB6E-2F8D500FDFD8}E:\ride\ride.exe] => (Block) E:\ride\ride.exe
FirewallRules: [UDP Query User{B1584C63-740A-46AE-96FD-D9B599B99D1B}E:\ride\ride.exe] => (Block) E:\ride\ride.exe
FirewallRules: [TCP Query User{0992C118-E8FE-4E65-BC60-E3E3BCA2A952}E:\mozilla firefox\firefox.exe] => (Allow) E:\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{4BE46A10-A07B-4849-BD76-2471D32413B5}E:\mozilla firefox\firefox.exe] => (Allow) E:\mozilla firefox\firefox.exe
FirewallRules: [TCP Query User{EA16F3BB-29C7-48B8-B7DB-3525D16BB2F9}E:\grand theft auto v\gta5.exe] => (Block) E:\grand theft auto v\gta5.exe
FirewallRules: [UDP Query User{3E168728-80D3-4D6D-9754-2D672C915E10}E:\grand theft auto v\gta5.exe] => (Block) E:\grand theft auto v\gta5.exe
FirewallRules: [TCP Query User{9E580029-CD92-48FE-AA19-F3BC2C5CF5D2}E:\homesick\binaries\win32\udk.exe] => (Block) E:\homesick\binaries\win32\udk.exe
FirewallRules: [UDP Query User{81F541DB-E13F-478D-B854-A2EEE51B4FFC}E:\homesick\binaries\win32\udk.exe] => (Block) E:\homesick\binaries\win32\udk.exe
FirewallRules: [TCP Query User{E2650989-A5E2-42BA-8159-05974B40EFCA}E:\games\new folder\basement.v0.2.1\64 bit\basement_64.exe] => (Block) E:\games\new folder\basement.v0.2.1\64 bit\basement_64.exe
FirewallRules: [UDP Query User{1B3381FE-35FE-44D8-A31A-CB6EB2CC9380}E:\games\new folder\basement.v0.2.1\64 bit\basement_64.exe] => (Block) E:\games\new folder\basement.v0.2.1\64 bit\basement_64.exe
FirewallRules: [TCP Query User{E03ACFDF-BB9F-4F08-8A0C-866B6B3F79C3}E:\grand ages medieval\grandagesmedieval.exe] => (Block) E:\grand ages medieval\grandagesmedieval.exe
FirewallRules: [UDP Query User{997F27C8-18D8-4909-B9AC-CEB258E6DD39}E:\grand ages medieval\grandagesmedieval.exe] => (Block) E:\grand ages medieval\grandagesmedieval.exe
FirewallRules: [{9C2CE1AE-5AB9-4655-B86D-6E43E83DE63D}] => (Allow) C:\Users\User\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{6E92F72D-CA9C-4C09-93E0-5AEF1B824C37}] => (Allow) C:\Users\User\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{9B07195F-2994-4A8A-8AF0-59559764FCEC}] => (Allow) C:\Users\User\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{18D3BB8B-438F-4207-9FB6-675A2C6655DC}] => (Allow) C:\Users\User\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{FC3B94AE-AFF8-456B-9E97-F1A8DEDD3A85}] => (Allow) C:\Users\User\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{B7FF6E27-C5F3-4082-A971-09B7D5F0C284}] => (Allow) C:\Users\User\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [TCP Query User{0EE78189-D18D-47D3-8254-276CAFD78774}E:\starcraft ii\versions\base39576\sc2_x64.exe] => (Allow) E:\starcraft ii\versions\base39576\sc2_x64.exe
FirewallRules: [UDP Query User{8DEE1412-2003-4893-BFA2-0CC8A68EF8E9}E:\starcraft ii\versions\base39576\sc2_x64.exe] => (Allow) E:\starcraft ii\versions\base39576\sc2_x64.exe
FirewallRules: [TCP Query User{303A4E6C-6F53-4DEB-9AD8-7AF0E3314E1A}E:\firewatch\firewatch.exe] => (Block) E:\firewatch\firewatch.exe
FirewallRules: [UDP Query User{473E6623-9935-4523-8B78-AB032225BC70}E:\firewatch\firewatch.exe] => (Block) E:\firewatch\firewatch.exe
FirewallRules: [{1E595172-5A0C-4277-BA0B-BE8EE6197931}] => (Allow) C:\Steam\steamapps\common\Rust\Rust.exe
FirewallRules: [{D9BA9CE4-9F37-46D5-B8AF-6D40D670A4F2}] => (Allow) C:\Steam\steamapps\common\Rust\Rust.exe
FirewallRules: [{A9E90F00-FD9F-44EF-88BB-A7289D22DB5D}] => (Allow) E:\Steam\SteamApps\common\EvolveGame\bin64_SteamRetail\Evolve.exe
FirewallRules: [{21EC669D-0DDB-4377-B290-ADB70C6DD402}] => (Allow) E:\Steam\SteamApps\common\EvolveGame\bin64_SteamRetail\Evolve.exe
FirewallRules: [{B12FF2F8-1AD2-4F1B-B82B-EFB33A8C14A9}] => (Allow) E:\Steam\SteamApps\common\Euro Truck Simulator 2\bin\win_x86\eurotrucks2.exe
FirewallRules: [{07D77411-72AA-40FA-A211-F54E50EA7A87}] => (Allow) E:\Steam\SteamApps\common\Euro Truck Simulator 2\bin\win_x86\eurotrucks2.exe
FirewallRules: [{5AAC4337-C775-44DB-9815-B438D7B61030}] => (Allow) E:\Steam\SteamApps\common\Euro Truck Simulator 2\bin\win_x64\eurotrucks2.exe
FirewallRules: [{01A45039-9AC5-4C40-B611-22C844319E7C}] => (Allow) E:\Steam\SteamApps\common\Euro Truck Simulator 2\bin\win_x64\eurotrucks2.exe
FirewallRules: [TCP Query User{FDF94FDD-1F0D-454B-AB08-3B20E5DD38D6}E:\mafia iii\launcher.exe] => (Block) E:\mafia iii\launcher.exe
FirewallRules: [UDP Query User{B2DFCA2D-9BD1-4BB4-8813-BB530FA45998}E:\mafia iii\launcher.exe] => (Block) E:\mafia iii\launcher.exe
FirewallRules: [TCP Query User{A9729D5A-0402-4160-8997-AB3BBFE0D65F}E:\mafia iii\mafia3.exe] => (Allow) E:\mafia iii\mafia3.exe
FirewallRules: [UDP Query User{C919FC0E-DB39-49C1-B3F2-AAC935164EAF}E:\mafia iii\mafia3.exe] => (Allow) E:\mafia iii\mafia3.exe
FirewallRules: [{694C29B6-6650-4211-ACD8-996864D1D2C1}] => (Allow) E:\WOT\WoTLauncher.exe
FirewallRules: [{C0A848A0-0F51-4114-A267-241A1FFF893D}] => (Allow) E:\WOT\WoTLauncher.exe
FirewallRules: [{CC7B8C6F-3F6F-41D7-85A9-BE78F2905D31}] => (Allow) E:\WOT\worldoftanks.exe
FirewallRules: [{DF660665-0588-4615-A5D3-2C34DEB9044A}] => (Allow) E:\WOT\worldoftanks.exe
FirewallRules: [TCP Query User{DECB8213-C4B1-41DC-B08B-6152B7EF88EF}E:\games\new folder\farming.simulator.17.v1.2.0.0\dedicatedserver.exe] => (Block) E:\games\new folder\farming.simulator.17.v1.2.0.0\dedicatedserver.exe
FirewallRules: [UDP Query User{31A014F6-45B2-4BA7-B91D-9761F2953A80}E:\games\new folder\farming.simulator.17.v1.2.0.0\dedicatedserver.exe] => (Block) E:\games\new folder\farming.simulator.17.v1.2.0.0\dedicatedserver.exe
FirewallRules: [{2903A95A-C6A6-4249-846F-BB07A6A7AC29}] => (Allow) E:\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{15B9A300-AF37-48F7-A427-15D02F1FB5DA}] => (Allow) E:\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{FE1EBB9D-3564-48BE-B330-166AD716DC80}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{CF9B9BFC-D39D-4BA9-976F-D107FB77BDFD}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{A02C7CB2-E68C-4154-8CF4-8BD6C6712F59}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
FirewallRules: [{237391FC-F868-4B0B-9BD0-89A80871A034}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{213FA747-ECF5-440F-B4A3-8E3F6B5D5F46}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [TCP Query User{6769C8A8-FA80-45D4-B3D4-FB98D2FCAFEC}E:\ubisoft game launcher\games\forhonor\forhonor.exe] => (Allow) E:\ubisoft game launcher\games\forhonor\forhonor.exe
FirewallRules: [UDP Query User{5A68D267-E6DE-406F-AD96-B04B3C299F24}E:\ubisoft game launcher\games\forhonor\forhonor.exe] => (Allow) E:\ubisoft game launcher\games\forhonor\forhonor.exe
FirewallRules: [TCP Query User{F44D96F7-2127-4C11-9065-A584037293B2}E:\battlefield 1\bf1.exe] => (Block) E:\battlefield 1\bf1.exe
FirewallRules: [UDP Query User{E64DFF75-F5C1-427F-8870-F0D9DDF35D6E}E:\battlefield 1\bf1.exe] => (Block) E:\battlefield 1\bf1.exe
FirewallRules: [{4978D042-FB26-48F3-8513-3070EF7BC915}] => (Allow) E:\Steam\SteamApps\common\rocketleague\Binaries\Win32\RocketLeague.exe
FirewallRules: [{21E8A477-4304-4642-8E05-10721F216D3C}] => (Allow) E:\Steam\SteamApps\common\rocketleague\Binaries\Win32\RocketLeague.exe
FirewallRules: [TCP Query User{A0704AE3-CFCD-494A-8F61-0447B718E9E1}E:\sniper ghost warrior 3\win_x64\sgw3.exe] => (Block) E:\sniper ghost warrior 3\win_x64\sgw3.exe
FirewallRules: [UDP Query User{2173B086-B806-46F7-AB48-31F6480783D1}E:\sniper ghost warrior 3\win_x64\sgw3.exe] => (Block) E:\sniper ghost warrior 3\win_x64\sgw3.exe
FirewallRules: [TCP Query User{848E94BA-0871-4B5F-8BB4-D24EE9C71761}E:\steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe] => (Allow) E:\steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe
FirewallRules: [UDP Query User{B7107250-4BAE-4DBB-AFF3-81F718290424}E:\steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe] => (Allow) E:\steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe
FirewallRules: [TCP Query User{4065FBF0-8E89-45FE-A6C0-A63D085F3822}E:\steam\steamapps\common\pubg_test\tslgame\binaries\win64\tslgame.exe] => (Allow) E:\steam\steamapps\common\pubg_test\tslgame\binaries\win64\tslgame.exe
FirewallRules: [UDP Query User{13A063B8-B01E-4F55-BDD4-1C821BD00EDB}E:\steam\steamapps\common\pubg_test\tslgame\binaries\win64\tslgame.exe] => (Allow) E:\steam\steamapps\common\pubg_test\tslgame\binaries\win64\tslgame.exe
FirewallRules: [{4A6C4573-AE18-4ECA-9A52-1B9C3ABFC20E}] => (Allow) E:\Steam\SteamApps\common\Rust\Rust.exe
FirewallRules: [{19616245-6110-420F-8BC9-C46C0568715A}] => (Allow) E:\Steam\SteamApps\common\Rust\Rust.exe
FirewallRules: [TCP Query User{161DE0B1-2373-4AD2-82BA-DADDB72DC5E1}C:\steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe] => (Allow) C:\steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe
FirewallRules: [UDP Query User{88D47919-A191-4839-B9CD-43CCA773A380}C:\steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe] => (Allow) C:\steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe
FirewallRules: [TCP Query User{251159B2-FC80-4A48-9387-D96CD8066F23}E:\thehunter call of the wild\thehuntercotw_f.exe] => (Block) E:\thehunter call of the wild\thehuntercotw_f.exe
FirewallRules: [UDP Query User{C720CFA2-5CE8-4B55-97B0-8B3E14AFB27F}E:\thehunter call of the wild\thehuntercotw_f.exe] => (Block) E:\thehunter call of the wild\thehuntercotw_f.exe
FirewallRules: [{98B5DA6E-9A59-4D16-B4E1-D015263EF6AB}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{7DEE7CB7-F906-45EA-8EE9-C19C3B112922}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{614076A3-9627-4056-A9FC-FA86FC8275B9}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{C825FA0B-861B-4C6F-A96F-61A50399FC28}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{B867B349-1DB0-43DF-9576-31847A212825}] => (Allow) C:\Steam\steamapps\common\PUBG\TslGame\Binaries\Win64\TslGame_BE.exe
FirewallRules: [{DB92DC18-5133-41A9-AE9F-2E94AF6308F2}] => (Allow) C:\Steam\steamapps\common\PUBG\TslGame\Binaries\Win64\TslGame_BE.exe
FirewallRules: [{452BD8A4-B1F5-42A8-8C11-B80FD667F5E2}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [TCP Query User{C18A4E3E-B101-49BE-803D-E5B6C3A82BF9}E:\epic games\launcher\portal\binaries\win32\epicgameslauncher.exe] => (Allow) E:\epic games\launcher\portal\binaries\win32\epicgameslauncher.exe
FirewallRules: [UDP Query User{C629E187-1FB3-4196-ABA2-8C0B0749D400}E:\epic games\launcher\portal\binaries\win32\epicgameslauncher.exe] => (Allow) E:\epic games\launcher\portal\binaries\win32\epicgameslauncher.exe
FirewallRules: [TCP Query User{80D3F534-00B8-442E-9E93-BCF656B8B225}E:\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe] => (Allow) E:\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe
FirewallRules: [UDP Query User{6C9E7920-4911-4A5E-86DB-A81152801DD2}E:\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe] => (Allow) E:\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe
FirewallRules: [TCP Query User{09F605C9-F2DD-4003-ADCB-CCE312A61709}E:\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe] => (Allow) E:\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe
FirewallRules: [UDP Query User{FFC3D11D-5505-4089-BE3F-76DB2F59F3AE}E:\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe] => (Allow) E:\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe

==================== Restore Points =========================

05-11-2017 15:02:58 Installed DirectX
05-11-2017 15:03:32 Installed DirectX
08-11-2017 16:43:32 Windows Update

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (11/12/2017 05:10:49 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (11/12/2017 01:05:52 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: CsrBtOBEXService.exe, version: 2.1.63.0, time stamp: 0x4f68683b
Faulting module name: CsrBtOBEXService.exe, version: 2.1.63.0, time stamp: 0x4f68683b
Exception code: 0xc0000005
Fault offset: 0x0000000000006f58
Faulting process id: 0x7cc
Faulting application start time: 0x01d35bb35ed7358e
Faulting application path: E:\bluetooth\CsrBtOBEXService.exe
Faulting module path: E:\bluetooth\CsrBtOBEXService.exe
Report Id: 3562f4dd-c7aa-11e7-81a8-08606e7c329b

Error: (11/12/2017 12:41:54 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (11/12/2017 12:39:25 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: CsrBtOBEXService.exe, version: 2.1.63.0, time stamp: 0x4f68683b
Faulting module name: CsrBtOBEXService.exe, version: 2.1.63.0, time stamp: 0x4f68683b
Exception code: 0xc0000005
Fault offset: 0x0000000000006f58
Faulting process id: 0x7d8
Faulting application start time: 0x01d35bb2ac9849ed
Faulting application path: E:\bluetooth\CsrBtOBEXService.exe
Faulting module path: E:\bluetooth\CsrBtOBEXService.exe
Report Id: 8374cdc3-c7a6-11e7-8707-08606e7c329b

Error: (11/12/2017 12:36:55 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (11/12/2017 05:31:20 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: CsrBtOBEXService.exe, version: 2.1.63.0, time stamp: 0x4f68683b
Faulting module name: CsrBtOBEXService.exe, version: 2.1.63.0, time stamp: 0x4f68683b
Exception code: 0xc0000005
Fault offset: 0x0000000000006f58
Faulting process id: 0x7dc
Faulting application start time: 0x01d35b7661f1b84c
Faulting application path: E:\bluetooth\CsrBtOBEXService.exe
Faulting module path: E:\bluetooth\CsrBtOBEXService.exe
Report Id: b60135e7-c76a-11e7-a3e9-08606e7c329b

Error: (11/12/2017 05:25:20 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (11/11/2017 09:13:47 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: CsrBtOBEXService.exe, version: 2.1.63.0, time stamp: 0x4f68683b
Faulting module name: CsrBtOBEXService.exe, version: 2.1.63.0, time stamp: 0x4f68683b
Exception code: 0xc0000005
Fault offset: 0x0000000000006f58
Faulting process id: 0x7d4
Faulting application start time: 0x01d35b2d4f09272d
Faulting application path: E:\bluetooth\CsrBtOBEXService.exe
Faulting module path: E:\bluetooth\CsrBtOBEXService.exe
Report Id: 343abf0b-c725-11e7-a2cc-08606e7c329b

Error: (11/11/2017 08:42:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (11/11/2017 04:14:31 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: CsrBtOBEXService.exe, version: 2.1.63.0, time stamp: 0x4f68683b
Faulting module name: CsrBtOBEXService.exe, version: 2.1.63.0, time stamp: 0x4f68683b
Exception code: 0xc0000005
Fault offset: 0x0000000000006f58
Faulting process id: 0x7d0
Faulting application start time: 0x01d35af7460225ed
Faulting application path: E:\bluetooth\CsrBtOBEXService.exe
Faulting module path: E:\bluetooth\CsrBtOBEXService.exe
Report Id: 65a2ac73-c6fb-11e7-9221-08606e7c329b


System errors:
=============
Error: (11/12/2017 05:09:03 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
sptd

Error: (11/12/2017 05:08:51 PM) (Source: sptd) (EventID: 4) (User: )
Description: Driver detected an internal error in its data structures for .

Error: (11/12/2017 01:05:53 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The CSR OBEX Service service terminated unexpectedly.  It has done this 1 time(s).

Error: (11/12/2017 12:40:08 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
sptd

Error: (11/12/2017 12:39:56 PM) (Source: sptd) (EventID: 4) (User: )
Description: Driver detected an internal error in its data structures for .

Error: (11/12/2017 12:39:26 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The CSR OBEX Service service terminated unexpectedly.  It has done this 1 time(s).

Error: (11/12/2017 12:35:09 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
SDHookDriver
sptd

Error: (11/12/2017 12:34:57 PM) (Source: sptd) (EventID: 4) (User: )
Description: Driver detected an internal error in its data structures for .

Error: (11/12/2017 05:31:21 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The CSR OBEX Service service terminated unexpectedly.  It has done this 1 time(s).

Error: (11/12/2017 05:23:34 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
SDHookDriver
sptd


CodeIntegrity:
===================================
  Date: 2017-09-06 18:00:08.158
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\ProgramData\ESET\ESET NOD32 Antivirus\updfiles\base_nonnups\nod7F8F.dll.nup.raw because the set of per-page image hashes could not be found on the system.

  Date: 2017-09-06 18:00:07.988
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\ProgramData\ESET\ESET NOD32 Antivirus\updfiles\base_nonnups\nod7F8F.dll.nup.raw because the set of per-page image hashes could not be found on the system.

  Date: 2017-09-06 18:00:07.850
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\ProgramData\ESET\ESET NOD32 Antivirus\updfiles\base_nonnups\nod7F8F.dll.nup.raw because the set of per-page image hashes could not be found on the system.

  Date: 2017-09-06 18:00:07.687
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\ProgramData\ESET\ESET NOD32 Antivirus\updfiles\base_nonnups\nod7F8F.dll.nup.raw because the set of per-page image hashes could not be found on the system.

  Date: 2017-09-06 18:00:07.519
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\ProgramData\ESET\ESET NOD32 Antivirus\updfiles\base_nonnups\nod7F8F.dll.nup.raw because the set of per-page image hashes could not be found on the system.

  Date: 2017-09-06 18:00:07.380
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\ProgramData\ESET\ESET NOD32 Antivirus\updfiles\base_nonnups\nod7F8F.dll.nup.raw because the set of per-page image hashes could not be found on the system.

  Date: 2017-09-06 17:58:42.440
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\ESET\ESET NOD32 Antivirus\Modules\em023_64\10844\em023_64.dll.raw because the set of per-page image hashes could not be found on the system.

  Date: 2017-09-06 17:58:42.258
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\ESET\ESET NOD32 Antivirus\Modules\em023_64\10844\em023_64.dll.raw because the set of per-page image hashes could not be found on the system.

  Date: 2017-09-06 17:58:42.106
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\ESET\ESET NOD32 Antivirus\Modules\em023_64\10844\em023_64.dll.raw because the set of per-page image hashes could not be found on the system.

  Date: 2017-09-06 17:58:41.932
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\ESET\ESET NOD32 Antivirus\Modules\em023_64\10844\em023_64.dll.raw because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Processor: Intel® Core™ i7-3770K CPU @ 3.50GHz
Percentage of memory in use: 34%
Total physical RAM: 12234.91 MB
Available physical RAM: 7969.85 MB
Total Virtual: 24468 MB
Available Virtual: 19754.23 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:119.14 GB) (Free:45.71 GB) NTFS
Drive e: () (Fixed) (Total:931.51 GB) (Free:671.2 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 119.2 GB) (Disk ID: 24136AD3)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=119.1 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 952C201B)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================



#28 lazystoner

lazystoner
  • Topic Starter

  • Members
  • 68 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:17 PM

Posted 12 November 2017 - 01:02 PM

when i opened up frst this time it said failed to update



#29 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 10,250 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:06:17 PM

Posted 12 November 2017 - 01:25 PM

Please browse to C:\Windows\Minidump\111017-27924-01.dmp. Right click on the file and select "Send to", select "Compressed Zipped folder". That should create a zipped folder in that location. Please attach it to your reply.


Under Hurricane Emergency, expect delays on my responses

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#30 lazystoner

lazystoner
  • Topic Starter

  • Members
  • 68 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:17 PM

Posted 12 November 2017 - 01:30 PM

it said file not found or no read permission  when i try to send to compressed zip folder






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users