Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Need help removing malware (winver.exe infected)


  • This topic is locked This topic is locked
21 replies to this topic

#1 GhostlierCrib

GhostlierCrib

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:37 AM

Posted 28 April 2018 - 12:12 PM

Basically I've been searching for a way to fix my computer this whole week almost everywhere on the web, I've scanned my computer with almost everything there is, but unfortunately i was unsuccessful. The only thing that came close to fixing or removing the malware from my computer was Combofix.exe (I know I'm not supposed to run it unless told otherwise, but I'm desperate at this point), however after the scan, when my computer was restarting it said that the "windows update was unsuccessful" and that It'll revert to old settings or something close to that. The following is what Combofix is detecting: 
 
Infected copy of c:\windows\System32\winver.exe was found and disinfected 
Restored copy from - c:\windows\winsxs\amd64_microsoft-windows-winver_31bf3856ad364e35_6.1.7600.16385_none_12466fe3b629e036\winver.exe 
 
I can post the whole log if that would be helpful.
 
I also have scanned my computer with Comodo along the other anti - malware and the Comodo internet security essentials detects an untrusted root certificate "GlobalSigns Root CA" when trying to connect to any website on any browser. 
 
The more prominent problems I'm having are: 
 
- My CPU usage is unusually high even though nothing is running - 40% - 50%
- When trying to open any website its stuck on "waiting for" said webpage sometimes for minutes (happens in both chrome and IE)
 
 
Any help is appreciated and sorry if I messed something up this is my first time posting here.
 
 
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 25.04.2018
Ran by Alexander Dochev (administrator) on MYPC (28-04-2018 19:53:04)
Running from C:\Users\Alexander Dochev\Desktop
Loaded Profiles: Alexander Dochev (Available Profiles: Alexander Dochev)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(COMODO) C:\Program Files (x86)\Comodo\Internet Security Essentials\isesrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
() C:\ProgramData\VIVACOM 3G USB Modem\OnlineUpdate\ouc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Discord Inc.) C:\Users\Alexander Dochev\AppData\Local\Discord\app-0.0.300\Discord.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(COMODO) C:\Program Files (x86)\Comodo\Internet Security Essentials\vkise.exe
(Node.js) C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe
(Disc Soft Ltd) C:\Program Files (x86)\DAEMON Tools Ultra\DiscSoftBusService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(HP Inc.) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
==================== Registry (Whitelisted) ===========================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7666392 2014-12-12] (Realtek Semiconductor)
HKLM\...\Run: [XboxStat] => C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-10-01] (Microsoft Corporation)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2818800 2014-06-17] (Synaptics Incorporated)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1353680 2016-11-14] (Microsoft Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-12-19] (Oracle Corporation)
HKLM-x32\...\Run: [IseUI] => C:\Program Files (x86)\COMODO\Internet Security Essentials\vkise.exe [4072376 2018-01-17] (COMODO)
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-1505688330-694015033-755604794-1000\...\Run: [GalaxyClient] => C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe [6448712 2018-04-23] (GOG.com)
HKU\S-1-5-21-1505688330-694015033-755604794-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3199776 2018-04-03] (Valve Corporation)
HKU\S-1-5-21-1505688330-694015033-755604794-1000\...\Run: [DAEMON Tools Ultra Agent] => C:\Program Files (x86)\DAEMON Tools Ultra\DTAgent.exe [3639568 2014-07-10] (Disc Soft Ltd)
HKU\S-1-5-21-1505688330-694015033-755604794-1000\...\Run: [Discord] => C:\Users\Alexander Dochev\AppData\Local\Discord\app-0.0.300\Discord.exe [57821176 2018-01-08] (Discord Inc.)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [182784 2018-03-25] (NVIDIA Corporation)
AppInit_DLLs:  C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [182784 2018-03-25] (NVIDIA Corporation)
AppInit_DLLs:  C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [182784 2018-03-25] (NVIDIA Corporation)
AppInit_DLLs:  C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [182784 2018-03-25] (NVIDIA Corporation)
AppInit_DLLs:  C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [182784 2018-03-25] (NVIDIA Corporation)
AppInit_DLLs:  C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [182784 2018-03-25] (NVIDIA Corporation)
AppInit_DLLs: ,C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [182784 2018-03-25] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [159704 2018-03-25] (NVIDIA Corporation)
Lsa: [Notification Packages] scecli C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
GroupPolicy: Restriction - Chrome <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Tcpip\Parameters: [DhcpNameServer] 78.90.164.1 89.190.192.247
Tcpip\..\Interfaces\{187A61D7-4EE8-4CCB-AC90-AAB6E5A3987F}: [NameServer] 212.39.90.42 212.39.90.43
Tcpip\..\Interfaces\{31D1BEB9-070E-4F50-B144-1BEFCE9738C9}: [DhcpNameServer] 78.90.164.1 89.190.192.247
Tcpip\..\Interfaces\{59836918-9A32-4EA5-BFE1-5E0E6EC2146F}: [DhcpNameServer] 78.90.164.1 89.190.192.247
Tcpip\..\Interfaces\{67CE52F9-19DF-4B43-9DE2-189F201BF4C2}: [NameServer]  
Tcpip\..\Interfaces\{C8B800E2-3557-4B9B-97B2-F80F94928681}: [NameServer]  
 
Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617911&ResetID=131413247638939178&GUID=3F0DDCEE-AD44-4446-9008-703275629452
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617911&ResetID=131413247638939178&GUID=3F0DDCEE-AD44-4446-9008-703275629452
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1505688330-694015033-755604794-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1505688330-694015033-755604794-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.co.uk/
SearchScopes: HKU\S-1-5-21-1505688330-694015033-755604794-1000 -> DefaultScope {1348A74C-C71D-415F-919A-6CA4703F72F2} URL = hxxps://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-1505688330-694015033-755604794-1000 -> {1348A74C-C71D-415F-919A-6CA4703F72F2} URL = hxxps://www.google.com/search?q={searchTerms}
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2018-02-15] (Microsoft Corporation)
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_161\bin\ssv.dll [2018-01-26] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2017-02-23] (Microsoft Corporation)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_161\bin\jp2ssv.dll [2018-01-26] (Oracle Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2017-08-24] (Microsoft Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_161\bin\ssv.dll [2018-01-26] (Oracle Corporation)
BHO-x32: ArcPluginIEBHO Class -> {84BFE29A-8139-402a-B2A4-C23AE9E1A75F} -> C:\Program Files (x86)\Arc\Plugins\ArcPluginIE.dll [2017-08-31] (Perfect World Entertainment Inc)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2014-01-21] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2017-02-23] (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_161\bin\jp2ssv.dll [2018-01-26] (Oracle Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2017-08-15] (Microsoft Corporation)
Handler: WSKVAllmytubechrome - {91AB862D-07B8-4A85 -  No File
 
FireFox:
========
FF HKU\S-1-5-21-1505688330-694015033-755604794-1000\...\Firefox\Extensions: [KVAllmytube@KeepVid.com] - C:\Users\Alexander Dochev\Desktop\New folder\Keepvid\KeepVid Pro\BrowserPlugin\kvallmytube@keepvid.com_xpi => not found
FF Plugin: @java.com/DTPlugin,version=11.161.2 -> C:\Program Files\Java\jre1.8.0_161\bin\dtplugin\npDeployJava1.dll [2018-01-26] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.161.2 -> C:\Program Files\Java\jre1.8.0_161\bin\plugin2\npjp2.dll [2018-01-26] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2015-07-12] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2015-07-12] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.161.2 -> C:\Program Files (x86)\Java\jre1.8.0_161\bin\dtplugin\npDeployJava1.dll [2018-01-26] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.161.2 -> C:\Program Files (x86)\Java\jre1.8.0_161\bin\plugin2\npjp2.dll [2018-01-26] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-10-18] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-21] (Microsoft Corporation)
FF Plugin-x32: @perfectworld.com/npArcPlayNowPlugin -> C:\Program Files (x86)\Arc\Plugins\npArcPluginFF.dll [2017-08-31] (Perfect World Entertainment Inc)
FF Plugin-x32: @tiancity.com/NxGame -> C:\ProgramData\Tiancity\NGM\npNxGameCN.dll [2017-09-02] (Nexon)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-16] (Google Inc.)
FF Plugin HKU\S-1-5-21-1505688330-694015033-755604794-1000: torrents-time.com/TTPlugin -> C:\Program Files (x86)\TorrentsTime Media Player\bin\npTTPlugin.dll [No File]
 
Chrome: 
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> hxxp://www.google.co.uk/
CHR StartupUrls: Default -> "hxxps://www.google.co.uk/"
CHR Profile: C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default [2018-04-28]
CHR Extension: (YouTube) - C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-06-07]
CHR Extension: (Dark Reader) - C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default\Extensions\eimadpbcbfnmbkopoojfekhnkhdbieeh [2018-04-26]
CHR Extension: (Assassin's Creed III) - C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default\Extensions\geadmffjboclimmeiaimcafapjaefnfn [2017-06-07]
CHR Extension: (AdBlock) - C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2018-04-24]
CHR Extension: (Google Maps) - C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default\Extensions\lneaknkopdijkpnocmklfnjbeapigfbh [2017-06-07]
CHR Extension: (What are you a bleep bleep?(iDubbbzTV)) - C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfmdkhjclbbjlkgjiajngllhmanljklb [2017-06-07]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-04-04]
CHR Extension: (iDubbbzTv Memes!) - C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default\Extensions\oaakdddcpbpecmmeikbdbfiopeagmppd [2017-06-07]
CHR Extension: (IT'S TIME TO STOP!) - C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfcacfgohgdodgmahbjkbndbdkmfknlo [2017-09-27]
CHR Extension: (Chrome Media Router) - C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-04-24]
CHR Extension: (That's Pretty Good (iDubbbzTV)) - C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pnidecdngnainebcfbmebgpkmnmljdng [2017-06-28]
CHR Profile: C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\System Profile [2017-06-07]
CHR Extension: (No Name) - C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\oblofgmmhnjplahhlebchjjgnjfkicch [2017-06-07]
CHR HKU\S-1-5-21-1505688330-694015033-755604794-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [dhdgffkkebhmkfjojejmpbldmpobfkfo] - hxxp://clients2.google.com/service/update2/crx
 
==================== Services (Whitelisted) ====================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
S3 ArcService; C:\Program Files (x86)\Arc\ArcService.exe [87064 2017-08-31] (Perfect World Entertainment Inc)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [7013384 2018-03-10] ()
R3 Disc Soft Bus Service; C:\Program Files (x86)\DAEMON Tools Ultra\DiscSoftBusService.exe [887056 2014-07-10] (Disc Soft Ltd)
S3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [383016 2017-08-14] (EasyAntiCheat Ltd)
S3 GalaxyClientService; C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe [665160 2018-04-23] (GOG.com)
S3 GalaxyCommunication; C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe [8109640 2018-04-23] (GOG.com)
U2 HiPatchService; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9728 2017-02-23] (Hi-Rez Studios) [File not signed]
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [332144 2017-11-21] (HP Inc.)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [355232 2015-08-09] (Intel Corporation)
R2 Intel® Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-28] (Intel® Corporation) [File not signed]
S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-28] (Intel® Corporation)
R2 Intel® ME Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [131544 2015-07-12] (Intel Corporation)
R2 isesrv; C:\Program Files (x86)\COMODO\Internet Security Essentials\isesrv.exe [1199544 2018-01-17] (COMODO)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [169432 2015-07-12] (Intel Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [119864 2016-11-14] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [361816 2016-11-14] (Microsoft Corporation)
R2 NvContainerLocalSystem; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [522688 2018-03-14] (NVIDIA Corporation)
S3 NvContainerNetworkService; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [522688 2018-03-14] (NVIDIA Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [292568 2014-12-12] (Realtek Semiconductor)
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [191728 2014-06-17] (Synaptics Incorporated)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5426448 2014-12-15] (TeamViewer GmbH)
S2 VIVACOM 3G USB Modem. RunOuc; C:\Program Files (x86)\VIVACOM 3G USB Modem\UpdateDog\ouc.exe [655712 2014-09-03] ()
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2014-02-13] (Microsoft Corporation)
R2 NVDisplay.ContainerLocalSystem; "C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe" -s NVDisplay.ContainerLocalSystem -f "C:\ProgramData\NVIDIA\NVDisplay.ContainerLocalSystem.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem" -r -p 30000
R2 NvTelemetryContainer; "C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe" -s NvTelemetryContainer -f "C:\ProgramData\NVIDIA\NvTelemetryContainer.log" -l 3 -d "C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\plugins" -r
 
===================== Drivers (Whitelisted) ======================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [172760 2013-10-02] (Broadcom Corporation.)
R3 dtscsibus; C:\Windows\System32\DRIVERS\dtscsibus.sys [29696 2014-08-20] (Disc Soft Ltd)
S3 EvolveVirtualAdapter; C:\Windows\System32\DRIVERS\evolve.sys [21656 2015-03-03] (Echobit, LLC)
R1 gtkrnl; C:\Windows\System32\drivers\gtkrnl.sys [126856 2018-03-29] ()
S3 huawei_wwanecm; C:\Windows\System32\DRIVERS\ew_juwwanecm.sys [238080 2014-09-03] (Huawei Technologies Co., Ltd.)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-11-08] (Intel Corporation)
S3 INETMON; C:\Windows\System32\Drivers\INETMON.sys [29088 2013-08-14] ()
R3 ISCT; C:\Windows\System32\DRIVERS\ISCTD64.sys [46568 2013-01-19] ()
R1 isedrv; C:\Windows\system32\drivers\isedrv.sys [50576 2018-01-17] (COMODO)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [100312 2015-07-12] (Intel Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [295000 2016-08-25] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [135928 2016-08-25] (Microsoft Corporation)
S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [31168 2018-03-14] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [59240 2017-12-15] (NVIDIA Corporation)
R3 nvvhci; C:\Windows\System32\DRIVERS\nvvhci.sys [58680 2018-01-10] (NVIDIA Corporation)
R3 RTSPER; C:\Windows\System32\DRIVERS\RtsPer.sys [466136 2014-01-15] (Realsil Semiconductor Corporation)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [31472 2014-06-17] (Synaptics Incorporated)
S3 ssudobex; C:\Windows\System32\DRIVERS\ssudobex.sys [206080 2014-01-22] (DEVGURU Co., LTD.(www.devguru.co.kr))
S3 btwampfl; \??\C:\Windows\system32\drivers\btwampfl.sys [X]
S3 btwaudio; system32\drivers\btwaudio.sys [X]
S3 btwl2cap; system32\DRIVERS\btwl2cap.sys [X]
S3 btwrchid; system32\DRIVERS\btwrchid.sys [X]
S3 catchme; \??\C:\Fixer\catchme.sys [X]
S3 clwvd; system32\DRIVERS\clwvd.sys [X]
S3 lmimirr; system32\DRIVERS\lmimirr.sys [X]
S3 RSP2STOR; system32\DRIVERS\RtsP2Stor.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 vmci; \SystemRoot\system32\DRIVERS\vmci.sys [X]
S3 VMnetAdapter; system32\DRIVERS\vmnetadapter.sys [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2018-04-28 19:53 - 2018-04-28 19:54 - 000023886 _____ C:\Users\Alexander Dochev\Desktop\FRST.txt
2018-04-28 19:44 - 2018-04-28 19:44 - 002405888 _____ (Farbar) C:\Users\Alexander Dochev\Desktop\FRST64.exe
2018-04-28 19:42 - 2018-04-28 19:52 - 000001759 _____ C:\Users\Alexander Dochev\Desktop\HELP.txt
2018-04-28 18:14 - 2018-04-28 18:16 - 000224652 _____ C:\TDSSKiller.3.1.0.17_28.04.2018_18.14.05_log.txt
2018-04-28 17:23 - 2018-04-28 17:31 - 000000000 ____D C:\Program Files (x86)\DLL Suite
2018-04-28 15:27 - 2018-04-28 15:27 - 001700352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdiplus.dll
2018-04-28 15:27 - 2018-04-28 15:27 - 001060864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc71.dll
2018-04-28 15:13 - 2018-04-28 15:13 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\COMODO
2018-04-28 15:06 - 2018-03-13 17:17 - 000440512 _____ (COMODO) C:\ProgramData\cmdres.dll
2018-04-28 14:05 - 2018-04-28 15:27 - 000000000 ____D C:\Users\Alexander Dochev\AppData\Local\Comodo
2018-04-28 14:05 - 2018-04-28 15:27 - 000000000 ____D C:\Program Files (x86)\Comodo
2018-04-28 14:05 - 2018-01-17 10:59 - 000255248 _____ (COMODO) C:\Windows\system32\iseguard64.dll
2018-04-28 14:05 - 2018-01-17 10:59 - 000205256 _____ (COMODO) C:\Windows\SysWOW64\iseguard32.dll
2018-04-28 14:05 - 2018-01-17 10:59 - 000050576 _____ (COMODO) C:\Windows\system32\Drivers\isedrv.sys
2018-04-28 14:03 - 2018-04-28 15:20 - 000000000 ____D C:\ProgramData\Comodo
2018-04-28 13:42 - 2018-04-28 13:42 - 000000000 ____D C:\ProgramData\Emsisoft
2018-04-26 13:06 - 2018-04-26 13:06 - 000000000 ____D C:\Users\Alexander Dochev\AppData\Local\ESET
2018-04-26 12:48 - 2018-04-28 19:53 - 000000000 ____D C:\FRST
2018-04-22 19:48 - 2018-04-22 20:58 - 000000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2018-04-22 19:27 - 2018-04-22 19:48 - 000000000 ____D C:\ProgramData\Malwarebytes
2018-04-22 19:27 - 2018-04-22 19:27 - 000000000 ____D C:\Program Files\Malwarebytes
2018-04-22 14:12 - 2018-04-26 02:17 - 000000000 ____D C:\AdwCleaner
2018-04-22 11:52 - 2018-04-22 11:52 - 000000000 ____D C:\Users\Alexander Dochev\AppData\LocalLow\Moe Wars
2018-04-16 19:44 - 2018-04-16 19:44 - 000000000 ____D C:\Users\Alexander Dochev\Desktop\REeee
2018-04-13 19:08 - 2018-03-31 05:09 - 005583040 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2018-04-13 19:08 - 2018-03-31 05:09 - 000708288 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2018-04-13 19:08 - 2018-03-31 05:09 - 000262336 _____ (Microsoft Corporation) C:\Windows\system32\hal.dll
2018-04-13 19:08 - 2018-03-31 05:09 - 000154816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2018-04-13 19:08 - 2018-03-31 05:09 - 000095424 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2018-04-13 19:08 - 2018-03-31 04:45 - 000631640 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2018-04-13 19:08 - 2018-03-31 04:39 - 004046528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2018-04-13 19:08 - 2018-03-31 04:39 - 003958464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2018-04-13 19:08 - 2018-03-31 04:38 - 001665336 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 001461248 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 001212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 001163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000731648 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000361984 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000094720 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000007168 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:12 - 001314064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 001114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000554496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000070144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:06 - 000148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2018-04-13 19:08 - 2018-03-31 04:06 - 000064512 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2018-04-13 19:08 - 2018-03-31 04:06 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2018-04-13 19:08 - 2018-03-31 04:06 - 000017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2018-04-13 19:08 - 2018-03-31 04:03 - 000338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2018-04-13 19:08 - 2018-03-31 04:02 - 000296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2018-04-13 19:08 - 2018-03-31 04:02 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\videoprt.sys
2018-04-13 19:08 - 2018-03-31 03:59 - 000160256 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2018-04-13 19:08 - 2018-03-31 03:58 - 000291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2018-04-13 19:08 - 2018-03-31 03:58 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2018-04-13 19:08 - 2018-03-31 03:58 - 000112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2018-04-13 19:08 - 2018-03-31 03:58 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2018-04-13 19:08 - 2018-03-31 03:51 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2018-04-13 19:08 - 2018-03-31 03:47 - 000036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2018-04-13 19:08 - 2018-03-31 03:47 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2018-04-13 19:08 - 2018-03-31 03:47 - 000014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2018-04-13 19:08 - 2018-03-31 03:47 - 000007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2018-04-13 19:08 - 2018-03-31 03:47 - 000006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 03:47 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 03:47 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 03:47 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 03:47 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2018-04-13 19:08 - 2018-03-28 10:30 - 003225600 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2018-04-13 19:08 - 2018-03-23 21:50 - 000396952 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2018-04-13 19:08 - 2018-03-23 20:59 - 000348824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2018-04-13 19:08 - 2018-03-23 02:00 - 025742336 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2018-04-13 19:08 - 2018-03-23 00:32 - 002724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2018-04-13 19:08 - 2018-03-23 00:32 - 000004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2018-04-13 19:08 - 2018-03-23 00:26 - 020287488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2018-04-13 19:08 - 2018-03-23 00:19 - 002901504 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2018-04-13 19:08 - 2018-03-23 00:18 - 000066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2018-04-13 19:08 - 2018-03-23 00:17 - 000578048 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2018-04-13 19:08 - 2018-03-23 00:17 - 000417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2018-04-13 19:08 - 2018-03-23 00:17 - 000088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2018-04-13 19:08 - 2018-03-23 00:17 - 000048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2018-04-13 19:08 - 2018-03-23 00:15 - 005780480 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2018-04-13 19:08 - 2018-03-23 00:10 - 000054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2018-04-13 19:08 - 2018-03-23 00:09 - 000034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2018-04-13 19:08 - 2018-03-23 00:07 - 000615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2018-04-13 19:08 - 2018-03-23 00:06 - 000794112 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2018-04-13 19:08 - 2018-03-23 00:06 - 000144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2018-04-13 19:08 - 2018-03-23 00:06 - 000116224 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2018-04-13 19:08 - 2018-03-23 00:05 - 000814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2018-04-13 19:08 - 2018-03-23 00:04 - 002724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2018-04-13 19:08 - 2018-03-22 23:58 - 000969216 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2018-04-13 19:08 - 2018-03-22 23:55 - 000489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2018-04-13 19:08 - 2018-03-22 23:52 - 000499712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2018-04-13 19:08 - 2018-03-22 23:52 - 000062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2018-04-13 19:08 - 2018-03-22 23:51 - 000341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2018-04-13 19:08 - 2018-03-22 23:51 - 000047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2018-04-13 19:08 - 2018-03-22 23:50 - 000064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2018-04-13 19:08 - 2018-03-22 23:49 - 000077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2018-04-13 19:08 - 2018-03-22 23:48 - 002295296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2018-04-13 19:08 - 2018-03-22 23:48 - 000107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2018-04-13 19:08 - 2018-03-22 23:48 - 000087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2018-04-13 19:08 - 2018-03-22 23:45 - 000199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2018-04-13 19:08 - 2018-03-22 23:45 - 000047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2018-04-13 19:08 - 2018-03-22 23:45 - 000030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2018-04-13 19:08 - 2018-03-22 23:44 - 000092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2018-04-13 19:08 - 2018-03-22 23:43 - 000476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2018-04-13 19:08 - 2018-03-22 23:42 - 000661504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2018-04-13 19:08 - 2018-03-22 23:42 - 000315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2018-04-13 19:08 - 2018-03-22 23:42 - 000115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2018-04-13 19:08 - 2018-03-22 23:41 - 000620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2018-04-13 19:08 - 2018-03-22 23:40 - 000152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2018-04-13 19:08 - 2018-03-22 23:33 - 000416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2018-04-13 19:08 - 2018-03-22 23:31 - 000262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2018-04-13 19:08 - 2018-03-22 23:29 - 015282688 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2018-04-13 19:08 - 2018-03-22 23:29 - 000809472 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2018-04-13 19:08 - 2018-03-22 23:29 - 000728064 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2018-04-13 19:08 - 2018-03-22 23:29 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2018-04-13 19:08 - 2018-03-22 23:28 - 000091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2018-04-13 19:08 - 2018-03-22 23:28 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2018-04-13 19:08 - 2018-03-22 23:27 - 002135552 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2018-04-13 19:08 - 2018-03-22 23:27 - 001359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2018-04-13 19:08 - 2018-03-22 23:25 - 000168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2018-04-13 19:08 - 2018-03-22 23:25 - 000076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2018-04-13 19:08 - 2018-03-22 23:24 - 000279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2018-04-13 19:08 - 2018-03-22 23:22 - 000130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2018-04-13 19:08 - 2018-03-22 23:21 - 004496896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2018-04-13 19:08 - 2018-03-22 23:20 - 013680128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2018-04-13 19:08 - 2018-03-22 23:17 - 000230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2018-04-13 19:08 - 2018-03-22 23:15 - 003241472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2018-04-13 19:08 - 2018-03-22 23:15 - 000696320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2018-04-13 19:08 - 2018-03-22 23:14 - 002059776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2018-04-13 19:08 - 2018-03-22 23:14 - 001155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2018-04-13 19:08 - 2018-03-22 23:04 - 001545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2018-04-13 19:08 - 2018-03-22 22:55 - 002767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2018-04-13 19:08 - 2018-03-22 22:53 - 000800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2018-04-13 19:08 - 2018-03-22 22:52 - 001313792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2018-04-13 19:08 - 2018-03-22 22:51 - 000710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2018-04-13 19:08 - 2018-03-10 20:11 - 000340480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msexcl40.dll
2018-04-13 19:08 - 2018-03-09 21:18 - 000309440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2018-04-13 19:08 - 2018-03-09 21:12 - 000383680 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2018-04-13 19:08 - 2018-03-09 21:12 - 000111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\t2embed.dll
2018-04-13 19:08 - 2018-03-09 21:12 - 000071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2018-04-13 19:08 - 2018-03-09 21:12 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2018-04-13 19:08 - 2018-03-09 21:11 - 000010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2018-04-13 19:08 - 2018-03-09 21:07 - 000152064 _____ (Microsoft Corporation) C:\Windows\system32\t2embed.dll
2018-04-13 19:08 - 2018-03-09 21:07 - 000100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2018-04-13 19:08 - 2018-03-09 21:07 - 000041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2018-04-13 19:08 - 2018-03-09 21:06 - 000046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2018-04-13 19:08 - 2018-03-09 21:06 - 000014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2018-04-13 19:08 - 2018-03-09 20:31 - 000034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2018-04-13 19:08 - 2018-03-06 21:13 - 000148160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\basecsp.dll
2018-04-13 19:08 - 2018-03-06 21:11 - 000184320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scksp.dll
2018-04-13 19:08 - 2018-03-06 21:11 - 000052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wsnmp32.dll
2018-04-13 19:08 - 2018-03-06 21:10 - 000170176 _____ (Microsoft Corporation) C:\Windows\system32\basecsp.dll
2018-04-13 19:08 - 2018-03-06 21:07 - 000229376 _____ (Microsoft Corporation) C:\Windows\system32\scksp.dll
2018-04-13 19:08 - 2018-03-06 21:07 - 000067072 _____ (Microsoft Corporation) C:\Windows\system32\wsnmp32.dll
2018-04-13 19:08 - 2018-02-22 06:28 - 000217600 _____ (Microsoft Corporation) C:\Windows\system32\WinSCard.dll
2018-04-13 19:08 - 2018-02-22 06:06 - 000134656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinSCard.dll
2018-04-13 19:08 - 2018-02-10 21:35 - 000367296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msrpc.sys
2018-04-13 19:08 - 2018-02-10 21:35 - 000334528 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\acpi.sys
2018-04-13 19:08 - 2018-02-10 21:35 - 000185024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pci.sys
2018-04-13 19:08 - 2018-02-10 21:35 - 000122560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\NV_AGP.SYS
2018-04-13 19:08 - 2018-02-10 21:35 - 000068288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volmgr.sys
2018-04-13 19:08 - 2018-02-10 21:35 - 000064192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ULIAGPKX.SYS
2018-04-13 19:08 - 2018-02-10 21:35 - 000063168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\termdd.sys
2018-04-13 19:08 - 2018-02-10 21:35 - 000060608 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\AGP440.sys
2018-04-13 19:08 - 2018-02-10 21:35 - 000036032 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vdrvroot.sys
2018-04-13 19:08 - 2018-02-10 21:35 - 000031936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mssmbios.sys
2018-04-13 19:08 - 2018-02-10 21:35 - 000023744 _____ (Microsoft Corporation) C:\Windows\system32\streamci.dll
2018-04-13 19:08 - 2018-02-10 21:35 - 000020160 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\isapnp.sys
2018-04-13 19:08 - 2018-02-10 21:35 - 000015040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msisadrv.sys
2018-04-13 19:08 - 2018-02-10 21:35 - 000012096 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\swenum.sys
2018-04-13 19:08 - 2018-02-10 21:23 - 002292224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSVidCtl.dll
2018-04-13 19:08 - 2018-02-10 21:23 - 000330240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\zipfldr.dll
2018-04-13 19:08 - 2018-02-10 21:23 - 000111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\racpldlg.dll
2018-04-13 19:08 - 2018-02-10 21:11 - 003665920 _____ (Microsoft Corporation) C:\Windows\system32\MSVidCtl.dll
2018-04-13 19:08 - 2018-02-10 21:11 - 000369664 _____ (Microsoft Corporation) C:\Windows\system32\zipfldr.dll
2018-04-13 19:08 - 2018-02-10 21:11 - 000133120 _____ (Microsoft Corporation) C:\Windows\system32\msrahc.dll
2018-04-13 19:08 - 2018-02-10 21:11 - 000119296 _____ (Microsoft Corporation) C:\Windows\system32\racpldlg.dll
2018-04-13 19:08 - 2018-02-10 20:36 - 000108032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msra.exe
2018-04-13 19:08 - 2018-02-10 20:36 - 000040960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdchange.exe
2018-04-13 19:08 - 2018-02-10 20:36 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsraLegacy.tlb
2018-04-13 19:08 - 2018-02-10 20:26 - 000653312 _____ (Microsoft Corporation) C:\Windows\system32\msra.exe
2018-04-13 19:08 - 2018-02-10 20:26 - 000051712 _____ (Microsoft Corporation) C:\Windows\system32\sdchange.exe
2018-04-13 19:08 - 2018-02-10 20:25 - 000014336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wmiacpi.sys
2018-04-13 19:08 - 2018-02-10 20:25 - 000009728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\errdev.sys
2018-04-13 19:08 - 2018-02-10 20:25 - 000007168 _____ (Microsoft Corporation) C:\Windows\system32\MsraLegacy.tlb
2018-04-13 19:08 - 2018-02-02 21:40 - 000114368 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2018-04-13 19:08 - 2018-02-02 21:29 - 002365952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2018-04-13 19:08 - 2018-02-02 21:29 - 000337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2018-04-13 19:08 - 2018-02-02 21:29 - 000025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msimsg.dll
2018-04-13 19:08 - 2018-02-02 21:28 - 001806848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2018-04-13 19:08 - 2018-02-02 21:16 - 003246080 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2018-04-13 19:08 - 2018-02-02 21:16 - 000504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2018-04-13 19:08 - 2018-02-02 21:16 - 000025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2018-04-13 19:08 - 2018-02-02 21:14 - 001942016 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2018-04-13 19:08 - 2018-02-02 21:14 - 000070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2018-04-13 19:08 - 2018-02-02 20:46 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2018-04-13 19:08 - 2018-02-02 20:36 - 000128512 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2018-04-13 19:08 - 2018-01-25 17:05 - 000995272 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000063832 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000020824 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000019800 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000017752 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000017752 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000016216 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000015704 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000014168 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000014168 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000013656 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000012632 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000012632 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000012632 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000012120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000012120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000012120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000012120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000012120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000011608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000011608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000011608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000011608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000922944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ucrtbase.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000066392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-private-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-math-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000019800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000017752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-string-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000017752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000016216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000015704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000014168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-time-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000014168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000013656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000012632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000012632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000012632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000012120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000012120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000012120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000012120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000012120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000011608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l2-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000011608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000011608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000011608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll
2018-04-13 19:08 - 2018-01-15 22:59 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2018-04-13 19:08 - 2018-01-15 22:40 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2018-04-13 19:08 - 2018-01-12 19:40 - 000407040 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2018-04-13 19:08 - 2018-01-12 19:26 - 000308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2018-04-11 19:22 - 2018-03-14 20:14 - 000135360 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2018-04-11 19:22 - 2018-03-14 20:09 - 000656384 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2018-04-11 19:22 - 2018-03-14 16:05 - 001993728 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2018-04-11 19:22 - 2018-03-14 16:05 - 001559552 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2018-04-11 19:22 - 2018-03-14 16:05 - 000739840 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2018-04-11 19:22 - 2018-03-14 16:05 - 000599552 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2018-04-11 19:22 - 2018-03-14 16:05 - 000450048 _____ (Microsoft Corporation) C:\Windows\system32\centel.dll
2018-04-11 19:22 - 2018-03-14 16:05 - 000414720 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2018-04-11 19:22 - 2018-03-14 16:05 - 000291840 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2018-04-11 19:22 - 2018-03-14 16:05 - 000237056 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2018-03-30 21:10 - 2018-02-19 00:34 - 000634272 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2018-03-29 02:59 - 2018-03-29 02:59 - 000126856 _____ C:\Windows\system32\Drivers\gtkrnl.sys
2018-03-29 02:59 - 2018-03-29 02:59 - 000000000 ____D C:\Windows\SysWOW64\NV
2018-03-29 02:59 - 2018-03-29 02:59 - 000000000 ____D C:\Windows\system32\NV
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2018-04-28 19:06 - 2014-10-30 23:08 - 000000000 ____D C:\Program Files (x86)\Steam
2018-04-28 19:02 - 2014-08-20 16:55 - 000000000 ____D C:\ProgramData\NVIDIA
2018-04-28 19:00 - 2014-08-20 15:09 - 000000000 __SHD C:\Users\Alexander Dochev\IntelGraphicsProfiles
2018-04-28 18:59 - 2017-03-12 21:12 - 000000000 ____D C:\Program Files (x86)\Hi-Rez Studios
2018-04-28 18:59 - 2016-07-01 23:00 - 000000000 ____D C:\Users\Alexander Dochev\Documents\Assassin's Creed Unity
2018-04-28 18:58 - 2016-04-19 14:15 - 000000147 _____ C:\HaxLogs.txt
2018-04-28 18:58 - 2009-07-14 08:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2018-04-28 18:57 - 2009-07-14 07:45 - 000035664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2018-04-28 18:57 - 2009-07-14 07:45 - 000035664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2018-04-28 18:48 - 2017-05-19 21:20 - 000000000 ____D C:\Users\Alexander Dochev\Downloads\Fix my bleep bleep please
2018-04-28 18:40 - 2017-05-19 12:32 - 000000000 ____D C:\Qoobox
2018-04-28 18:33 - 2017-05-19 12:32 - 000000000 ____D C:\Windows\erdnt
2018-04-28 18:33 - 2009-07-14 05:34 - 000000215 _____ C:\Windows\system.ini
2018-04-28 18:11 - 2017-05-25 02:17 - 000000000 ____D C:\Windows\Minidump
2018-04-28 17:34 - 2014-08-20 15:10 - 000113824 _____ C:\Users\Alexander Dochev\AppData\Local\GDIPFONTCACHEV1.DAT
2018-04-28 17:32 - 2009-07-14 07:45 - 000444872 _____ C:\Windows\system32\FNTCACHE.DAT
2018-04-28 17:19 - 2016-11-15 16:30 - 000000000 ____D C:\Users\Alexander Dochev\AppData\Local\Battle.net
2018-04-28 16:19 - 2016-11-15 16:29 - 000000000 ____D C:\Program Files (x86)\Battle.net
2018-04-28 13:58 - 2014-08-24 20:23 - 000000000 ____D C:\Users\Alexander Dochev\Downloads\Fable.III-SKIDROW
2018-04-26 20:19 - 2009-07-14 06:20 - 000000000 ____D C:\Windows\system32\NDF
2018-04-26 19:29 - 2015-02-08 10:30 - 000000000 ____D C:\Users\Alexander Dochev\Downloads\Android
2018-04-26 01:29 - 2016-04-23 19:38 - 000000000 ____D C:\Users\Alexander Dochev\AppData\Roaming\discord
2018-04-24 23:19 - 2014-08-21 09:25 - 000000000 ___RD C:\Games
2018-04-23 21:33 - 2016-11-03 01:46 - 000000000 ____D C:\Program Files (x86)\GOG Galaxy
2018-04-23 21:32 - 2009-07-14 08:13 - 000783606 _____ C:\Windows\system32\PerfStringBackup.INI
2018-04-23 21:32 - 2009-07-14 06:20 - 000000000 ____D C:\Windows\inf
2018-04-23 21:26 - 2014-08-20 21:27 - 000000000 ____D C:\Users\Alexander Dochev
2018-04-23 21:24 - 2016-11-15 16:29 - 000000000 ____D C:\Users\Alexander Dochev\AppData\Roaming\Battle.net
2018-04-23 21:24 - 2016-05-05 15:16 - 000000000 ____D C:\Users\Alexander Dochev\Documents\Overwatch
2018-04-23 21:24 - 2014-10-28 02:42 - 000000000 ____D C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform
2018-04-23 21:23 - 2017-05-20 01:19 - 000000000 ____D C:\Program Files\Microsoft Security Client
2018-04-23 21:23 - 2017-05-20 01:19 - 000000000 ____D C:\Program Files (x86)\Microsoft Security Client
2018-04-23 21:23 - 2009-07-14 06:20 - 000000000 ____D C:\Windows\registration
2018-04-23 21:22 - 2018-02-07 12:17 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com
2018-04-22 21:34 - 2014-12-27 05:56 - 000000000 ____D C:\Users\Alexander Dochev\AppData\Local\Deployment
2018-04-15 15:59 - 2009-07-14 06:20 - 000000000 ____D C:\Windows\rescache
2018-04-15 15:18 - 2014-10-26 21:12 - 000000000 ____D C:\Users\Alexander Dochev\AppData\Local\CrashDumps
2018-04-15 03:31 - 2015-04-16 13:37 - 000000000 ____D C:\Windows\system32\appraiser
2018-04-15 03:31 - 2009-07-14 06:20 - 000000000 ____D C:\Windows\PolicyDefinitions
2018-04-15 03:14 - 2014-08-20 14:42 - 000000000 ____D C:\Windows\system32\MRT
2018-04-15 03:12 - 2017-10-12 03:05 - 136971704 ____C (Microsoft Corporation) C:\Windows\system32\MRT-KB890830.exe
2018-04-15 03:11 - 2014-08-20 21:27 - 136971704 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2018-04-15 03:07 - 2016-12-01 15:33 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2018-04-15 03:06 - 2009-07-14 05:34 - 000000514 _____ C:\Windows\win.ini
2018-04-11 18:59 - 2014-09-07 13:05 - 000804864 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2018-04-11 18:59 - 2014-09-07 13:05 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2018-04-11 18:59 - 2014-09-07 13:05 - 000004312 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2018-04-11 18:59 - 2014-09-07 13:05 - 000000000 ____D C:\Windows\SysWOW64\Macromed
2018-04-11 18:59 - 2014-09-07 13:05 - 000000000 ____D C:\Windows\system32\Macromed
2018-04-01 02:57 - 2017-06-01 22:25 - 000000000 ____D C:\Users\Alexander Dochev\AppData\Roaming\RenPy
2018-04-01 02:57 - 2014-08-20 17:05 - 000000000 ____D C:\Users\Alexander Dochev\AppData\Local\NVIDIA
 
==================== Files in the root of some directories =======
 
2018-04-28 15:06 - 2018-03-13 17:17 - 000440512 _____ (COMODO) C:\ProgramData\cmdres.dll
2017-05-18 17:25 - 2017-05-18 17:25 - 000248822 _____ () C:\Users\Alexander Dochev\AppData\Local\ars.cache
2017-05-18 17:26 - 2017-05-18 17:26 - 000468434 _____ () C:\Users\Alexander Dochev\AppData\Local\census.cache
2017-05-18 16:45 - 2017-05-18 16:45 - 000000036 _____ () C:\Users\Alexander Dochev\AppData\Local\housecall.guid.cache
2014-08-20 21:53 - 2016-06-22 09:38 - 000007633 _____ () C:\Users\Alexander Dochev\AppData\Local\resmon.resmoncfg
2017-05-18 16:58 - 2017-05-18 16:58 - 000000010 _____ () C:\Users\Alexander Dochev\AppData\Local\sponge.last.runtime.cache
 
==================== Bamital & volsnap ======================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 
LastRegBack: 2018-04-28 11:40
 
==================== End of FRST.txt ============================
 
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25.04.2018
Ran by Alexander Dochev (28-04-2018 19:54:28)
Running from C:\Users\Alexander Dochev\Desktop
Windows 7 Ultimate Service Pack 1 (X64) (2014-08-20 18:27:42)
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-1505688330-694015033-755604794-500 - Administrator - Disabled)
Alexander Dochev (S-1-5-21-1505688330-694015033-755604794-1000 - Administrator - Enabled) => C:\Users\Alexander Dochev
Guest (S-1-5-21-1505688330-694015033-755604794-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1505688330-694015033-755604794-1002 - Limited - Enabled)
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: Microsoft Security Essentials (Disabled - Up to date) {71A27EC9-3DA6-45FC-60A7-004F623C6189}
AS: Microsoft Security Essentials (Disabled - Up to date) {CAC39F2D-1B9C-4A72-5A17-3B3D19BB2B34}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
«Assassin`s Creed III»  1.06 (HKLM-x32\...\{9D15E813-0C26-41E7-ABC5-3EB06FF1B3CF}_is1) (Version: 1.06 - Ubisoft)
«The Elder Scrolls V - Skyrim»  1.9.32.0.8 (HKLM-x32\...\The Elder Scrolls V - Skyrim_is1) (Version: 1.9.32.0.8 - Bethesda Softworks)
Adobe Flash Player 29 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 29.0.0.140 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKU\S-1-5-21-1505688330-694015033-755604794-1000\...\Akamai) (Version:  - Akamai Technologies, Inc)
Arc (HKLM-x32\...\{CED8E25B-122A-4E80-B612-7F99B93284B3}) (Version: 1.0.0.9668 - Perfect World Entertainment)
AVG 2016 (HKLM\...\{13E0C5B7-711E-425A-98B1-4A9C97AE927F}) (Version: 16.0.4647 - AVG Technologies) Hidden
Bandicam (HKLM-x32\...\Bandicam) (Version: 2.1.2.739 - Bandisoft.com)
Bandisoft MPEG-1 Decoder (HKLM-x32\...\BandiMPEG1) (Version:  - Bandisoft.com)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
Broadcom Bluetooth Software (HKLM\...\{A1439D4F-FD46-47F2-A1D3-FEE097C29A09}) (Version: 6.5.1.5300 - Broadcom Corporation)
DAEMON Tools Ultra (HKLM-x32\...\DAEMON Tools Ultra) (Version: 2.4.0.0280 - Disc Soft Ltd)
Dark Souls 3 (HKLM-x32\...\Dark Souls 3_is1) (Version:  - )
Dark Souls II Scholar of the First Sin (HKLM-x32\...\Dark Souls II Scholar of the First Sin_is1) (Version:  - )
Discord (HKU\S-1-5-21-1505688330-694015033-755604794-1000\...\Discord) (Version: 0.0.300 - Discord Inc.)
Dishonored (HKLM-x32\...\Dishonored_is1) (Version:  - )
DisplayDriverAnalyzer (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_DisplayDriverAnalyzer) (Version: 391.35 - NVIDIA Corporation) Hidden
Dungeon Siege 2 (HKLM-x32\...\DungeonSiege2) (Version:  - Microsoft)
Dungeon Siege 2 Broken World (HKLM-x32\...\{A563C4F4-BE36-4956-BA0B-E02BDD9F70D5}) (Version: 1.00.0000 - Gas Powered Games)
Fable III (HKLM-x32\...\{4D53090A-9B45-437B-A66A-831000008300}) (Version: 1.0.0000.131 - Microsoft Game Studios) Hidden
Fable III (HKLM-x32\...\{4D53090A-CE35-42BD-B377-831000018301}) (Version: 1.0.0001.131 - Microsoft Game Studios) Hidden
Fable III (HKLM-x32\...\{4D53090A-CE35-42BD-B377-831000018302}) (Version: 1.0.0001.131 - Microsoft Game Studios) Hidden
Fable III (HKLM-x32\...\GFWL_{4D53090A-9B45-437B-A66A-831000008300}) (Version: 1.0.0000.131 - Microsoft Game Studios)
GOG Galaxy (HKLM-x32\...\{7258BA11-600C-430E-A759-27E2C691A335}_is1) (Version:  - GOG.com)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 66.0.3359.139 - Google Inc.)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.7 - Google Inc.) Hidden
Gwent (HKLM-x32\...\1971477531_is1) (Version: 0.9.23.5.430.3 - GOG.com)
Hewlett-Packard ACLM.NET v1.2.2.3 (HKLM-x32\...\{6F340107-F9AA-47C6-B54C-C3A19F11553F}) (Version: 1.00.0000 - Hewlett-Packard Company) Hidden
Hi-Rez Studios Authenticate and Update Service (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}) (Version: 3.0.0.0 - Hi-Rez Studios)
HP Support Solutions Framework (HKLM-x32\...\{A772EA32-AE5B-4474-BFC0-4C69C04AFF6A}) (Version: 12.8.47.1 - Hewlett-Packard Company)
I Am Alive (HKLM-x32\...\{62952508-8C6F-4D31-9802-099FC67B41C3}) (Version: 1.01.0 - Ubisoft) Hidden
I Am Alive (HKLM-x32\...\InstallShield_{62952508-8C6F-4D31-9802-099FC67B41C3}) (Version: 1.01.0 - Ubisoft)
Intel® Chipset Device Software (HKLM-x32\...\{4a87bd28-a855-4a8d-b133-60ca8ccffd30}) (Version: 10.0.17 - Intel® Corporation) Hidden
Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.23.1766 - Intel Corporation)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.14.4264 - Intel Corporation)
Intel® Hardware Accelerated Execution Manager (HKLM\...\{30F3FF94-225B-4319-A13C-E307FFDA3CFB}) (Version: 6.0.1 - Intel Corporation)
Internet Security Essentials (HKLM-x32\...\ComodoIse) (Version: 1.3.438464.135 - Comodo)
Java 8 Update 161 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180161F0}) (Version: 8.0.1610.12 - Oracle Corporation)
Java 8 Update 161 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180161F0}) (Version: 8.0.1610.12 - Oracle Corporation)
Java SE Development Kit 8 Update 77 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180770}) (Version: 8.0.770.3 - Oracle Corporation)
Malwarebytes Activation (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 3.0.6.1469 - Malwarebytes)
Microsoft .NET Framework 4.7.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.7.02558 - Microsoft Corporation)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.10.209.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 RC Redistributable (x64) - 14.0.22816 (HKLM-x32\...\{e2495eb6-cca8-47aa-91ea-3410ca44d7b7}) (Version: 14.0.22816.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 (HKLM-x32\...\{d992c12e-cab2-426f-bde3-fb8c53950b0d}) (Version: 14.0.24215.1 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Xbox 360 Accessories 1.2 (HKLM\...\{D9C50188-12D5-4D3E-8F00-682346C2AA5F}) (Version: 1.20.146.0 - Microsoft)
Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
Middle-earth Shadow of War v.1.0 (HKLM-x32\...\Middle-earth Shadow of War_is1) (Version:  - )
Necropolis (HKLM-x32\...\1453282796_is1) (Version: 2.5.0.7 - GOG.com)
NVIDIA GeForce Experience 3.13.1.30 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 3.13.1.30 - NVIDIA Corporation)
NVIDIA Graphics Driver 391.35 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 391.35 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.17.0524 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.17.0524 - NVIDIA Corporation)
Outils de vérification linguistique 2013 de Microsoft Office - Français (HKLM\...\{90150000-001F-040C-1000-0000000FF1CE}) (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Overgrowth (HKLM-x32\...\Overgrowth_is1) (Version:  - )
Overwatch (HKLM-x32\...\Overwatch) (Version:  - Blizzard Entertainment)
Python 3.5.2 (32-bit) (HKU\S-1-5-21-1505688330-694015033-755604794-1000\...\{cf72a2ab-2f1d-49fd-a0d7-1065e6357e1e}) (Version: 3.5.2150.0 - Python Software Foundation)
Python 3.5.2 Core Interpreter (32-bit) (HKLM-x32\...\{EB0611B2-7F10-4D97-BCF2-DCAAB1199498}) (Version: 3.5.2150.0 - Python Software Foundation) Hidden
Python 3.5.2 Development Libraries (32-bit) (HKLM-x32\...\{5DB2183B-62D3-407F-BBC1-EAD2F36283FA}) (Version: 3.5.2150.0 - Python Software Foundation) Hidden
Python 3.5.2 Documentation (32-bit) (HKLM-x32\...\{1FBA5182-78DD-4940-9F06-96E5042B7061}) (Version: 3.5.2150.0 - Python Software Foundation) Hidden
Python 3.5.2 Executables (32-bit) (HKLM-x32\...\{33B10015-A9B1-4210-B50A-26C6443979B0}) (Version: 3.5.2150.0 - Python Software Foundation) Hidden
Python 3.5.2 pip Bootstrap (32-bit) (HKLM-x32\...\{9ADF9987-3327-48C6-91B3-B10900366491}) (Version: 3.5.2150.0 - Python Software Foundation) Hidden
Python 3.5.2 Standard Library (32-bit) (HKLM-x32\...\{FCBB04F4-D2CF-4F55-BE92-B3898696B318}) (Version: 3.5.2150.0 - Python Software Foundation) Hidden
Python 3.5.2 Tcl/Tk Support (32-bit) (HKLM-x32\...\{C1153533-FDC4-4922-892D-B71810F69566}) (Version: 3.5.2150.0 - Python Software Foundation) Hidden
Python 3.5.2 Test Suite (32-bit) (HKLM-x32\...\{9D50A6D7-410A-4469-87B7-35FA84CBD479}) (Version: 3.5.2150.0 - Python Software Foundation) Hidden
Python 3.5.2 Utility Scripts (32-bit) (HKLM-x32\...\{E6DEBF43-7ACF-4E88-9BBF-9B5945683281}) (Version: 3.5.2150.0 - Python Software Foundation) Hidden
Python Launcher (HKLM-x32\...\{963ECCDD-F09F-4C24-9367-8B5D748AA7C8}) (Version: 3.5.2121.0 - Python Software Foundation)
qBittorrent 4.0.3 (HKLM-x32\...\qBittorrent) (Version: 4.0.3 - The qBittorrent project)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.85.423.2014 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7404 - Realtek Semiconductor Corp.)
Rising Thunder (HKLM-x32\...\{058B8624-E23B-4AD5-AF38-F9E70D6225EE}) (Version: 1.00.0000 - Radiant)
Rockstar Games Social Club (HKLM-x32\...\Rockstar Games Social Club) (Version: 1.2.1.9 - Rockstar Games)
Shark007 ADVANCED Codecs (HKLM-x32\...\{8C0CAA7A-3272-4991-A808-2C7559DE3409}) (Version: 8.2.7 - Shark007)
Shark007 ADVANCED x64Components (HKLM\...\ADVANCED x64Components_is1) (Version: 8.2.7 - Shark007)
Skype™ 7.28 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.28.101 - Skype Technologies S.A.)
State of Decay Year-One (HKLM-x32\...\State of Decay Year-One_is1) (Version:  - )
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Styx Shards of Darkness (HKLM-x32\...\Styx Shards of Darkness_is1) (Version:  - )
Styx: Master of Shadows (HKLM-x32\...\U3R5eE1hc3Rlcm9mU2hhZG93cw==_is1) (Version: 1 - )
SUPERHOT (HKLM-x32\...\1456141688_is1) (Version: 2.0.0.4 - GOG.com)
Synaptics ClickPad Driver (HKLM\...\SynTPDeinstKey) (Version: 18.1.7.16 - Synaptics Incorporated)
System Requirements Lab (HKLM-x32\...\{A92D0DBB-834A-4CAD-A434-F2232C692516}) (Version: 6.1.4.0 - Husdawg, LLC)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.18 - TeamSpeak Systems GmbH)
TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.36897 - TeamViewer)
univcredist (HKLM-x32\...\{2d9d4a60-1d22-46c1-84bb-1de04b4715d7}) (Version: 1.0.0.0 - Motiga)
Update for Skype for Business 2015 (KB4018334) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{E27BA6F9-6C03-4D1F-B34F-E3B1AB6B5C36}) (Version:  - Microsoft)
Update for Skype for Business 2015 (KB4018334) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUS_{E27BA6F9-6C03-4D1F-B34F-E3B1AB6B5C36}) (Version:  - Microsoft)
Update for Skype for Business 2015 (KB4018334) 64-Bit Edition (HKLM\...\{90150000-012B-0409-1000-0000000FF1CE}_Office15.PROPLUS_{E27BA6F9-6C03-4D1F-B34F-E3B1AB6B5C36}) (Version:  - Microsoft)
Uplay (HKLM-x32\...\Uplay) (Version: 26.1 - Ubisoft)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VIVACOM 3G USB Modem (HKLM-x32\...\VIVACOM 3G USB Modem) (Version: 21.005.22.07.738 - Huawei Technologies Co.,Ltd)
Vulkan Run Time Libraries 1.0.3.0 (HKLM\...\VulkanRT1.0.3.0) (Version: 1.0.3.0 - LunarG, Inc.)
Vulkan Run Time Libraries 1.0.65.1 (HKLM\...\VulkanRT1.0.65.1) (Version: 1.0.65.1 - LunarG, Inc.) Hidden
Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
Windows Media Player 64-bit Plug-in Fix (HKLM\...\{00a8ce68-cb2e-4652-aecd-c05c0d9d53a7}.sdb) (Version:  - )
Windows Media Player Plus! 2.8 (HKLM-x32\...\{67E4EF06-E0D6-42E0-A2BA-67199B0143FB}_is1) (Version: 2.8 - BM-productions)
WinRAR 5.10 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.10.0 - win.rar GmbH)
反恐精英Online2 (HKLM-x32\...\Counter-Strike Online 2) (Version:  - )
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
CustomCLSID: HKU\S-1-5-21-1505688330-694015033-755604794-1000_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
ContextMenuHandlers1: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => c:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2014-06-11] (Alexander Roshal)
ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2014-06-11] (Alexander Roshal)
ContextMenuHandlers2: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => c:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers4: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => c:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers4: [MSSE] -> {0365FE2C-F183-4091-AC82-BFC39FB75C49} =>  -> No File
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\Windows\system32\igfxDTCM.dll [2015-08-09] (Intel Corporation)
ContextMenuHandlers5: [igfxOSP] -> {FA507C3F-30C6-4DCA-9EE5-2656072EEC14} => C:\Windows\system32\igfxOSP.dll [2015-08-09] (Intel Corporation)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\Windows\system32\nvshext.dll [2018-03-24] (NVIDIA Corporation)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2014-06-11] (Alexander Roshal)
ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2014-06-11] (Alexander Roshal)
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {03A8DD19-554D-4776-B311-03346F78FF0F} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2018-03-14] (NVIDIA Corporation)
Task: {0EBA1A06-25C5-438A-8654-6345933CCF16} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {2088373E-6F79-4C7B-BA3B-36A644BAA41E} - System32\Tasks\AVGPCTuneUp_Task_BkGndMaintenance => C:\Program Files (x86)\AVG\AVG PC TuneUp\tuscanx.exe
Task: {26B9E587-A82D-4127-9689-667D7597AB13} - \AVG_SYS_TASK_0615av_RUN -> No File <==== ATTENTION
Task: {29A3D3AF-0EA8-43DF-A394-866512FEF6A7} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe
Task: {2D8976EB-BBF9-48F0-BB6C-1FC275C9FDB7} - System32\Tasks\SidebarExecute => C:\Program Files (x86)\Windows Sidebar\sidebar.exe [2010-11-21] (Microsoft Corporation)
Task: {374904A2-42E3-4301-8CB0-9E84BB664021} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2018-04-11] (Adobe Systems Incorporated)
Task: {41856DD6-76FE-4FB1-B94D-F84078260FB2} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2017-09-20] (HP Inc.)
Task: {41A8E8A5-7598-4572-B15D-87F0DE759D73} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-02-08] (Google Inc.)
Task: {484F628A-CA9C-4166-9639-615A4302FCAB} - System32\Tasks\{9EB021E1-716A-4B0F-8320-4A96C5522587} => C:\Windows\system32\pcalua.exe -a "C:\Users\Alexander Dochev\AppData\Roaming\istartsurf\UninstallManager.exe" -c -ptid=amt
Task: {4CA681A8-9CD7-4B96-8F21-059804CE5580} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2018-03-14] (NVIDIA Corporation)
Task: {5B220963-DBE4-41C5-AD53-81A47C098CDF} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe
Task: {6BB24196-9952-4185-B16E-291A3AF3EE2C} - System32\Tasks\winmgr89.exe => C:\Users\Alexander [Argument = Dochev\AppData\Roaming\Windows\winmgr89.exe]
Task: {6F57FEAA-77BC-4CC9-B58B-1890EA03A5CD} - System32\Tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA GeForce Experience.exe [2018-03-14] (NVIDIA Corporation)
Task: {7BF78A91-B81D-4559-B095-0E94F6502535} - System32\Tasks\Games\UpdateCheck_S-1-5-21-1505688330-694015033-755604794-1000
Task: {808608E7-7941-4754-8E8D-140E439BCFBF} - System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [2018-03-14] (NVIDIA Corporation)
Task: {85D0C6A8-116D-4CB5-A74C-E6840D5AD902} - System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2018-03-14] (NVIDIA Corporation)
Task: {8B7A0B20-89D8-42AE-9384-00B207EE89ED} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {992D3BCA-067E-476B-A175-0B9269B9B2A2} - System32\Tasks\{055A7D96-93CA-4913-AD3A-23ABDEAA211E} => C:\Windows\system32\pcalua.exe -a "C:\Users\Alexander Dochev\Downloads\Android\Half Life\Half-Life.RePack-Eqa5cro\Half.Life.RePack.Setup-Eqa5cro.exe" -d "C:\Users\Alexander Dochev\Downloads\Android\Half Life\Half-Life.RePack-Eqa5cro"
Task: {9A6B03F0-050A-40FD-A77D-6D58CBE26B3A} - System32\Tasks\NvBatteryBoostCheckOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe [2018-03-14] (NVIDIA Corporation)
Task: {A1CDAD6E-D5B1-45D6-BEE3-24E74B65A104} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-02-08] (Google Inc.)
Task: {B9450EF3-D7CC-4052-9C7A-808507B05619} - System32\Tasks\{F0649A19-A64D-4C02-BBB9-A6A9CC2EDA77} => C:\Windows\system32\pcalua.exe -a C:\Users\ALEXAN~1\AppData\Local\Temp\jre-8u144-windows-au.exe -d C:\Windows\SysWOW64 -c /installmethod=jau FAMILYUPGRADE=1 <==== ATTENTION
Task: {BAED7C65-AE5B-4AB3-B5A8-EE836156A41C} - System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe [2018-03-14] (NVIDIA Corporation)
Task: {C6C67D16-25DF-423F-9F2B-289FC52683F9} - System32\Tasks\{C24F33C8-C394-40A6-B6B9-56E36786DAE0} => C:\Windows\system32\pcalua.exe -a "C:\Users\Alexander Dochev\Downloads\64bit_Win7_Win8_Win81_R275.exe" -d "C:\Users\Alexander Dochev\Desktop"
Task: {CAF0F3B0-AFB2-463A-999D-6597FE14BE2B} - System32\Tasks\AVG EUpdate Task => avgsetupx.exe
Task: {DE93766D-FF47-45EF-9AA8-5D2CDDB0C4FC} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)
Task: {E2F6A598-768C-482D-A3CF-709E9D1EC295} - System32\Tasks\Java Platform SE Auto Updater => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2017-12-19] (Oracle Corporation)
Task: {E6BB36C5-330E-4A53-9BE6-F1674D02C4E8} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Service Update Utility => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\Service\ServiceUpdater.exe
Task: {E8F3CA9B-C201-4610-BA95-48615AC0CE7D} - System32\Tasks\{E9CE28AE-1CD2-4564-A6A0-25CF548AE18C} => "C:\Program Files\Internet Explorer\iexplore.exe" hxxps://ui.skype.com/ui/0/7.29.80.102/en/abandoninstall?page=tsProgressBar
Task: {F196E40B-999F-4712-9354-F2FE092FC6DB} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSFReport.exe [2017-06-22] (HP Inc.)
Task: {F8B427DD-5128-48B8-BCD5-33B694874EB5} - System32\Tasks\Microsoft\Windows\Windows Activation Technologies\WatTask => C:\Windows Activation Technologies\wat.exe
Task: {F9D4B1CC-930E-4120-9C21-F6C5C71344F5} - System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe [2018-03-14] (NVIDIA Corporation)
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
 
==================== Shortcuts & WMI ========================
 
(The entries could be listed to be restored or removed.)
 
 
Shortcut: C:\Users\Alexander Dochev\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Intеrnеt Exрlоrer (No Аdd-ons).lnk -> C:\Users\Alexander Dochev\AppData\Roaming\Browsers\exe.erolpxei.bat (No File) <==== Cyrillic
Shortcut: C:\Users\Alexander Dochev\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Gоoglе Chromе.lnk -> C:\Users\Alexander Dochev\AppData\Roaming\Browsers\exe.emorhc.bat (No File) <==== Cyrillic
Shortcut: C:\Users\Alexander Dochev\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Lаunсh Intеrnet Ехрlоrеr Brоwser.lnk -> C:\Users\Alexander Dochev\AppData\Roaming\Browsers\exe.erolpxei.bat (No File) <==== Cyrillic
 
==================== Loaded Modules (Whitelisted) ==============
 
2018-03-04 06:36 - 2018-03-24 04:13 - 000544192 _____ () C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem\DisplayDriverAnalyzer\_DisplayDriverCrashAnalyzer64.dll
2011-03-14 18:27 - 2011-03-14 18:27 - 000346976 _____ () C:\ProgramData\DatacardService\HWDeviceService64.exe
2017-11-17 00:56 - 2018-03-14 16:05 - 001267648 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\libprotobuf.dll
2014-09-03 05:07 - 2014-09-03 05:06 - 000655712 _____ () C:\ProgramData\VIVACOM 3G USB Modem\OnlineUpdate\ouc.exe
2017-02-23 09:29 - 2017-02-23 09:29 - 008909512 _____ () C:\Program Files\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2014-09-03 05:07 - 2014-09-03 05:06 - 000011362 _____ () C:\ProgramData\VIVACOM 3G USB Modem\OnlineUpdate\mingwm10.dll
2014-09-03 05:07 - 2014-09-03 05:06 - 000043008 _____ () C:\ProgramData\VIVACOM 3G USB Modem\OnlineUpdate\libgcc_s_dw2-1.dll
2014-09-03 05:07 - 2014-09-03 05:06 - 002415104 _____ () C:\ProgramData\VIVACOM 3G USB Modem\OnlineUpdate\QtCore4.dll
2014-09-03 05:07 - 2014-09-03 05:06 - 001148416 _____ () C:\ProgramData\VIVACOM 3G USB Modem\OnlineUpdate\QtNetwork4.dll
2014-09-03 05:07 - 2014-09-03 05:06 - 000843264 _____ () C:\ProgramData\VIVACOM 3G USB Modem\OnlineUpdate\QueryStrategy.dll
2014-09-03 05:07 - 2014-09-03 05:06 - 000398336 _____ () C:\ProgramData\VIVACOM 3G USB Modem\OnlineUpdate\QtXml4.dll
2018-01-09 14:26 - 2018-01-08 18:52 - 001891832 _____ () C:\Users\Alexander Dochev\AppData\Local\Discord\app-0.0.300\ffmpeg.dll
2017-11-17 00:56 - 2018-03-14 16:05 - 001041344 _____ () C:\Program Files (x86)\NVIDIA Corporation\NvContainer\libprotobuf.dll
2015-07-12 19:46 - 2015-07-12 19:46 - 001242584 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\ACE.dll
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 
==================== Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
IE trusted site: HKU\.DEFAULT\...\clonewarsadventures.com -> clonewarsadventures.com
IE trusted site: HKU\.DEFAULT\...\freerealms.com -> freerealms.com
IE trusted site: HKU\.DEFAULT\...\soe.com -> soe.com
IE trusted site: HKU\.DEFAULT\...\sony.com -> sony.com
IE trusted site: HKU\S-1-5-19\...\clonewarsadventures.com -> clonewarsadventures.com
IE trusted site: HKU\S-1-5-19\...\freerealms.com -> freerealms.com
IE trusted site: HKU\S-1-5-19\...\soe.com -> soe.com
IE trusted site: HKU\S-1-5-19\...\sony.com -> sony.com
IE trusted site: HKU\S-1-5-20\...\clonewarsadventures.com -> clonewarsadventures.com
IE trusted site: HKU\S-1-5-20\...\freerealms.com -> freerealms.com
IE trusted site: HKU\S-1-5-20\...\soe.com -> soe.com
IE trusted site: HKU\S-1-5-20\...\sony.com -> sony.com
IE trusted site: HKU\S-1-5-21-1505688330-694015033-755604794-1000\...\clonewarsadventures.com -> clonewarsadventures.com
IE trusted site: HKU\S-1-5-21-1505688330-694015033-755604794-1000\...\freerealms.com -> freerealms.com
IE trusted site: HKU\S-1-5-21-1505688330-694015033-755604794-1000\...\soe.com -> soe.com
IE trusted site: HKU\S-1-5-21-1505688330-694015033-755604794-1000\...\sony.com -> sony.com
 
==================== Hosts content: ===============================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2017-03-25 19:31 - 2018-04-28 18:33 - 000000027 _____ C:\Windows\system32\Drivers\etc\hosts
 
127.0.0.1       localhost
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-1505688330-694015033-755604794-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Alexander Dochev\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 78.90.164.1 - 89.190.192.247
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
MSCONFIG\startupreg: Aimersoft Helper Compact.exe => C:\Program Files (x86)\Common Files\Aimersoft\Aimersoft Helper Compact\ASHelper.exe
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [{3BBE68E5-3EF3-4B68-BD9D-C977E8D80FB0}] => (Allow) C:\Users\Alexander Dochev\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{B38D43DC-FB74-4B09-B5DB-E1D46D1E4F35}] => (Allow) C:\Users\Alexander Dochev\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{86904348-FF88-477F-BE94-8A4B43809625}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{E8D12475-EAC1-4F84-B73D-A6E62B975B1D}] => (Allow) C:\Users\Alexander Dochev\Downloads\Fable.III-SKIDROW\Fable III\Fable3.exe
FirewallRules: [{42DF5D48-9A40-4612-96A8-D19F63C3B779}] => (Allow) C:\Users\Alexander Dochev\Downloads\Fable.III-SKIDROW\Fable III\Fable3.exe
FirewallRules: [TCP Query User{7BA46607-3C3A-46ED-B94F-885761DEEFD1}C:\users\alexander dochev\downloads\fable.iii-skidrow\fable iii\fable3.exe] => (Allow) C:\users\alexander dochev\downloads\fable.iii-skidrow\fable iii\fable3.exe
FirewallRules: [UDP Query User{F53D00BF-A769-4829-852A-678C0E5B269E}C:\users\alexander dochev\downloads\fable.iii-skidrow\fable iii\fable3.exe] => (Allow) C:\users\alexander dochev\downloads\fable.iii-skidrow\fable iii\fable3.exe
FirewallRules: [{840D6413-5225-4DDF-B313-8C478D48D6D7}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{5762291A-C2BA-44F0-AD7A-BA625FCE073E}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{9E6EB49B-BBE5-487D-BEA1-749C247DA75B}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{FBBBA84C-0223-491D-B95C-9479D5420143}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [TCP Query User{1C9FA8A3-484D-4F35-8C36-07235DADED7C}C:\games\assassin`s creed iii\ac3sp.exe] => (Allow) C:\games\assassin`s creed iii\ac3sp.exe
FirewallRules: [UDP Query User{660B0F2B-E0ED-4D7F-9F92-095766285083}C:\games\assassin`s creed iii\ac3sp.exe] => (Allow) C:\games\assassin`s creed iii\ac3sp.exe
FirewallRules: [{BC4A8A0B-2321-4DB2-A122-530DB0FA8646}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{63811D10-875E-4B06-93A0-ADB1A252C215}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{8994ECFA-2428-4134-B3AE-0AF869117309}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{5A18E221-EF03-4335-8F02-95F6E9ADFE30}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{D00D029D-5BA9-4B5E-9F91-E54709123EEF}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{36E287BA-D5F9-46B3-BA0F-DEE938D314E4}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{4D723F34-5B49-4B6B-9E9C-0E643ADB4191}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{5BAA44B5-2BDB-48FF-B136-B5D9B08ACC19}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{A6C17643-9EA0-4A64-ADC2-7293FF03BFDA}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{47A01E19-8E08-444D-9F0A-5E555F94286E}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{54C922A1-D691-499E-8A77-5FBB978FF2F1}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Portal 2\portal2.exe
FirewallRules: [{13776657-8492-403A-8C14-32155FA2DBA6}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Portal 2\portal2.exe
FirewallRules: [{A905D723-3F00-4F26-8F58-C6FD1AA967E2}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Portal\hl2.exe
FirewallRules: [{4928956C-BA87-470E-9EC1-169476C38C1B}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Portal\hl2.exe
FirewallRules: [TCP Query User{85113B35-947B-4650-BABC-26ABDB788175}C:\games\grand theft auto v\gta5.exe] => (Allow) C:\games\grand theft auto v\gta5.exe
FirewallRules: [UDP Query User{58CE7EAF-541F-47E3-9445-D817FD91AB87}C:\games\grand theft auto v\gta5.exe] => (Allow) C:\games\grand theft auto v\gta5.exe
FirewallRules: [TCP Query User{C04C2EB1-2BBF-4EE6-90B5-4E3700EE07A4}C:\users\alexander dochev\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\alexander dochev\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{16582529-2488-4DEF-80DE-EB538A954AE3}C:\users\alexander dochev\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\alexander dochev\appdata\local\akamai\netsession_win.exe
FirewallRules: [TCP Query User{E4F3B530-8C83-48B3-A79A-38E413FB1D8A}C:\users\alexander dochev\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\alexander dochev\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{C94E64D9-3732-45E2-B319-E4E3CAC5618F}C:\users\alexander dochev\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\alexander dochev\appdata\local\akamai\netsession_win.exe
FirewallRules: [TCP Query User{A09ADD32-FAF1-4CFB-B6EA-16DF5103620B}C:\games\grand theft auto v\gta5.exe] => (Allow) C:\games\grand theft auto v\gta5.exe
FirewallRules: [UDP Query User{FC838782-70A5-4B17-84FA-9A4596B17649}C:\games\grand theft auto v\gta5.exe] => (Allow) C:\games\grand theft auto v\gta5.exe
FirewallRules: [{5FFCFEED-5E81-4FB1-85FB-9D23A48BD566}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Left 4 Dead 2\left4dead2.exe
FirewallRules: [{ACABA120-44C1-41AB-AE50-6F76706454E7}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Left 4 Dead 2\left4dead2.exe
FirewallRules: [{5173BC91-DDCB-49FA-99BB-CEEF2CFDB99B}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Super Street Fighter IV - Arcade Edition\SSFIV.exe
FirewallRules: [{C8696EC5-A3E2-47E8-BD2A-25FEFFDCB57D}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Super Street Fighter IV - Arcade Edition\SSFIV.exe
FirewallRules: [TCP Query User{5F651D67-BB36-46F0-AD78-061A443D5A80}C:\users\alexander dochev\downloads\android\half life\xash\hl.exe] => (Allow) C:\users\alexander dochev\downloads\android\half life\xash\hl.exe
FirewallRules: [UDP Query User{4457F51C-5F82-4040-83BB-7E4273551828}C:\users\alexander dochev\downloads\android\half life\xash\hl.exe] => (Allow) C:\users\alexander dochev\downloads\android\half life\xash\hl.exe
FirewallRules: [TCP Query User{DCCDB349-7BB7-4DFC-AFFD-616BC85435D5}C:\games\dishonored\binaries\win32\dishonored.exe] => (Allow) C:\games\dishonored\binaries\win32\dishonored.exe
FirewallRules: [UDP Query User{4B556E5C-88AA-4AD6-8D37-4B39AC852B81}C:\games\dishonored\binaries\win32\dishonored.exe] => (Allow) C:\games\dishonored\binaries\win32\dishonored.exe
FirewallRules: [TCP Query User{2BCB672D-AE31-41C9-AF34-208E209B8548}C:\games\rising thunder\radiantgames\rising thunder\windowsnoeditor\risingthunder\binaries\win64\risingthunder-win64-shipping.exe] => (Allow) C:\games\rising thunder\radiantgames\rising thunder\windowsnoeditor\risingthunder\binaries\win64\risingthunder-win64-shipping.exe
FirewallRules: [UDP Query User{D4168253-1B4D-48CD-8A1E-17AB71104715}C:\games\rising thunder\radiantgames\rising thunder\windowsnoeditor\risingthunder\binaries\win64\risingthunder-win64-shipping.exe] => (Allow) C:\games\rising thunder\radiantgames\rising thunder\windowsnoeditor\risingthunder\binaries\win64\risingthunder-win64-shipping.exe
FirewallRules: [{FB3100D5-F6F1-4BCB-8384-2BF247027F52}] => (Allow) C:\Games\I am Alive\src\System\IAmAlive_game.exe
FirewallRules: [{ED5FEE5D-2AD0-4709-822A-5A6EDAC4D6AA}] => (Allow) C:\Games\I am Alive\src\System\IAmAlive_game.exe
FirewallRules: [{9E32C1EB-8472-46BC-9748-A57FCEEE6D5D}] => (Allow) C:\Games\I am Alive\IAmAlive_Launcher.exe
FirewallRules: [{57313290-8117-4442-A768-A83D25F9531B}] => (Allow) C:\Games\I am Alive\IAmAlive_Launcher.exe
FirewallRules: [{8BB85022-7D00-416C-9846-B0C03BC88C42}] => (Block) %SystemDrive%\Games\I am Alive\src\System\IAmAlive_game.exe
FirewallRules: [TCP Query User{4D0C6350-A68D-434F-AE19-85A49C7280E5}C:\games\7 days to die\7.days.to.die.alpha.12.4.steam.edition.x64\7daystodie.exe] => (Allow) C:\games\7 days to die\7.days.to.die.alpha.12.4.steam.edition.x64\7daystodie.exe
FirewallRules: [UDP Query User{AA9AC12A-29ED-4677-93CC-7804986676DD}C:\games\7 days to die\7.days.to.die.alpha.12.4.steam.edition.x64\7daystodie.exe] => (Allow) C:\games\7 days to die\7.days.to.die.alpha.12.4.steam.edition.x64\7daystodie.exe
FirewallRules: [{0A5CD136-83F6-415E-8FF9-7821C5E6662C}] => (Allow) C:\Games\Rainbow Six Siege - Closed Beta\RainbowSix.exe
FirewallRules: [{057F7A0D-2D59-4388-8164-34D9F332BAA0}] => (Allow) C:\Games\Rainbow Six Siege - Closed Beta\RainbowSix.exe
FirewallRules: [{F3CDDCA3-4CCA-4A82-80B1-81D4D37BDC9B}] => (Allow) C:\Games\Tom Clancy's Splinter Cell Conviction\src\system\conviction_game.exe
FirewallRules: [{8A7E85A3-8309-4993-BF4E-004CD7BECB61}] => (Allow) C:\Games\Tom Clancy's Splinter Cell Conviction\src\system\conviction_game.exe
FirewallRules: [{40213F20-512A-44A0-B842-31B09485EC6B}] => (Allow) C:\Games\Tom Clancy's Splinter Cell Conviction\src\system\gu.exe
FirewallRules: [{962D7015-6BC9-4324-BC12-3C0F2AB2FD21}] => (Allow) C:\Games\Tom Clancy's Splinter Cell Conviction\src\system\gu.exe
FirewallRules: [TCP Query User{5AC60F9C-A080-4A4E-8F89-FEBEDC6C4924}C:\games\cs-source\hl2.exe] => (Allow) C:\games\cs-source\hl2.exe
FirewallRules: [UDP Query User{E0F5D657-7D98-4AC5-B679-44C6F08F2F32}C:\games\cs-source\hl2.exe] => (Allow) C:\games\cs-source\hl2.exe
FirewallRules: [{EF75B005-86D3-44B8-946A-8262C9EB4F06}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\7 Days To Die\7DaysToDie_EAC.exe
FirewallRules: [{4ABEED6F-F89B-4163-910B-9A3F091B9933}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\7 Days To Die\7DaysToDie_EAC.exe
FirewallRules: [{D65D59FC-F6C6-4A6F-A359-8418B7F77AD3}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\7 Days To Die\7DaysToDie.exe
FirewallRules: [{C0F29A89-13CF-44AE-81F0-620A5709A392}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\7 Days To Die\7DaysToDie.exe
FirewallRules: [{1EDF3112-4EC1-4DEE-B941-11A6CDBCF7AD}] => (Allow) C:\Program Files (x86)\AVG\Av\avgdiagex.exe
FirewallRules: [{966C6A3F-FD13-4ADD-8AC0-0169DE0BD35C}] => (Allow) C:\Program Files (x86)\AVG\Av\avgdiagex.exe
FirewallRules: [{04238AC2-3AC0-4BDC-8AE2-D758A38A8E58}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Contagion\contagion.exe
FirewallRules: [{96B4C16A-3156-4C95-A1E6-58D9E55D9DE0}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Contagion\contagion.exe
FirewallRules: [TCP Query User{87F5FA37-CA87-45CE-AE9E-0D5CD492B01D}C:\program files\java\jdk1.8.0_77\bin\jmc.exe] => (Allow) C:\program files\java\jdk1.8.0_77\bin\jmc.exe
FirewallRules: [UDP Query User{8E210C13-9C4A-45E4-9B84-3C17021E1500}C:\program files\java\jdk1.8.0_77\bin\jmc.exe] => (Allow) C:\program files\java\jdk1.8.0_77\bin\jmc.exe
FirewallRules: [TCP Query User{3CCC3E99-ED74-4F86-A5F0-2641890E990D}C:\program files (x86)\battle.net\overwatch\overwatch.exe] => (Allow) C:\program files (x86)\battle.net\overwatch\overwatch.exe
FirewallRules: [UDP Query User{D68D80A6-7891-4A80-BF89-F0D4C32FD155}C:\program files (x86)\battle.net\overwatch\overwatch.exe] => (Allow) C:\program files (x86)\battle.net\overwatch\overwatch.exe
FirewallRules: [{E20325AE-1ACE-42FB-ABD0-6835637B1CFD}] => (Allow) C:\Program Files\Andy\andy.exe
FirewallRules: [{9ED52AD4-EC4E-4134-A532-158776F76C76}] => (Allow) C:\Program Files\Andy\andy.exe
FirewallRules: [{C0DE9BA3-9AC7-4640-AFD9-9C656F7073ED}] => (Allow) C:\Program Files\Andy\AndyConsole.exe
FirewallRules: [{03981DEA-2A4F-4365-9E4C-9C8DF47FB89D}] => (Allow) C:\Program Files\Andy\AndyConsole.exe
FirewallRules: [{E859BB44-B18D-4B25-A09A-90B39EB3F92A}] => (Allow) C:\Program Files\Andy\HandyAndy.exe
FirewallRules: [{7DCB84FE-1268-4411-A128-0405DC1E6821}] => (Allow) C:\Program Files\Andy\HandyAndy.exe
FirewallRules: [{D34FD6C2-4D05-4554-9ECD-FA4092794EB6}] => (Allow) C:\Program Files\Andy\SetupFiles\Uninstall.exe
FirewallRules: [{16A0BC5C-ABE3-4E05-842B-73B59C41E682}] => (Allow) C:\Program Files\Andy\SetupFiles\Uninstall.exe
FirewallRules: [TCP Query User{1528A94F-2F19-4B01-860D-B5A8CE2F1ED6}C:\program files\java\jdk1.8.0_77\bin\java.exe] => (Allow) C:\program files\java\jdk1.8.0_77\bin\java.exe
FirewallRules: [UDP Query User{E0CD6575-D81B-4DFE-BBF1-76FDA9E15260}C:\program files\java\jdk1.8.0_77\bin\java.exe] => (Allow) C:\program files\java\jdk1.8.0_77\bin\java.exe
FirewallRules: [TCP Query User{6C14A076-0E94-4D14-BBBF-08154B809A23}C:\games\the stanley parable\thestanleyparable.exe] => (Block) C:\games\the stanley parable\thestanleyparable.exe
FirewallRules: [UDP Query User{CBFFBC8C-3439-4B8C-8C83-C1706650C41D}C:\games\the stanley parable\thestanleyparable.exe] => (Block) C:\games\the stanley parable\thestanleyparable.exe
FirewallRules: [{C0F00AC8-79A8-442E-894B-0246DF1D4EB9}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Assassin's Creed Unity\ACU.exe
FirewallRules: [{1F36C2C1-17BE-482C-AD39-D99857E85F5C}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Assassin's Creed Unity\ACU.exe
FirewallRules: [{1539AA7F-0542-45EA-9A0E-F8BD3798B27C}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Grand Theft Auto V\GTAVLauncher.exe
FirewallRules: [{2D31A8C4-A8E4-4E60-83C4-33F97662BAE8}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Grand Theft Auto V\GTAVLauncher.exe
FirewallRules: [TCP Query User{1320B08D-6F93-48F6-A586-CEF6FCA98431}C:\program files (x86)\steam\steamapps\common\grand theft auto v\gta5.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\grand theft auto v\gta5.exe
FirewallRules: [UDP Query User{308964FC-336C-40F8-89AB-359A24620968}C:\program files (x86)\steam\steamapps\common\grand theft auto v\gta5.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\grand theft auto v\gta5.exe
FirewallRules: [TCP Query User{819F34BA-33B1-489D-BE01-70E22A52B775}C:\users\alexander dochev\downloads\movies, tv\vlc player\vlc - v.2.2.1\vlc.exe] => (Allow) C:\users\alexander dochev\downloads\movies, tv\vlc player\vlc - v.2.2.1\vlc.exe
FirewallRules: [UDP Query User{0BB0C7E5-4F54-4C8D-BB14-2DFBE141F46A}C:\users\alexander dochev\downloads\movies, tv\vlc player\vlc - v.2.2.1\vlc.exe] => (Allow) C:\users\alexander dochev\downloads\movies, tv\vlc player\vlc - v.2.2.1\vlc.exe
FirewallRules: [{85175FF1-3197-4865-B927-F652A3925875}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\GarrysMod\hl2.exe
FirewallRules: [{5952CB50-A561-4AAD-83B6-C235898CD29B}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\GarrysMod\hl2.exe
FirewallRules: [TCP Query User{4CD8AC2C-743B-497B-80B1-D11BA1EE7449}C:\games\mount&blade - warband\mb_warband.exe] => (Allow) C:\games\mount&blade - warband\mb_warband.exe
FirewallRules: [UDP Query User{43A1B92C-F413-47AA-975B-2F5F13A45780}C:\games\mount&blade - warband\mb_warband.exe] => (Allow) C:\games\mount&blade - warband\mb_warband.exe
FirewallRules: [{1215DB23-DB38-4C15-9A23-834E35975D52}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\The Binding Of Isaac\Isaac.exe
FirewallRules: [{573292D7-C95C-4EFD-A569-5F9B87A4762A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\The Binding Of Isaac\Isaac.exe
FirewallRules: [{4B42F9C6-9ECD-4B8E-93B2-69C77B4B3F6A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Metal Gear Solid Ground Zeroes\MgsGroundZeroes.exe
FirewallRules: [{63121A5E-028E-46ED-849F-13E3C1A8DE00}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Metal Gear Solid Ground Zeroes\MgsGroundZeroes.exe
FirewallRules: [{AF9D5729-332C-44B7-BBFA-F5132FECC9C0}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Outlast\OutlastLauncher.exe
FirewallRules: [{E1554446-2AF7-49BA-9174-4C4330BAD5A9}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Outlast\OutlastLauncher.exe
FirewallRules: [{4866B22C-5C85-460D-83B6-559D8C16A231}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sniper Elite V2\Launcher\SniperV2Launcher.exe
FirewallRules: [{23474109-B0C0-44E5-A05D-B2CF7327084C}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sniper Elite V2\Launcher\SniperV2Launcher.exe
FirewallRules: [{39AE7FBB-F4A8-41C0-AF74-A04987C027F2}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Resident Evil 4\Bin32\bio4.exe
FirewallRules: [{97C4253C-2576-4EFE-B033-44D30613B27A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Resident Evil 4\Bin32\bio4.exe
FirewallRules: [{5FFF808F-4C46-4C49-AE3B-719C27685770}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sniper Elite 3\Launcher\Sniper3Launcher.exe
FirewallRules: [{93D428C9-0D92-4149-A039-A3530EDE92DE}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sniper Elite 3\Launcher\Sniper3Launcher.exe
FirewallRules: [{63613149-5181-4843-AEB8-0100B4941F77}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Fallout 4\Fallout4Launcher.exe
FirewallRules: [{F9335461-0A81-4CF9-8EBA-625D4B6B071A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Fallout 4\Fallout4Launcher.exe
FirewallRules: [{23D434D7-F70E-4A48-B966-8BBFBCD54E2D}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\MGS_TPP\mgsvtpp.exe
FirewallRules: [{C1E5704C-B220-47C8-8847-1581B4533A1B}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\MGS_TPP\mgsvtpp.exe
FirewallRules: [TCP Query User{013EE8E9-F0B8-4BD2-9241-6379F13663FC}C:\games\quantum break\dx11\quantumbreak.exe] => (Allow) C:\games\quantum break\dx11\quantumbreak.exe
FirewallRules: [UDP Query User{17CE015D-C6B8-4994-91AE-18EB91D06E8D}C:\games\quantum break\dx11\quantumbreak.exe] => (Allow) C:\games\quantum break\dx11\quantumbreak.exe
FirewallRules: [TCP Query User{06411689-1EDB-4D8B-A054-44E87268CE25}C:\games\styx master of shadows\binaries\win32\styxgame.exe] => (Allow) C:\games\styx master of shadows\binaries\win32\styxgame.exe
FirewallRules: [UDP Query User{B73EE5DE-3D60-4CA8-BC6E-90A971D7B780}C:\games\styx master of shadows\binaries\win32\styxgame.exe] => (Allow) C:\games\styx master of shadows\binaries\win32\styxgame.exe
FirewallRules: [TCP Query User{9F7E2B49-2C3A-4CB1-8C4E-6DE1A0EA944E}C:\users\alexander dochev\appdata\roaming\utorrent\updates\3.4.9_42606.exe] => (Allow) C:\users\alexander dochev\appdata\roaming\utorrent\updates\3.4.9_42606.exe
FirewallRules: [UDP Query User{EFEAA228-AE3F-4199-9793-4F13DF7AB0C8}C:\users\alexander dochev\appdata\roaming\utorrent\updates\3.4.9_42606.exe] => (Allow) C:\users\alexander dochev\appdata\roaming\utorrent\updates\3.4.9_42606.exe
FirewallRules: [TCP Query User{8E798AD8-C417-4381-A081-3DD639442081}C:\program files (x86)\gog galaxy\games\gwent\gwent.exe] => (Allow) C:\program files (x86)\gog galaxy\games\gwent\gwent.exe
FirewallRules: [UDP Query User{F909890B-93FE-484F-A6EA-443B28FA019C}C:\program files (x86)\gog galaxy\games\gwent\gwent.exe] => (Allow) C:\program files (x86)\gog galaxy\games\gwent\gwent.exe
FirewallRules: [{1C92645F-5FF1-4E64-B13C-35715CD1C581}] => (Allow) C:\Games\Dungeon Siege 2\DungeonSiege2.exe
FirewallRules: [{D55532D2-37C2-4A8F-92DC-D09F9A077EBF}] => (Allow) C:\Games\Dungeon Siege 2\DungeonSiege2.exe
FirewallRules: [TCP Query User{D48DE423-636F-470A-BB09-F233F680B706}C:\program files (x86)\overwatch\overwatch.exe] => (Allow) C:\program files (x86)\overwatch\overwatch.exe
FirewallRules: [UDP Query User{14EECBA8-8483-481A-8943-BE91648BB3F8}C:\program files (x86)\overwatch\overwatch.exe] => (Allow) C:\program files (x86)\overwatch\overwatch.exe
FirewallRules: [TCP Query User{C315B9DF-9DFC-4122-A537-FBE662A18D0E}C:\program files (x86)\battle.net\battle.net.8142\battle.net.exe] => (Allow) C:\program files (x86)\battle.net\battle.net.8142\battle.net.exe
FirewallRules: [UDP Query User{B96FB51D-B80D-4E99-8684-082F4BC1D890}C:\program files (x86)\battle.net\battle.net.8142\battle.net.exe] => (Allow) C:\program files (x86)\battle.net\battle.net.8142\battle.net.exe
FirewallRules: [TCP Query User{FA138D91-CA02-430E-B959-9F48D690E57E}C:\games\heroes of the storm\versions\base48297\heroesofthestorm_x64.exe] => (Allow) C:\games\heroes of the storm\versions\base48297\heroesofthestorm_x64.exe
FirewallRules: [UDP Query User{2CCB9902-828A-4F4C-8E5C-0167D265A4C3}C:\games\heroes of the storm\versions\base48297\heroesofthestorm_x64.exe] => (Allow) C:\games\heroes of the storm\versions\base48297\heroesofthestorm_x64.exe
FirewallRules: [TCP Query User{5B5537B4-5105-4C4F-99CE-FF5203A19A1D}C:\program files (x86)\battle.net\games\overwatch\overwatch.exe] => (Allow) C:\program files (x86)\battle.net\games\overwatch\overwatch.exe
FirewallRules: [UDP Query User{443C5C43-6384-4C60-997B-C06CE5B9D846}C:\program files (x86)\battle.net\games\overwatch\overwatch.exe] => (Allow) C:\program files (x86)\battle.net\games\overwatch\overwatch.exe
FirewallRules: [TCP Query User{802D2B36-98E8-4599-95D5-CC70DC0BF2D4}C:\program files (x86)\battle.net\games\heroes of the storm\versions\base48297\heroesofthestorm_x64.exe] => (Allow) C:\program files (x86)\battle.net\games\heroes of the storm\versions\base48297\heroesofthestorm_x64.exe
FirewallRules: [UDP Query User{7111BA71-BF2A-4561-B33F-91055AF98A9B}C:\program files (x86)\battle.net\games\heroes of the storm\versions\base48297\heroesofthestorm_x64.exe] => (Allow) C:\program files (x86)\battle.net\games\heroes of the storm\versions\base48297\heroesofthestorm_x64.exe
FirewallRules: [{102437AE-6806-40F5-9CAF-2EF44B549DC1}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{AD74F27B-1659-4867-B5BE-BD2F5F463D94}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{D43FAE48-0AD7-4BAE-8F83-8EDFE6B71C8B}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{A0AF6346-B0A4-4B3D-A691-77E71482AE70}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [TCP Query User{A6C65732-D6B8-4BE3-AD2C-8D069FD66D34}C:\users\alexander dochev\downloads\hello neighbor\hello.neighbor.alpha.1\helloneighbor\helloneighborreborn\binaries\win64\helloneighborreborn.exe] => (Allow) C:\users\alexander dochev\downloads\hello neighbor\hello.neighbor.alpha.1\helloneighbor\helloneighborreborn\binaries\win64\helloneighborreborn.exe
FirewallRules: [UDP Query User{5BC1CCCE-403E-47D2-8505-8D6C62B89AEB}C:\users\alexander dochev\downloads\hello neighbor\hello.neighbor.alpha.1\helloneighbor\helloneighborreborn\binaries\win64\helloneighborreborn.exe] => (Allow) C:\users\alexander dochev\downloads\hello neighbor\hello.neighbor.alpha.1\helloneighbor\helloneighborreborn\binaries\win64\helloneighborreborn.exe
FirewallRules: [TCP Query User{C49E6D71-00CB-4A7E-A9B5-F26E3E6783A0}C:\program files (x86)\battle.net\games\heroes of the storm\versions\base48548\heroesofthestorm_x64.exe] => (Allow) C:\program files (x86)\battle.net\games\heroes of the storm\versions\base48548\heroesofthestorm_x64.exe
FirewallRules: [UDP Query User{0BCC02E5-3B8D-45F9-BE5A-F4A928F7891B}C:\program files (x86)\battle.net\games\heroes of the storm\versions\base48548\heroesofthestorm_x64.exe] => (Allow) C:\program files (x86)\battle.net\games\heroes of the storm\versions\base48548\heroesofthestorm_x64.exe
FirewallRules: [{BA682C81-55F6-4EEA-8FB3-BEA9580F2D78}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{007CBD04-3E0F-4906-AB33-C45C62BCA708}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{DF49F63B-6601-43B0-9F62-5CFF906485FF}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{E850513F-747A-43A9-9B0C-3FCB3F1B9D2E}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{58CDE7BF-86CE-4099-B267-0C04E2A46200}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
FirewallRules: [{CF9D4E1F-D0F2-4AE7-8C9E-26461961786A}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{ACBADE36-532C-4C0F-A529-7603F4A9FF36}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [TCP Query User{383147C3-4B80-4688-9AC4-D4B9A4CFBAE3}C:\program files (x86)\battle.net\games\heroes of the storm\versions\base48760\heroesofthestorm_x64.exe] => (Allow) C:\program files (x86)\battle.net\games\heroes of the storm\versions\base48760\heroesofthestorm_x64.exe
FirewallRules: [UDP Query User{CA69AC8C-644F-44BB-A2AC-3D6225482D54}C:\program files (x86)\battle.net\games\heroes of the storm\versions\base48760\heroesofthestorm_x64.exe] => (Allow) C:\program files (x86)\battle.net\games\heroes of the storm\versions\base48760\heroesofthestorm_x64.exe
FirewallRules: [TCP Query User{1F2417D5-ACBD-4433-994D-7F91F5E9746C}C:\program files (x86)\battle.net\games\heroes of the storm\versions\base49008\heroesofthestorm_x64.exe] => (Allow) C:\program files (x86)\battle.net\games\heroes of the storm\versions\base49008\heroesofthestorm_x64.exe
FirewallRules: [UDP Query User{9F57A15C-5208-4A6C-B704-201BB0AAFE74}C:\program files (x86)\battle.net\games\heroes of the storm\versions\base49008\heroesofthestorm_x64.exe] => (Allow) C:\program files (x86)\battle.net\games\heroes of the storm\versions\base49008\heroesofthestorm_x64.exe
FirewallRules: [{44E06929-DA8F-4603-BD85-BBF93F418696}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\insurgency2\insurgency.exe
FirewallRules: [{9E9D6923-E99A-4FB4-8752-D6C5ECE829A8}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\insurgency2\insurgency.exe
FirewallRules: [TCP Query User{46E9643D-54CD-4610-929C-FACF15F35574}C:\program files (x86)\battle.net\battle.net.8293\battle.net.exe] => (Allow) C:\program files (x86)\battle.net\battle.net.8293\battle.net.exe
FirewallRules: [UDP Query User{00795DD6-CD67-4A47-850D-986A77A6ED3F}C:\program files (x86)\battle.net\battle.net.8293\battle.net.exe] => (Allow) C:\program files (x86)\battle.net\battle.net.8293\battle.net.exe
FirewallRules: [{6D7F4285-4E58-4437-858F-F8994A59095A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\rocketleague\Binaries\Win32\RocketLeague.exe
FirewallRules: [{A0CF7047-8997-40FA-B614-4FAB2E3D4001}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\rocketleague\Binaries\Win32\RocketLeague.exe
FirewallRules: [TCP Query User{AE310947-2E1E-44DF-9CEA-A6E74731291C}C:\program files (x86)\battle.net\games\overwatch\overwatch.exe] => (Allow) C:\program files (x86)\battle.net\games\overwatch\overwatch.exe
FirewallRules: [UDP Query User{45F62C58-F2FE-4498-9417-8291C810AAED}C:\program files (x86)\battle.net\games\overwatch\overwatch.exe] => (Allow) C:\program files (x86)\battle.net\games\overwatch\overwatch.exe
FirewallRules: [{C5CB5B9C-479C-4F08-AD89-0D1E2188B832}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\insurgency2\insurgency_BE.exe
FirewallRules: [{87A3EADE-040E-49D6-BFB2-96D7C57D062E}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\insurgency2\insurgency_BE.exe
FirewallRules: [TCP Query User{3A928FBD-63BC-4E56-9CBC-24BD7D660E97}C:\games\forhonorbeta\forhonor.exe] => (Allow) C:\games\forhonorbeta\forhonor.exe
FirewallRules: [UDP Query User{EC00742E-E380-4E56-8344-28D23178E067}C:\games\forhonorbeta\forhonor.exe] => (Allow) C:\games\forhonorbeta\forhonor.exe
FirewallRules: [{0AE260CB-26EE-4B95-8186-94FC980DDB86}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\legacy_kain_defiance\defiance.exe
FirewallRules: [{2DB45651-5D16-4EB3-BC5A-6F8E64806602}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\legacy_kain_defiance\defiance.exe
FirewallRules: [TCP Query User{BED18D8B-89AC-4C29-8CD7-F69B80900B21}C:\program files (x86)\steam\steamapps\common\paladins\binaries\win32\paladins.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\paladins\binaries\win32\paladins.exe
FirewallRules: [UDP Query User{04C0E529-F466-443A-A7ED-B7766128AEA0}C:\program files (x86)\steam\steamapps\common\paladins\binaries\win32\paladins.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\paladins\binaries\win32\paladins.exe
FirewallRules: [{03DF4D43-1B2C-4E73-9064-ED0D3D96BA24}] => (Allow) C:\Users\Alexander Dochev\Desktop\LiquidSkyClient.exe
FirewallRules: [{3F8D1641-BA58-4C00-A957-EDA3E41DEA47}] => (Allow) C:\Users\Alexander Dochev\Desktop\LiquidSkyClient.exe
FirewallRules: [TCP Query User{9874C938-7C9B-4297-BEE3-D5DD793B56F5}C:\games\outlast 2\binaries\win64\outlast2.exe] => (Allow) C:\games\outlast 2\binaries\win64\outlast2.exe
FirewallRules: [UDP Query User{E492FB94-5B95-4F05-A8A3-8B120DDBC77B}C:\games\outlast 2\binaries\win64\outlast2.exe] => (Allow) C:\games\outlast 2\binaries\win64\outlast2.exe
FirewallRules: [TCP Query User{3C77327A-C976-4886-899D-5878B199B02D}C:\program files (x86)\battle.net\games\heroes of the storm\versions\base52860\heroesofthestorm_x64.exe] => (Allow) C:\program files (x86)\battle.net\games\heroes of the storm\versions\base52860\heroesofthestorm_x64.exe
FirewallRules: [UDP Query User{19B51188-32D8-4721-93B4-114B52E65552}C:\program files (x86)\battle.net\games\heroes of the storm\versions\base52860\heroesofthestorm_x64.exe] => (Allow) C:\program files (x86)\battle.net\games\heroes of the storm\versions\base52860\heroesofthestorm_x64.exe
FirewallRules: [TCP Query User{39B8E576-6F8B-4DB8-A8A7-452661AB85B3}C:\program files (x86)\battle.net\games\heroes of the storm\versions\base52986\heroesofthestorm_x64.exe] => (Allow) C:\program files (x86)\battle.net\games\heroes of the storm\versions\base52986\heroesofthestorm_x64.exe
FirewallRules: [UDP Query User{C03F92DA-BF48-4B37-9772-51362AEA5193}C:\program files (x86)\battle.net\games\heroes of the storm\versions\base52986\heroesofthestorm_x64.exe] => (Allow) C:\program files (x86)\battle.net\games\heroes of the storm\versions\base52986\heroesofthestorm_x64.exe
FirewallRules: [TCP Query User{818A8E3B-908E-400C-8B4D-657F6ED3632A}C:\program files (x86)\battle.net\games\heroes of the storm\versions\base53548\heroesofthestorm_x64.exe] => (Allow) C:\program files (x86)\battle.net\games\heroes of the storm\versions\base53548\heroesofthestorm_x64.exe
FirewallRules: [UDP Query User{08810158-7505-4DCC-B46A-B9D5838A3007}C:\program files (x86)\battle.net\games\heroes of the storm\versions\base53548\heroesofthestorm_x64.exe] => (Allow) C:\program files (x86)\battle.net\games\heroes of the storm\versions\base53548\heroesofthestorm_x64.exe
FirewallRules: [TCP Query User{A03416D0-6E5A-4AC8-9B3A-34821500A663}C:\program files (x86)\ostotosoft\drivertalent\drivertalent.exe] => (Allow) C:\program files (x86)\ostotosoft\drivertalent\drivertalent.exe
FirewallRules: [UDP Query User{6FA1666E-8073-46DF-8EEC-1C2A495630F2}C:\program files (x86)\ostotosoft\drivertalent\drivertalent.exe] => (Allow) C:\program files (x86)\ostotosoft\drivertalent\drivertalent.exe
FirewallRules: [{6609A949-FCFC-4207-93E0-43DEC3DF7224}] => (Allow) C:\Program Files (x86)\OSTotoSoft\DriverTalent\DriverTalent.exe
FirewallRules: [{C9B801D0-B55D-4AB6-96DB-98857EA22956}] => (Allow) C:\Program Files (x86)\OSTotoSoft\DriverTalent\DTLService.exe
FirewallRules: [{5E46BE92-6F5C-406F-ABB5-F2D220D6F955}] => (Allow) C:\Program Files (x86)\OSTotoSoft\DriverTalent\download\MiniThunderPlatform.exe
FirewallRules: [{9A763DA6-6950-4592-8237-95A7564685DC}] => (Allow) C:\Users\Alexander Dochev\AppData\Roaming\LiquidSky\LiquidSkyClient.exe
FirewallRules: [{C444F594-791C-4EB7-832C-3F6D3C0B66DA}] => (Allow) C:\Users\Alexander Dochev\AppData\Roaming\LiquidSky\LiquidSkyClient.exe
FirewallRules: [{55D345F1-1D16-492F-B21E-6D6AD092160B}] => (Allow) C:\Users\Alexander Dochev\AppData\Roaming\LiquidSky\lib\LiquidSky.exe
FirewallRules: [{6F33BF68-78D1-4170-AAC3-892F04D78A2B}] => (Allow) C:\Users\Alexander Dochev\AppData\Roaming\LiquidSky\lib\LiquidSky.exe
FirewallRules: [TCP Query User{ECC26B10-CE80-4AF4-87DA-947D2AC7B65D}C:\games\borderlands 2\binaries\win32\borderlands2.exe] => (Allow) C:\games\borderlands 2\binaries\win32\borderlands2.exe
FirewallRules: [UDP Query User{80EE168B-C180-4938-BCF7-E34DEE03F43C}C:\games\borderlands 2\binaries\win32\borderlands2.exe] => (Allow) C:\games\borderlands 2\binaries\win32\borderlands2.exe
FirewallRules: [{4E82D18D-2208-43EE-B140-B926721B3708}] => (Block) C:\games\borderlands 2\binaries\win32\borderlands2.exe
FirewallRules: [{3915FF7F-FA2C-4CD1-AC5E-AAAB93151998}] => (Block) C:\games\borderlands 2\binaries\win32\borderlands2.exe
FirewallRules: [TCP Query User{3CA2C687-F700-4F94-978D-32FA55EAA52E}C:\games\borderlands the pre-sequel\binaries\win32\borderlandspresequel.exe] => (Allow) C:\games\borderlands the pre-sequel\binaries\win32\borderlandspresequel.exe
FirewallRules: [UDP Query User{8F4209B3-332C-4E2E-827E-A3983705B3C4}C:\games\borderlands the pre-sequel\binaries\win32\borderlandspresequel.exe] => (Allow) C:\games\borderlands the pre-sequel\binaries\win32\borderlandspresequel.exe
FirewallRules: [{CCC35FFE-DF66-4FF1-8DD0-8430692B056A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\ShadowOfMordor\x64\ShadowOfMordor.exe
FirewallRules: [{0260E8FC-6F4D-4FBB-A2BF-7F7838038DD2}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\ShadowOfMordor\x64\ShadowOfMordor.exe
FirewallRules: [TCP Query User{E2F71F2A-9242-4B1C-9786-D8205F6CA045}C:\program files (x86)\qbittorrent\qbittorrent.exe] => (Allow) C:\program files (x86)\qbittorrent\qbittorrent.exe
FirewallRules: [UDP Query User{168E1936-9D4B-427C-A7C3-2B2A34488623}C:\program files (x86)\qbittorrent\qbittorrent.exe] => (Allow) C:\program files (x86)\qbittorrent\qbittorrent.exe
FirewallRules: [{09A16F42-DB96-4E19-81A3-FADFAEEE2E72}] => (Allow) C:\Users\Alexander Dochev\Desktop\LiquidSkyClient0.2.9.exe
FirewallRules: [{EA728B99-0BF2-4A5F-8063-5EC01D781D35}] => (Allow) C:\Users\Alexander Dochev\Desktop\LiquidSkyClient0.2.9.exe
FirewallRules: [{1EE3D39F-ECC5-443D-961A-F107D91CCEE1}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Gigantic\ArcSteamHelper.exe
FirewallRules: [{FEE70A39-FF6E-4532-9167-23E26038318F}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Gigantic\ArcSteamHelper.exe
FirewallRules: [TCP Query User{B2F764E2-E8C9-4051-BA58-7CADD92D31D1}C:\program files (x86)\arc\arcchat.exe] => (Allow) C:\program files (x86)\arc\arcchat.exe
FirewallRules: [UDP Query User{2E146B24-1132-44AC-8933-C8CC8DA4F969}C:\program files (x86)\arc\arcchat.exe] => (Allow) C:\program files (x86)\arc\arcchat.exe
FirewallRules: [TCP Query User{B7A937A4-C034-4EF6-B3A0-BDF69DDFD3D2}C:\program files (x86)\steam\steamapps\common\gigantic\binaries\win64\rxgame-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\gigantic\binaries\win64\rxgame-win64-shipping.exe
FirewallRules: [UDP Query User{1471A170-5D1C-4BAA-AF72-ACE933E50EE6}C:\program files (x86)\steam\steamapps\common\gigantic\binaries\win64\rxgame-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\gigantic\binaries\win64\rxgame-win64-shipping.exe
FirewallRules: [TCP Query User{6CA76F5D-C37D-4437-B46F-9D75CDC7BFE2}C:\games\the long dark\tld.exe] => (Allow) C:\games\the long dark\tld.exe
FirewallRules: [UDP Query User{41B59EBF-1BAE-4EE3-ADD6-8089C12B8CA6}C:\games\the long dark\tld.exe] => (Allow) C:\games\the long dark\tld.exe
FirewallRules: [TCP Query User{1C261E00-588A-4465-B9EF-1473FCFA3519}C:\games\absolver\absolver\binaries\win64\absolver-win64-shipping.exe] => (Allow) C:\games\absolver\absolver\binaries\win64\absolver-win64-shipping.exe
FirewallRules: [UDP Query User{15B5A160-DE92-4ED7-8CBC-1D656D21141E}C:\games\absolver\absolver\binaries\win64\absolver-win64-shipping.exe] => (Allow) C:\games\absolver\absolver\binaries\win64\absolver-win64-shipping.exe
FirewallRules: [{A5EBE166-9287-4CFB-9757-BB93019264A6}] => (Allow) C:\ProgramData\Tiancity\NGM\NGM.exe
FirewallRules: [{DBB00472-B6BB-4026-8732-1D50922BC8C6}] => (Allow) C:\ProgramData\Tiancity\NGM\NGM.exe
FirewallRules: [{0E71E143-0581-41C2-B0D8-4D40B6F83199}] => (Allow) C:\Games\Counter-Strike Online 2\Bin\CounterStrikeOnline2.exe
FirewallRules: [{1736A0BC-7509-40B8-9962-8F6F3DA0057F}] => (Allow) C:\Games\Counter-Strike Online 2\Bin\CounterStrikeOnline2.exe
FirewallRules: [TCP Query User{3FE9CD3D-926B-4342-9B28-133297D92BFA}C:\program files (x86)\steam\steamapps\common\lms\lms.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\lms\lms.exe
FirewallRules: [UDP Query User{C881B877-AE22-4D02-AF4C-770E429668F2}C:\program files (x86)\steam\steamapps\common\lms\lms.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\lms\lms.exe
FirewallRules: [TCP Query User{B9FA5708-32C0-4AAE-A28D-72762FF90BB1}C:\users\alexander dochev\desktop\zelda\wiiu_usb_helper.exe] => (Allow) C:\users\alexander dochev\desktop\zelda\wiiu_usb_helper.exe
FirewallRules: [UDP Query User{09D96A95-2714-4BB5-98A9-A1572483B8F9}C:\users\alexander dochev\desktop\zelda\wiiu_usb_helper.exe] => (Allow) C:\users\alexander dochev\desktop\zelda\wiiu_usb_helper.exe
FirewallRules: [TCP Query User{0CC4340E-4584-48D9-8AD4-E609C4C30D78}C:\users\alexander dochev\downloads\emulators\wiiu\wiiu usb helper\wiiu_usb_helper.exe] => (Allow) C:\users\alexander dochev\downloads\emulators\wiiu\wiiu usb helper\wiiu_usb_helper.exe
FirewallRules: [UDP Query User{FB5D1148-C338-44C7-9BED-A21C0F5ED10B}C:\users\alexander dochev\downloads\emulators\wiiu\wiiu usb helper\wiiu_usb_helper.exe] => (Allow) C:\users\alexander dochev\downloads\emulators\wiiu\wiiu usb helper\wiiu_usb_helper.exe
FirewallRules: [TCP Query User{FB505254-B3EC-48BA-96C9-FD6E74D8CF05}C:\program files (x86)\battle.net\battle.net.9397\battle.net.exe] => (Allow) C:\program files (x86)\battle.net\battle.net.9397\battle.net.exe
FirewallRules: [UDP Query User{954E04A2-89D7-40A0-B835-44354C324C68}C:\program files (x86)\battle.net\battle.net.9397\battle.net.exe] => (Allow) C:\program files (x86)\battle.net\battle.net.9397\battle.net.exe
FirewallRules: [{CC798BEE-6CCA-47A7-B299-382F65DACFE0}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{E30C9092-89D2-4C30-BBAE-F52573E17C21}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{EA2CB5AB-B584-4776-9D0B-9D93B18BA454}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\H1Z1\LaunchPad.exe
FirewallRules: [{7F593AF2-235D-4912-BC45-02AEE4C2F27F}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\H1Z1\LaunchPad.exe
FirewallRules: [TCP Query User{8B86DA3D-59CD-40B8-9B81-80FA1E105DB1}C:\program files (x86)\steam\steamapps\common\h1z1\h1z1.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\h1z1\h1z1.exe
FirewallRules: [UDP Query User{37A15E0C-A6E1-41C4-BCC9-D1A4E3DB2CF7}C:\program files (x86)\steam\steamapps\common\h1z1\h1z1.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\h1z1\h1z1.exe
FirewallRules: [TCP Query User{1D99B3A5-A5FE-45A8-BA6D-14101E6B86EE}C:\program files (x86)\battle.net\battle.net.exe] => (Allow) C:\program files (x86)\battle.net\battle.net.exe
FirewallRules: [UDP Query User{D4FDAAE5-E2E8-4616-A574-40DC306F8C3B}C:\program files (x86)\battle.net\battle.net.exe] => (Allow) C:\program files (x86)\battle.net\battle.net.exe
FirewallRules: [{5D83DCB1-E21F-4D42-ADC3-88DF9BDBB81C}] => (Allow) C:\Program Files (x86)\qBittorrent\qbittorrent.exe
FirewallRules: [{44ABC5DC-702E-4675-9B0C-1320E81A60DA}] => (Allow) C:\Program Files (x86)\qBittorrent\qbittorrent.exe
FirewallRules: [{F8C9371B-76D6-473A-9135-E9A489618C70}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\H1Z1\H1Z1_BE.exe
FirewallRules: [{CB5E24BB-4CBD-4279-9396-4F854B66A108}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\H1Z1\H1Z1_BE.exe
FirewallRules: [{3AD6E47D-1B92-4732-9E75-9D3B61EFDFF0}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{42C025B0-F788-4E06-812F-D18CA218FFAE}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{C3257873-D49F-452E-806B-401EDB3B1B59}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{13ED613B-D9B2-4333-8B7F-9BAB68D662DC}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{53BE8C55-21B0-476A-98BD-B92D56AD7733}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
==================== Restore Points =========================
 
27-04-2018 19:57:23 Windows Update
28-04-2018 14:06:08 Installing COMODO Antivirus
28-04-2018 15:05:34 Removing COMODO Client - Security
28-04-2018 17:48:29 JRT Pre-Junkware Removal
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (04/28/2018 06:59:03 PM) (Source: Winlogon) (EventID: 4103) (User: )
Description: Windows license activation failed. Error 0x00000000.
 
Error: (04/28/2018 06:59:03 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: License Activation (slui.exe) failed with the following error code:
0x80070005
 
Error: (04/28/2018 06:41:57 PM) (Source: Winlogon) (EventID: 4103) (User: )
Description: Windows license activation failed. Error 0x00000000.
 
Error: (04/28/2018 06:41:57 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: License Activation (slui.exe) failed with the following error code:
0x80070005
 
Error: (04/28/2018 06:33:16 PM) (Source: Winlogon) (EventID: 4103) (User: )
Description: Windows license activation failed. Error 0x00000000.
 
Error: (04/28/2018 06:33:16 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: License Activation (slui.exe) failed with the following error code:
0x80070005
 
Error: (04/28/2018 05:40:35 PM) (Source: Winlogon) (EventID: 4103) (User: )
Description: Windows license activation failed. Error 0x00000000.
 
Error: (04/28/2018 05:40:35 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: License Activation (slui.exe) failed with the following error code:
0x80070005
 
 
System errors:
=============
Error: (04/28/2018 07:44:37 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Peer Name Resolution Protocol service terminated with the following error: 
%%-2140993535
 
Error: (04/28/2018 07:44:37 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Peer Networking Grouping service depends on the Peer Name Resolution Protocol service which failed to start because of the following error: 
%%-2140993535
 
Error: (04/28/2018 07:44:37 PM) (Source: PNRPSvc) (EventID: 102) (User: )
Description: The Peer Name Resolution Protocol cloud did not start because the creation of the default identity failed with error code: 0x80630801.
 
Error: (04/28/2018 07:44:31 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Peer Name Resolution Protocol service terminated with the following error: 
%%-2140993535
 
Error: (04/28/2018 07:44:31 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Peer Networking Grouping service depends on the Peer Name Resolution Protocol service which failed to start because of the following error: 
%%-2140993535
 
Error: (04/28/2018 07:44:31 PM) (Source: PNRPSvc) (EventID: 102) (User: )
Description: The Peer Name Resolution Protocol cloud did not start because the creation of the default identity failed with error code: 0x80630801.
 
Error: (04/28/2018 07:44:28 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Peer Name Resolution Protocol service terminated with the following error: 
%%-2140993535
 
Error: (04/28/2018 07:44:28 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Peer Networking Grouping service depends on the Peer Name Resolution Protocol service which failed to start because of the following error: 
%%-2140993535
 
 
Windows Defender:
===================================
Date: 2018-04-22 21:37:39.122
Description: 
Windows Defender scan has been stopped before completion.
Scan ID:{1C495541-FCAC-43F8-BEEE-50F12942555A}
Scan Type:AntiSpyware
Scan Parameters:Quick Scan
 
Date: 2017-01-21 14:15:03.544
Description: 
Windows Defender scan has been stopped before completion.
Scan ID:{ED5C03D6-40F7-4623-A175-C2984A7BB6CE}
Scan Type:AntiSpyware
Scan Parameters:Quick Scan
 
Date: 2017-01-21 14:14:59.488
Description: 
Windows Defender scan has been stopped before completion.
Scan ID:{9B26E915-1BEC-45BB-867D-D13F2419CE46}
Scan Type:AntiSpyware
Scan Parameters:Quick Scan
 
Date: 2018-04-23 23:12:47.779
Description: 
Windows Defender has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures.
Signatures Attempted:Current
Error Code:0x80070002
Error description:The system cannot find the file specified. 
Signature version:0.0.0.0
Engine version:0.0.0.0
 
Date: 2017-05-16 17:59:59.914
Description: 
Windows Defender has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures.
Signatures Attempted:Current
Error Code:0x80070002
Error description:The system cannot find the file specified. 
Signature version:0.0.0.0
Engine version:0.0.0.0
 
CodeIntegrity:
===================================
 
Date: 2018-04-25 22:24:11.486
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Fixer\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
Date: 2018-04-25 22:24:11.377
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Fixer\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
Date: 2017-06-18 00:41:21.271
Description: 
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\user32.dll because the set of per-page image hashes could not be found on the system.
 
Date: 2017-06-17 19:40:22.880
Description: 
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\user32.dll because the set of per-page image hashes could not be found on the system.
 
Date: 2017-06-17 19:32:39.396
Description: 
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\user32.dll because the set of per-page image hashes could not be found on the system.
 
Date: 2017-06-17 18:38:13.192
Description: 
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\user32.dll because the set of per-page image hashes could not be found on the system.
 
Date: 2017-06-17 17:33:36.838
Description: 
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\user32.dll because the set of per-page image hashes could not be found on the system.
 
Date: 2017-06-17 17:00:08.176
Description: 
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\user32.dll because the set of per-page image hashes could not be found on the system.
 
==================== Memory info =========================== 
 
Processor: Intel® Core™ i7-4510U CPU @ 2.00GHz
Percentage of memory in use: 25%
Total physical RAM: 8126.3 MB
Available physical RAM: 6038.17 MB
Total Virtual: 16250.76 MB
Available Virtual: 14021.79 MB
 
==================== Drives ================================
 
Drive c: () (Fixed) (Total:915.92 GB) (Free:123.7 GB) NTFS
Drive d: () (Fixed) (Total:7.78 GB) (Free:7.57 GB) FAT32
 
\\?\Volume{75a2e912-287c-11e4-be03-806e6f6e6963}\ () (Fixed) (Total:7.78 GB) (Free:7.5 GB) FAT32
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7/8/10) (Size: 931.5 GB) (Disk ID: 8DCB84D1)
Partition 1: (Not Active) - (Size=7.8 GB) - (Type=0B)
Partition 2: (Active) - (Size=7.8 GB) - (Type=0C)
Partition 3: (Not Active) - (Size=915.9 GB) - (Type=07 NTFS)
 
==================== End of Addition.txt ============================
 
 


BC AdBot (Login to Remove)

 


#2 nasdaq

nasdaq

  • Malware Response Team
  • 40,476 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:10:37 PM

Posted 28 April 2018 - 01:01 PM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Press the Windows key + r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and and click the OK key.
Please copy the entire contents of the code box below to the a new file.
 
start

CreateRestorePoint:
EmptyTemp:
CloseProcesses:

ContextMenuHandlers4: [MSSE] -> {0365FE2C-F183-4091-AC82-BFC39FB75C49} =>  -> No File
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
Task: {26B9E587-A82D-4127-9689-667D7597AB13} - \AVG_SYS_TASK_0615av_RUN -> No File <==== ATTENTION
Task: {484F628A-CA9C-4166-9639-615A4302FCAB} - System32\Tasks\{9EB021E1-716A-4B0F-8320-4A96C5522587} => C:\Windows\system32\pcalua.exe -a "C:\Users\Alexander Dochev\AppData\Roaming\istartsurf\UninstallManager.exe" -c -ptid=amt
Task: {6BB24196-9952-4185-B16E-291A3AF3EE2C} - System32\Tasks\winmgr89.exe => C:\Users\Alexander [Argument = Dochev\AppData\Roaming\Windows\winmgr89.exe]
Task: {B9450EF3-D7CC-4052-9C7A-808507B05619} - System32\Tasks\{F0649A19-A64D-4C02-BBB9-A6A9CC2EDA77} => C:\Windows\system32\pcalua.exe -a C:\Users\ALEXAN~1\AppData\Local\Temp\jre-8u144-windows-au.exe -d C:\Windows\SysWOW64 -c /installmethod=jau FAMILYUPGRADE=1 <==== ATTENTION
Shortcut: C:\Users\Alexander Dochev\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Int?rn?t Ex?l?rer (No ?dd-ons).lnk -> C:\Users\Alexander Dochev\AppData\Roaming\Browsers\exe.erolpxei.bat (No File) <==== Cyrillic
Shortcut: C:\Users\Alexander Dochev\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\G?ogl? Chrom?.lnk -> C:\Users\Alexander Dochev\AppData\Roaming\Browsers\exe.emorhc.bat (No File) <==== Cyrillic
Shortcut: C:\Users\Alexander Dochev\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\L?un?h Int?rnet ???l?r?r Br?wser.lnk -> C:\Users\Alexander Dochev\AppData\Roaming\Browsers\exe.erolpxei.bat (No File) <==== Cyrillic


CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
Handler: WSKVAllmytubechrome - {91AB862D-07B8-4A85 -  No File
FF HKU\S-1-5-21-1505688330-694015033-755604794-1000\...\Firefox\Extensions: [KVAllmytube@KeepVid.com] - C:\Users\Alexander Dochev\Desktop\New folder\Keepvid\KeepVid Pro\BrowserPlugin\kvallmytube@keepvid.com_xpi => not found
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin HKU\S-1-5-21-1505688330-694015033-755604794-1000: torrents-time.com/TTPlugin -> C:\Program Files (x86)\TorrentsTime Media Player\bin\npTTPlugin.dll [No File]
S3 btwampfl; \??\C:\Windows\system32\drivers\btwampfl.sys [X]
S3 btwaudio; system32\drivers\btwaudio.sys [X]
S3 btwl2cap; system32\DRIVERS\btwl2cap.sys [X]
S3 btwrchid; system32\DRIVERS\btwrchid.sys [X]
S3 catchme; \??\C:\Fixer\catchme.sys [X]
S3 clwvd; system32\DRIVERS\clwvd.sys [X]
S3 lmimirr; system32\DRIVERS\lmimirr.sys [X]
S3 RSP2STOR; system32\DRIVERS\RtsP2Stor.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 vmci; \SystemRoot\system32\DRIVERS\vmci.sys [X]
S3 VMnetAdapter; system32\DRIVERS\vmnetadapter.sys [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]

C:\Windows\System32\Tasks\{9EB021E1-716A-4B0F-8320-4A96C5522587}
C:\Users\Alexander Dochev\AppData\Roaming\istartsurf
C:\Windows\System32\Tasks\winmgr89.exe
C:\Users\Alexander [Argument = Dochev\AppData\Roaming\Windows\winmgr89.exe]
C:\Woindows\System32\Tasks\{F0649A19-A64D-4C02-BBB9-A6A9CC2EDA77}

End
Save the file as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

Reset the browsers that you use and have been compromised.

How To:
https://www.howtogeek.com/171924/how-to-reset-your-web-browser-to-its-default-settings/

====

Please post the logs and let me know what problem persists

#3 GhostlierCrib

GhostlierCrib
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:37 AM

Posted 28 April 2018 - 01:56 PM

Hello, 

Thanks for the fast response. When I ran the FRST fix it crashed/stopped responding and didn't do anything, so I just ran it again. The second time around it worked fine. Unfortunately even after i reset the browsers the problem continues.

 

Fix result of Farbar Recovery Scan Tool (x64) Version: 25.04.2018

Ran by Alexander Dochev (28-04-2018 21:24:55) Run:2
Running from C:\Users\Alexander Dochev\Desktop
Loaded Profiles: Alexander Dochev (Available Profiles: Alexander Dochev)
Boot Mode: Normal
==============================================
 
fixlist content:
*****************
start
 
CreateRestorePoint:
EmptyTemp:
CloseProcesses:
 
ContextMenuHandlers4: [MSSE] -> {0365FE2C-F183-4091-AC82-BFC39FB75C49} =>  -> No File
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
Task: {26B9E587-A82D-4127-9689-667D7597AB13} - \AVG_SYS_TASK_0615av_RUN -> No File <==== ATTENTION
Task: {484F628A-CA9C-4166-9639-615A4302FCAB} - System32\Tasks\{9EB021E1-716A-4B0F-8320-4A96C5522587} => C:\Windows\system32\pcalua.exe -a "C:\Users\Alexander Dochev\AppData\Roaming\istartsurf\UninstallManager.exe" -c -ptid=amt
Task: {6BB24196-9952-4185-B16E-291A3AF3EE2C} - System32\Tasks\winmgr89.exe => C:\Users\Alexander [Argument = Dochev\AppData\Roaming\Windows\winmgr89.exe]
Task: {B9450EF3-D7CC-4052-9C7A-808507B05619} - System32\Tasks\{F0649A19-A64D-4C02-BBB9-A6A9CC2EDA77} => C:\Windows\system32\pcalua.exe -a C:\Users\ALEXAN~1\AppData\Local\Temp\jre-8u144-windows-au.exe -d C:\Windows\SysWOW64 -c /installmethod=jau FAMILYUPGRADE=1 <==== ATTENTION
Shortcut: C:\Users\Alexander Dochev\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Int?rn?t Ex?l?rer (No ?dd-ons).lnk -> C:\Users\Alexander Dochev\AppData\Roaming\Browsers\exe.erolpxei.bat (No File) <==== Cyrillic
Shortcut: C:\Users\Alexander Dochev\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\G?ogl? Chrom?.lnk -> C:\Users\Alexander Dochev\AppData\Roaming\Browsers\exe.emorhc.bat (No File) <==== Cyrillic
Shortcut: C:\Users\Alexander Dochev\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\L?un?h Int?rnet ???l?r?r Br?wser.lnk -> C:\Users\Alexander Dochev\AppData\Roaming\Browsers\exe.erolpxei.bat (No File) <==== Cyrillic
 
 
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
Handler: WSKVAllmytubechrome - {91AB862D-07B8-4A85 -  No File
FF HKU\S-1-5-21-1505688330-694015033-755604794-1000\...\Firefox\Extensions: [KVAllmytube@KeepVid.com] - C:\Users\Alexander Dochev\Desktop\New folder\Keepvid\KeepVid Pro\BrowserPlugin\kvallmytube@keepvid.com_xpi => not found
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin HKU\S-1-5-21-1505688330-694015033-755604794-1000: torrents-time.com/TTPlugin -> C:\Program Files (x86)\TorrentsTime Media Player\bin\npTTPlugin.dll [No File]
S3 btwampfl; \??\C:\Windows\system32\drivers\btwampfl.sys [X]
S3 btwaudio; system32\drivers\btwaudio.sys [X]
S3 btwl2cap; system32\DRIVERS\btwl2cap.sys [X]
S3 btwrchid; system32\DRIVERS\btwrchid.sys [X]
S3 catchme; \??\C:\Fixer\catchme.sys [X]
S3 clwvd; system32\DRIVERS\clwvd.sys [X]
S3 lmimirr; system32\DRIVERS\lmimirr.sys [X]
S3 RSP2STOR; system32\DRIVERS\RtsP2Stor.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 vmci; \SystemRoot\system32\DRIVERS\vmci.sys [X]
S3 VMnetAdapter; system32\DRIVERS\vmnetadapter.sys [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
 
C:\Windows\System32\Tasks\{9EB021E1-716A-4B0F-8320-4A96C5522587}
C:\Users\Alexander Dochev\AppData\Roaming\istartsurf
C:\Windows\System32\Tasks\winmgr89.exe
C:\Users\Alexander [Argument = Dochev\AppData\Roaming\Windows\winmgr89.exe]
C:\Woindows\System32\Tasks\{F0649A19-A64D-4C02-BBB9-A6A9CC2EDA77}
 
End
*****************
 
Restore point was successfully created.
Processes closed successfully.
HKLM\Software\Classes\Directory\ShellEx\ContextMenuHandlers\MSSE => not found
HKLM\Software\Classes\CLSID\{0365FE2C-F183-4091-AC82-BFC39FB75C49} => not found
HKLM\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers\igfxcui => not found
HKLM\Software\Classes\CLSID\{3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => not found
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{26B9E587-A82D-4127-9689-667D7597AB13}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{26B9E587-A82D-4127-9689-667D7597AB13}" => removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AVG_SYS_TASK_0615av_RUN => could not remove. Access Denied.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{484F628A-CA9C-4166-9639-615A4302FCAB}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{484F628A-CA9C-4166-9639-615A4302FCAB}" => removed successfully
C:\Windows\System32\Tasks\{9EB021E1-716A-4B0F-8320-4A96C5522587} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{9EB021E1-716A-4B0F-8320-4A96C5522587}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{6BB24196-9952-4185-B16E-291A3AF3EE2C}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6BB24196-9952-4185-B16E-291A3AF3EE2C}" => removed successfully
C:\Windows\System32\Tasks\winmgr89.exe => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\winmgr89.exe" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B9450EF3-D7CC-4052-9C7A-808507B05619}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B9450EF3-D7CC-4052-9C7A-808507B05619}" => removed successfully
C:\Windows\System32\Tasks\{F0649A19-A64D-4C02-BBB9-A6A9CC2EDA77} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{F0649A19-A64D-4C02-BBB9-A6A9CC2EDA77}" => removed successfully
"C:\Users\Alexander Dochev\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Int?rn?t Ex?l?rer (No ?dd-ons).lnk" => Could not move.
"C:\Users\Alexander Dochev\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\G?ogl? Chrom?.lnk" => Could not move.
"C:\Users\Alexander Dochev\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\L?un?h Int?rnet ???l?r?r Br?wser.lnk" => Could not move.
"HKLM\SOFTWARE\Policies\Google" => removed successfully
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => removed successfully
"HKLM\Software\Classes\PROTOCOLS\Handler\WSKVAllmytubechrome" => removed successfully
"HKU\S-1-5-21-1505688330-694015033-755604794-1000\Software\Mozilla\Firefox\Extensions\\KVAllmytube@KeepVid.com" => removed successfully
"HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE" => removed successfully
"HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE" => removed successfully
"HKU\S-1-5-21-1505688330-694015033-755604794-1000\Software\MozillaPlugins\torrents-time.com/TTPlugin" => removed successfully
"C:\Program Files (x86)\TorrentsTime Media Player\bin\npTTPlugin.dll" => not found
"HKLM\System\CurrentControlSet\Services\btwampfl" => removed successfully
btwampfl => service removed successfully
"HKLM\System\CurrentControlSet\Services\btwaudio" => removed successfully
btwaudio => service removed successfully
"HKLM\System\CurrentControlSet\Services\btwl2cap" => removed successfully
btwl2cap => service removed successfully
"HKLM\System\CurrentControlSet\Services\btwrchid" => removed successfully
btwrchid => service removed successfully
"HKLM\System\CurrentControlSet\Services\catchme" => removed successfully
catchme => service removed successfully
"HKLM\System\CurrentControlSet\Services\clwvd" => removed successfully
clwvd => service removed successfully
"HKLM\System\CurrentControlSet\Services\lmimirr" => removed successfully
lmimirr => service removed successfully
"HKLM\System\CurrentControlSet\Services\RSP2STOR" => removed successfully
RSP2STOR => service removed successfully
"HKLM\System\CurrentControlSet\Services\VGPU" => removed successfully
VGPU => service removed successfully
"HKLM\System\CurrentControlSet\Services\vmci" => removed successfully
vmci => service removed successfully
"HKLM\System\CurrentControlSet\Services\VMnetAdapter" => removed successfully
VMnetAdapter => service removed successfully
"HKLM\System\CurrentControlSet\Services\xhunter1" => removed successfully
xhunter1 => service removed successfully
"C:\Windows\System32\Tasks\{9EB021E1-716A-4B0F-8320-4A96C5522587}" => not found
"C:\Users\Alexander Dochev\AppData\Roaming\istartsurf" => not found
"C:\Windows\System32\Tasks\winmgr89.exe" => not found
"C:\Users\Alexander [Argument = Dochev\AppData\Roaming\Windows\winmgr89.exe]" => not found
"C:\Woindows\System32\Tasks\{F0649A19-A64D-4C02-BBB9-A6A9CC2EDA77}" => not found
 
=========== EmptyTemp: ==========
 
BITS transfer queue => 8388608 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 325842121 B
Java, Flash, Steam htmlcache => 519495257 B
Windows/system/drivers => 1650 B
Edge => 0 B
Chrome => 757475186 B
Firefox => 0 B
Opera => 0 B
 
Temp, IE cache, history, cookies, recent:
Users => 0 B
Default => 0 B
Public => 0 B
ProgramData => 0 B
systemprofile => 16802 B
systemprofile32 => 75160 B
LocalService => 0 B
NetworkService => 4405778 B
Alexander Dochev => 18700284153 B
 
RecycleBin => 0 B
EmptyTemp: => 18.9 GB temporary data Removed.
 
================================
 
Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 28-04-2018 21:30:44)
 
 
Result of scheduled keys to remove after reboot:
 
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AVG_SYS_TASK_0615av_RUN => could not remove. Access Denied.
 
==== End of Fixlog 21:30:44 ====
 
B


#4 nasdaq

nasdaq

  • Malware Response Team
  • 40,476 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:10:37 PM

Posted 29 April 2018 - 06:43 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Press the Windows key + r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and and click the OK key.
Please copy the entire contents of the code box below to the a new file.
 
start

CreateRestorePoint:
EmptyTemp:
CloseProcesses:

C:\Users\Alexander Dochev\AppData\Roaming\Windows\winmgr89.exe

cmd: ipconfig /flushdns
cmd: IPCONFIG /release
cmd: IPCONFIG /renew
CMD: netsh winsock reset catalog

End
Save the file as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

If the problem persists please run the Farbar program and post a fresh FRST.txt log for my review.

#5 GhostlierCrib

GhostlierCrib
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:37 AM

Posted 29 April 2018 - 07:33 AM

Hello again, 

I ran the new fix, however it unfortunately doesn't seem to have done anything. The following are the fixlog and the new FRST log. Do you need the new Addition.txt aswell?

 

Fix result of Farbar Recovery Scan Tool (x64) Version: 25.04.2018
Ran by Alexander Dochev (29-04-2018 15:04:30) Run:3
Running from C:\Users\Alexander Dochev\Desktop
Loaded Profiles: Alexander Dochev (Available Profiles: Alexander Dochev)
Boot Mode: Normal
==============================================
 
fixlist content:
*****************
start
 
CreateRestorePoint:
EmptyTemp:
CloseProcesses:
 
C:\Users\Alexander Dochev\AppData\Roaming\Windows\winmgr89.exe
 
cmd: ipconfig /flushdns
cmd: IPCONFIG /release
cmd: IPCONFIG /renew
CMD: netsh winsock reset catalog
 
End
*****************
 
Restore point was successfully created.
Processes closed successfully.
"C:\Users\Alexander Dochev\AppData\Roaming\Windows\winmgr89.exe" => not found
 
========= ipconfig /flushdns =========
 
 
Windows IP Configuration
 
Successfully flushed the DNS Resolver Cache.
 
========= End of CMD: =========
 
 
========= IPCONFIG /release =========
 
 
Windows IP Configuration
 
No operation can be performed on Bluetooth Network Connection 3 while it has its media disconnected.
No operation can be performed on Wireless Network Connection 2 while it has its media disconnected.
No operation can be performed on Wireless Network Connection while it has its media disconnected.
 
Ethernet adapter Bluetooth Network Connection 3:
 
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
 
Ethernet adapter Local Area Connection:
 
   Connection-specific DNS Suffix  . : 
   Link-local IPv6 Address . . . . . : fe80::6085:9614:484c:146c%19
   Default Gateway . . . . . . . . . : 
 
Wireless LAN adapter Wireless Network Connection 2:
 
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
 
Wireless LAN adapter Wireless Network Connection:
 
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
 
========= End of CMD: =========
 
 
========= IPCONFIG /renew =========
 
 
Windows IP Configuration
 
No operation can be performed on Bluetooth Network Connection 3 while it has its media disconnected.
No operation can be performed on Wireless Network Connection 2 while it has its media disconnected.
No operation can be performed on Wireless Network Connection while it has its media disconnected.
 
Ethernet adapter Bluetooth Network Connection 3:
 
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
 
Ethernet adapter Local Area Connection:
 
   Connection-specific DNS Suffix  . : 
   Link-local IPv6 Address . . . . . : fe80::6085:9614:484c:146c%19
   IPv4 Address. . . . . . . . . . . : 192.168.0.105
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.0.1
 
Wireless LAN adapter Wireless Network Connection 2:
 
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
 
Wireless LAN adapter Wireless Network Connection:
 
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
 
========= End of CMD: =========
 
 
========= netsh winsock reset catalog =========
 
 
Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.
 
 
========= End of CMD: =========
 
 
=========== EmptyTemp: ==========
 
BITS transfer queue => 8388608 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 7217020 B
Java, Flash, Steam htmlcache => 40867275 B
Windows/system/drivers => -508808 B
Edge => 0 B
Chrome => 21777816 B
Firefox => 0 B
Opera => 0 B
 
Temp, IE cache, history, cookies, recent:
Users => 0 B
Default => 0 B
Public => 0 B
ProgramData => 0 B
systemprofile => 128 B
systemprofile32 => 0 B
LocalService => 0 B
NetworkService => 4922 B
Alexander Dochev => 210931912 B
 
RecycleBin => 0 B
EmptyTemp: => 275.3 MB temporary data Removed.
 
================================
 
 
The system needed a reboot.
 
==== End of Fixlog 15:06:06 ====
 
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 25.04.2018
Ran by Alexander Dochev (administrator) on MYPC (29-04-2018 15:18:06)
Running from C:\Users\Alexander Dochev\Desktop
Loaded Profiles: Alexander Dochev (Available Profiles: Alexander Dochev)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(COMODO) C:\Program Files (x86)\Comodo\Internet Security Essentials\isesrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
() C:\ProgramData\VIVACOM 3G USB Modem\OnlineUpdate\ouc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Discord Inc.) C:\Users\Alexander Dochev\AppData\Local\Discord\app-0.0.300\Discord.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(COMODO) C:\Program Files (x86)\Comodo\Internet Security Essentials\vkise.exe
(Disc Soft Ltd) C:\Program Files (x86)\DAEMON Tools Ultra\DiscSoftBusService.exe
(Node.js) C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe
(HP Inc.) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(Discord Inc.) C:\Users\Alexander Dochev\AppData\Local\Discord\app-0.0.300\Discord.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
(Blizzard Entertainment) C:\Program Files (x86)\Battle.net\Battle.net.exe
(Blizzard Entertainment) C:\ProgramData\Battle.net\Agent\Agent.6160\Agent.exe
(Blizzard Entertainment) C:\Program Files (x86)\Battle.net\Battle.net.10047\Battle.net Helper.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Microsoft Corporation) C:\Windows\temp\E03D9447-59BC-4DD2-9F4C-F8FFF709B685\DismHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
==================== Registry (Whitelisted) ===========================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7666392 2014-12-12] (Realtek Semiconductor)
HKLM\...\Run: [XboxStat] => C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-10-01] (Microsoft Corporation)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2818800 2014-06-17] (Synaptics Incorporated)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1353680 2016-11-14] (Microsoft Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-12-19] (Oracle Corporation)
HKLM-x32\...\Run: [IseUI] => C:\Program Files (x86)\COMODO\Internet Security Essentials\vkise.exe [4072376 2018-01-17] (COMODO)
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-1505688330-694015033-755604794-1000\...\Run: [GalaxyClient] => C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe [6448712 2018-04-23] (GOG.com)
HKU\S-1-5-21-1505688330-694015033-755604794-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3199776 2018-04-03] (Valve Corporation)
HKU\S-1-5-21-1505688330-694015033-755604794-1000\...\Run: [DAEMON Tools Ultra Agent] => C:\Program Files (x86)\DAEMON Tools Ultra\DTAgent.exe [3639568 2014-07-10] (Disc Soft Ltd)
HKU\S-1-5-21-1505688330-694015033-755604794-1000\...\Run: [Discord] => C:\Users\Alexander Dochev\AppData\Local\Discord\app-0.0.300\Discord.exe [57821176 2018-01-08] (Discord Inc.)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [182784 2018-03-25] (NVIDIA Corporation)
AppInit_DLLs:  C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [182784 2018-03-25] (NVIDIA Corporation)
AppInit_DLLs:  C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [182784 2018-03-25] (NVIDIA Corporation)
AppInit_DLLs:  C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [182784 2018-03-25] (NVIDIA Corporation)
AppInit_DLLs:  C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [182784 2018-03-25] (NVIDIA Corporation)
AppInit_DLLs:  C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [182784 2018-03-25] (NVIDIA Corporation)
AppInit_DLLs: ,C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [182784 2018-03-25] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [159704 2018-03-25] (NVIDIA Corporation)
Lsa: [Notification Packages] scecli C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
GroupPolicy: Restriction - Chrome <==== ATTENTION
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Tcpip\Parameters: [DhcpNameServer] 78.90.164.1 89.190.192.247
Tcpip\..\Interfaces\{187A61D7-4EE8-4CCB-AC90-AAB6E5A3987F}: [NameServer] 212.39.90.42 212.39.90.43
Tcpip\..\Interfaces\{31D1BEB9-070E-4F50-B144-1BEFCE9738C9}: [DhcpNameServer] 78.90.164.1 89.190.192.247
Tcpip\..\Interfaces\{59836918-9A32-4EA5-BFE1-5E0E6EC2146F}: [DhcpNameServer] 78.90.164.1 89.190.192.247
Tcpip\..\Interfaces\{67CE52F9-19DF-4B43-9DE2-189F201BF4C2}: [NameServer]  
Tcpip\..\Interfaces\{C8B800E2-3557-4B9B-97B2-F80F94928681}: [NameServer]  
 
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617911&ResetID=131413247638939178&GUID=3F0DDCEE-AD44-4446-9008-703275629452
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617911&ResetID=131413247638939178&GUID=3F0DDCEE-AD44-4446-9008-703275629452
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1505688330-694015033-755604794-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1505688330-694015033-755604794-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.co.uk/
SearchScopes: HKU\S-1-5-21-1505688330-694015033-755604794-1000 -> DefaultScope {1348A74C-C71D-415F-919A-6CA4703F72F2} URL = hxxps://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-1505688330-694015033-755604794-1000 -> {1348A74C-C71D-415F-919A-6CA4703F72F2} URL = hxxps://www.google.com/search?q={searchTerms}
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2018-02-15] (Microsoft Corporation)
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_161\bin\ssv.dll [2018-01-26] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2017-02-23] (Microsoft Corporation)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_161\bin\jp2ssv.dll [2018-01-26] (Oracle Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2017-08-24] (Microsoft Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_161\bin\ssv.dll [2018-01-26] (Oracle Corporation)
BHO-x32: ArcPluginIEBHO Class -> {84BFE29A-8139-402a-B2A4-C23AE9E1A75F} -> C:\Program Files (x86)\Arc\Plugins\ArcPluginIE.dll [2017-08-31] (Perfect World Entertainment Inc)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2014-01-21] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2017-02-23] (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_161\bin\jp2ssv.dll [2018-01-26] (Oracle Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2017-08-15] (Microsoft Corporation)
 
FireFox:
========
FF Plugin: @java.com/DTPlugin,version=11.161.2 -> C:\Program Files\Java\jre1.8.0_161\bin\dtplugin\npDeployJava1.dll [2018-01-26] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.161.2 -> C:\Program Files\Java\jre1.8.0_161\bin\plugin2\npjp2.dll [2018-01-26] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2015-07-12] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2015-07-12] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.161.2 -> C:\Program Files (x86)\Java\jre1.8.0_161\bin\dtplugin\npDeployJava1.dll [2018-01-26] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.161.2 -> C:\Program Files (x86)\Java\jre1.8.0_161\bin\plugin2\npjp2.dll [2018-01-26] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-10-18] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-21] (Microsoft Corporation)
FF Plugin-x32: @perfectworld.com/npArcPlayNowPlugin -> C:\Program Files (x86)\Arc\Plugins\npArcPluginFF.dll [2017-08-31] (Perfect World Entertainment Inc)
FF Plugin-x32: @tiancity.com/NxGame -> C:\ProgramData\Tiancity\NGM\npNxGameCN.dll [2017-09-02] (Nexon)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-16] (Google Inc.)
 
Chrome: 
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> hxxp://www.google.co.uk/
CHR StartupUrls: Default -> "hxxps://www.google.co.uk/"
CHR Profile: C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default [2018-04-29]
CHR Extension: (YouTube) - C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-06-07]
CHR Extension: (Dark Reader) - C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default\Extensions\eimadpbcbfnmbkopoojfekhnkhdbieeh [2018-04-26]
CHR Extension: (Assassin's Creed III) - C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default\Extensions\geadmffjboclimmeiaimcafapjaefnfn [2018-04-29]
CHR Extension: (AdBlock) - C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2018-04-24]
CHR Extension: (Google Maps) - C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default\Extensions\lneaknkopdijkpnocmklfnjbeapigfbh [2017-06-07]
CHR Extension: (What are you a bleep bleep?(iDubbbzTV)) - C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfmdkhjclbbjlkgjiajngllhmanljklb [2017-06-07]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-04-04]
CHR Extension: (iDubbbzTv Memes!) - C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default\Extensions\oaakdddcpbpecmmeikbdbfiopeagmppd [2017-06-07]
CHR Extension: (IT'S TIME TO STOP!) - C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfcacfgohgdodgmahbjkbndbdkmfknlo [2017-09-27]
CHR Extension: (Chrome Media Router) - C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-04-24]
CHR Extension: (That's Pretty Good (iDubbbzTV)) - C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pnidecdngnainebcfbmebgpkmnmljdng [2017-06-28]
CHR Profile: C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\System Profile [2018-04-29]
CHR HKU\S-1-5-21-1505688330-694015033-755604794-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [dhdgffkkebhmkfjojejmpbldmpobfkfo] - hxxp://clients2.google.com/service/update2/crx
 
==================== Services (Whitelisted) ====================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
S3 ArcService; C:\Program Files (x86)\Arc\ArcService.exe [87064 2017-08-31] (Perfect World Entertainment Inc)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [7013384 2018-03-10] ()
R3 Disc Soft Bus Service; C:\Program Files (x86)\DAEMON Tools Ultra\DiscSoftBusService.exe [887056 2014-07-10] (Disc Soft Ltd)
S3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [383016 2017-08-14] (EasyAntiCheat Ltd)
S3 GalaxyClientService; C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe [665160 2018-04-23] (GOG.com)
S3 GalaxyCommunication; C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe [8109640 2018-04-23] (GOG.com)
U2 HiPatchService; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9728 2017-02-23] (Hi-Rez Studios) [File not signed]
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [332144 2017-11-21] (HP Inc.)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [355232 2015-08-09] (Intel Corporation)
R2 Intel® Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-28] (Intel® Corporation) [File not signed]
S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-28] (Intel® Corporation)
R2 Intel® ME Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [131544 2015-07-12] (Intel Corporation)
R2 isesrv; C:\Program Files (x86)\COMODO\Internet Security Essentials\isesrv.exe [1199544 2018-01-17] (COMODO)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [169432 2015-07-12] (Intel Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [119864 2016-11-14] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [361816 2016-11-14] (Microsoft Corporation)
R2 NvContainerLocalSystem; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [522688 2018-03-14] (NVIDIA Corporation)
S3 NvContainerNetworkService; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [522688 2018-03-14] (NVIDIA Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [292568 2014-12-12] (Realtek Semiconductor)
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [191728 2014-06-17] (Synaptics Incorporated)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5426448 2014-12-15] (TeamViewer GmbH)
S2 VIVACOM 3G USB Modem. RunOuc; C:\Program Files (x86)\VIVACOM 3G USB Modem\UpdateDog\ouc.exe [655712 2014-09-03] ()
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2014-02-13] (Microsoft Corporation)
R2 NVDisplay.ContainerLocalSystem; "C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe" -s NVDisplay.ContainerLocalSystem -f "C:\ProgramData\NVIDIA\NVDisplay.ContainerLocalSystem.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem" -r -p 30000
R2 NvTelemetryContainer; "C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe" -s NvTelemetryContainer -f "C:\ProgramData\NVIDIA\NvTelemetryContainer.log" -l 3 -d "C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\plugins" -r
 
===================== Drivers (Whitelisted) ======================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [172760 2013-10-02] (Broadcom Corporation.)
R3 dtscsibus; C:\Windows\System32\DRIVERS\dtscsibus.sys [29696 2014-08-20] (Disc Soft Ltd)
S3 EvolveVirtualAdapter; C:\Windows\System32\DRIVERS\evolve.sys [21656 2015-03-03] (Echobit, LLC)
R1 gtkrnl; C:\Windows\System32\drivers\gtkrnl.sys [126856 2018-03-29] ()
S3 huawei_wwanecm; C:\Windows\System32\DRIVERS\ew_juwwanecm.sys [238080 2014-09-03] (Huawei Technologies Co., Ltd.)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-11-08] (Intel Corporation)
S3 INETMON; C:\Windows\System32\Drivers\INETMON.sys [29088 2013-08-14] ()
R3 ISCT; C:\Windows\System32\DRIVERS\ISCTD64.sys [46568 2013-01-19] ()
R1 isedrv; C:\Windows\system32\drivers\isedrv.sys [50576 2018-01-17] (COMODO)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [100312 2015-07-12] (Intel Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [295000 2016-08-25] (Microsoft Corporation)
R1 MpKsl5b45fa56; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{1A710BA9-F1BC-4CEA-88FA-89F2BA16C1CE}\MpKsl5b45fa56.sys [58120 2018-04-29] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [135928 2016-08-25] (Microsoft Corporation)
S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [31168 2018-03-14] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [59240 2017-12-15] (NVIDIA Corporation)
R3 nvvhci; C:\Windows\System32\DRIVERS\nvvhci.sys [58680 2018-01-10] (NVIDIA Corporation)
R3 RTSPER; C:\Windows\System32\DRIVERS\RtsPer.sys [466136 2014-01-15] (Realsil Semiconductor Corporation)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [31472 2014-06-17] (Synaptics Incorporated)
S3 ssudobex; C:\Windows\System32\DRIVERS\ssudobex.sys [206080 2014-01-22] (DEVGURU Co., LTD.(www.devguru.co.kr))
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2018-04-29 15:18 - 2018-04-29 15:20 - 000023686 _____ C:\Users\Alexander Dochev\Desktop\FRST.txt
2018-04-29 15:04 - 2018-04-29 15:06 - 000004090 _____ C:\Users\Alexander Dochev\Desktop\Fixlog.txt
2018-04-28 20:16 - 2018-04-29 15:21 - 000000000 ____D C:\Users\Alexander Dochev\Desktop\Help pls
2018-04-28 19:44 - 2018-04-28 19:44 - 002405888 _____ (Farbar) C:\Users\Alexander Dochev\Desktop\FRST64.exe
2018-04-28 18:14 - 2018-04-28 18:16 - 000224652 _____ C:\TDSSKiller.3.1.0.17_28.04.2018_18.14.05_log.txt
2018-04-28 17:23 - 2018-04-28 17:31 - 000000000 ____D C:\Program Files (x86)\DLL Suite
2018-04-28 15:27 - 2018-04-28 15:27 - 001700352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdiplus.dll
2018-04-28 15:27 - 2018-04-28 15:27 - 001060864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc71.dll
2018-04-28 15:13 - 2018-04-28 15:13 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\COMODO
2018-04-28 15:06 - 2018-03-13 17:17 - 000440512 _____ (COMODO) C:\ProgramData\cmdres.dll
2018-04-28 14:05 - 2018-04-28 15:27 - 000000000 ____D C:\Users\Alexander Dochev\AppData\Local\Comodo
2018-04-28 14:05 - 2018-04-28 15:27 - 000000000 ____D C:\Program Files (x86)\Comodo
2018-04-28 14:05 - 2018-01-17 10:59 - 000255248 _____ (COMODO) C:\Windows\system32\iseguard64.dll
2018-04-28 14:05 - 2018-01-17 10:59 - 000205256 _____ (COMODO) C:\Windows\SysWOW64\iseguard32.dll
2018-04-28 14:05 - 2018-01-17 10:59 - 000050576 _____ (COMODO) C:\Windows\system32\Drivers\isedrv.sys
2018-04-28 14:03 - 2018-04-28 15:20 - 000000000 ____D C:\ProgramData\Comodo
2018-04-28 13:42 - 2018-04-28 13:42 - 000000000 ____D C:\ProgramData\Emsisoft
2018-04-26 13:06 - 2018-04-26 13:06 - 000000000 ____D C:\Users\Alexander Dochev\AppData\Local\ESET
2018-04-26 12:48 - 2018-04-29 15:18 - 000000000 ____D C:\FRST
2018-04-22 19:48 - 2018-04-22 20:58 - 000000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2018-04-22 19:27 - 2018-04-22 19:48 - 000000000 ____D C:\ProgramData\Malwarebytes
2018-04-22 19:27 - 2018-04-22 19:27 - 000000000 ____D C:\Program Files\Malwarebytes
2018-04-22 14:12 - 2018-04-26 02:17 - 000000000 ____D C:\AdwCleaner
2018-04-22 11:52 - 2018-04-22 11:52 - 000000000 ____D C:\Users\Alexander Dochev\AppData\LocalLow\Moe Wars
2018-04-16 19:44 - 2018-04-16 19:44 - 000000000 ____D C:\Users\Alexander Dochev\Desktop\REeee
2018-04-13 19:08 - 2018-03-31 05:09 - 005583040 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2018-04-13 19:08 - 2018-03-31 05:09 - 000708288 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2018-04-13 19:08 - 2018-03-31 05:09 - 000262336 _____ (Microsoft Corporation) C:\Windows\system32\hal.dll
2018-04-13 19:08 - 2018-03-31 05:09 - 000154816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2018-04-13 19:08 - 2018-03-31 05:09 - 000095424 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2018-04-13 19:08 - 2018-03-31 04:45 - 000631640 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2018-04-13 19:08 - 2018-03-31 04:39 - 004046528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2018-04-13 19:08 - 2018-03-31 04:39 - 003958464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2018-04-13 19:08 - 2018-03-31 04:38 - 001665336 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 001461248 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 001212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 001163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000731648 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000361984 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000094720 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000007168 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:12 - 001314064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 001114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000554496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000070144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:06 - 000148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2018-04-13 19:08 - 2018-03-31 04:06 - 000064512 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2018-04-13 19:08 - 2018-03-31 04:06 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2018-04-13 19:08 - 2018-03-31 04:06 - 000017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2018-04-13 19:08 - 2018-03-31 04:03 - 000338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2018-04-13 19:08 - 2018-03-31 04:02 - 000296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2018-04-13 19:08 - 2018-03-31 04:02 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\videoprt.sys
2018-04-13 19:08 - 2018-03-31 03:59 - 000160256 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2018-04-13 19:08 - 2018-03-31 03:58 - 000291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2018-04-13 19:08 - 2018-03-31 03:58 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2018-04-13 19:08 - 2018-03-31 03:58 - 000112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2018-04-13 19:08 - 2018-03-31 03:58 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2018-04-13 19:08 - 2018-03-31 03:51 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2018-04-13 19:08 - 2018-03-31 03:47 - 000036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2018-04-13 19:08 - 2018-03-31 03:47 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2018-04-13 19:08 - 2018-03-31 03:47 - 000014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2018-04-13 19:08 - 2018-03-31 03:47 - 000007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2018-04-13 19:08 - 2018-03-31 03:47 - 000006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 03:47 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 03:47 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 03:47 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 03:47 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2018-04-13 19:08 - 2018-03-28 10:30 - 003225600 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2018-04-13 19:08 - 2018-03-23 21:50 - 000396952 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2018-04-13 19:08 - 2018-03-23 20:59 - 000348824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2018-04-13 19:08 - 2018-03-23 02:00 - 025742336 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2018-04-13 19:08 - 2018-03-23 00:32 - 002724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2018-04-13 19:08 - 2018-03-23 00:32 - 000004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2018-04-13 19:08 - 2018-03-23 00:26 - 020287488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2018-04-13 19:08 - 2018-03-23 00:19 - 002901504 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2018-04-13 19:08 - 2018-03-23 00:18 - 000066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2018-04-13 19:08 - 2018-03-23 00:17 - 000578048 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2018-04-13 19:08 - 2018-03-23 00:17 - 000417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2018-04-13 19:08 - 2018-03-23 00:17 - 000088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2018-04-13 19:08 - 2018-03-23 00:17 - 000048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2018-04-13 19:08 - 2018-03-23 00:15 - 005780480 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2018-04-13 19:08 - 2018-03-23 00:10 - 000054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2018-04-13 19:08 - 2018-03-23 00:09 - 000034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2018-04-13 19:08 - 2018-03-23 00:07 - 000615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2018-04-13 19:08 - 2018-03-23 00:06 - 000794112 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2018-04-13 19:08 - 2018-03-23 00:06 - 000144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2018-04-13 19:08 - 2018-03-23 00:06 - 000116224 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2018-04-13 19:08 - 2018-03-23 00:05 - 000814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2018-04-13 19:08 - 2018-03-23 00:04 - 002724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2018-04-13 19:08 - 2018-03-22 23:58 - 000969216 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2018-04-13 19:08 - 2018-03-22 23:55 - 000489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2018-04-13 19:08 - 2018-03-22 23:52 - 000499712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2018-04-13 19:08 - 2018-03-22 23:52 - 000062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2018-04-13 19:08 - 2018-03-22 23:51 - 000341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2018-04-13 19:08 - 2018-03-22 23:51 - 000047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2018-04-13 19:08 - 2018-03-22 23:50 - 000064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2018-04-13 19:08 - 2018-03-22 23:49 - 000077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2018-04-13 19:08 - 2018-03-22 23:48 - 002295296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2018-04-13 19:08 - 2018-03-22 23:48 - 000107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2018-04-13 19:08 - 2018-03-22 23:48 - 000087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2018-04-13 19:08 - 2018-03-22 23:45 - 000199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2018-04-13 19:08 - 2018-03-22 23:45 - 000047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2018-04-13 19:08 - 2018-03-22 23:45 - 000030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2018-04-13 19:08 - 2018-03-22 23:44 - 000092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2018-04-13 19:08 - 2018-03-22 23:43 - 000476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2018-04-13 19:08 - 2018-03-22 23:42 - 000661504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2018-04-13 19:08 - 2018-03-22 23:42 - 000315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2018-04-13 19:08 - 2018-03-22 23:42 - 000115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2018-04-13 19:08 - 2018-03-22 23:41 - 000620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2018-04-13 19:08 - 2018-03-22 23:40 - 000152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2018-04-13 19:08 - 2018-03-22 23:33 - 000416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2018-04-13 19:08 - 2018-03-22 23:31 - 000262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2018-04-13 19:08 - 2018-03-22 23:29 - 015282688 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2018-04-13 19:08 - 2018-03-22 23:29 - 000809472 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2018-04-13 19:08 - 2018-03-22 23:29 - 000728064 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2018-04-13 19:08 - 2018-03-22 23:29 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2018-04-13 19:08 - 2018-03-22 23:28 - 000091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2018-04-13 19:08 - 2018-03-22 23:28 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2018-04-13 19:08 - 2018-03-22 23:27 - 002135552 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2018-04-13 19:08 - 2018-03-22 23:27 - 001359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2018-04-13 19:08 - 2018-03-22 23:25 - 000168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2018-04-13 19:08 - 2018-03-22 23:25 - 000076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2018-04-13 19:08 - 2018-03-22 23:24 - 000279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2018-04-13 19:08 - 2018-03-22 23:22 - 000130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2018-04-13 19:08 - 2018-03-22 23:21 - 004496896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2018-04-13 19:08 - 2018-03-22 23:20 - 013680128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2018-04-13 19:08 - 2018-03-22 23:17 - 000230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2018-04-13 19:08 - 2018-03-22 23:15 - 003241472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2018-04-13 19:08 - 2018-03-22 23:15 - 000696320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2018-04-13 19:08 - 2018-03-22 23:14 - 002059776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2018-04-13 19:08 - 2018-03-22 23:14 - 001155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2018-04-13 19:08 - 2018-03-22 23:04 - 001545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2018-04-13 19:08 - 2018-03-22 22:55 - 002767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2018-04-13 19:08 - 2018-03-22 22:53 - 000800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2018-04-13 19:08 - 2018-03-22 22:52 - 001313792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2018-04-13 19:08 - 2018-03-22 22:51 - 000710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2018-04-13 19:08 - 2018-03-10 20:11 - 000340480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msexcl40.dll
2018-04-13 19:08 - 2018-03-09 21:18 - 000309440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2018-04-13 19:08 - 2018-03-09 21:12 - 000383680 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2018-04-13 19:08 - 2018-03-09 21:12 - 000111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\t2embed.dll
2018-04-13 19:08 - 2018-03-09 21:12 - 000071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2018-04-13 19:08 - 2018-03-09 21:12 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2018-04-13 19:08 - 2018-03-09 21:11 - 000010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2018-04-13 19:08 - 2018-03-09 21:07 - 000152064 _____ (Microsoft Corporation) C:\Windows\system32\t2embed.dll
2018-04-13 19:08 - 2018-03-09 21:07 - 000100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2018-04-13 19:08 - 2018-03-09 21:07 - 000041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2018-04-13 19:08 - 2018-03-09 21:06 - 000046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2018-04-13 19:08 - 2018-03-09 21:06 - 000014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2018-04-13 19:08 - 2018-03-09 20:31 - 000034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2018-04-13 19:08 - 2018-03-06 21:13 - 000148160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\basecsp.dll
2018-04-13 19:08 - 2018-03-06 21:11 - 000184320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scksp.dll
2018-04-13 19:08 - 2018-03-06 21:11 - 000052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wsnmp32.dll
2018-04-13 19:08 - 2018-03-06 21:10 - 000170176 _____ (Microsoft Corporation) C:\Windows\system32\basecsp.dll
2018-04-13 19:08 - 2018-03-06 21:07 - 000229376 _____ (Microsoft Corporation) C:\Windows\system32\scksp.dll
2018-04-13 19:08 - 2018-03-06 21:07 - 000067072 _____ (Microsoft Corporation) C:\Windows\system32\wsnmp32.dll
2018-04-13 19:08 - 2018-02-22 06:28 - 000217600 _____ (Microsoft Corporation) C:\Windows\system32\WinSCard.dll
2018-04-13 19:08 - 2018-02-22 06:06 - 000134656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinSCard.dll
2018-04-13 19:08 - 2018-02-10 21:35 - 000367296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msrpc.sys
2018-04-13 19:08 - 2018-02-10 21:35 - 000334528 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\acpi.sys
2018-04-13 19:08 - 2018-02-10 21:35 - 000185024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pci.sys
2018-04-13 19:08 - 2018-02-10 21:35 - 000122560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\NV_AGP.SYS
2018-04-13 19:08 - 2018-02-10 21:35 - 000068288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volmgr.sys
2018-04-13 19:08 - 2018-02-10 21:35 - 000064192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ULIAGPKX.SYS
2018-04-13 19:08 - 2018-02-10 21:35 - 000063168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\termdd.sys
2018-04-13 19:08 - 2018-02-10 21:35 - 000060608 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\AGP440.sys
2018-04-13 19:08 - 2018-02-10 21:35 - 000036032 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vdrvroot.sys
2018-04-13 19:08 - 2018-02-10 21:35 - 000031936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mssmbios.sys
2018-04-13 19:08 - 2018-02-10 21:35 - 000023744 _____ (Microsoft Corporation) C:\Windows\system32\streamci.dll
2018-04-13 19:08 - 2018-02-10 21:35 - 000020160 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\isapnp.sys
2018-04-13 19:08 - 2018-02-10 21:35 - 000015040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msisadrv.sys
2018-04-13 19:08 - 2018-02-10 21:35 - 000012096 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\swenum.sys
2018-04-13 19:08 - 2018-02-10 21:23 - 002292224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSVidCtl.dll
2018-04-13 19:08 - 2018-02-10 21:23 - 000330240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\zipfldr.dll
2018-04-13 19:08 - 2018-02-10 21:23 - 000111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\racpldlg.dll
2018-04-13 19:08 - 2018-02-10 21:11 - 003665920 _____ (Microsoft Corporation) C:\Windows\system32\MSVidCtl.dll
2018-04-13 19:08 - 2018-02-10 21:11 - 000369664 _____ (Microsoft Corporation) C:\Windows\system32\zipfldr.dll
2018-04-13 19:08 - 2018-02-10 21:11 - 000133120 _____ (Microsoft Corporation) C:\Windows\system32\msrahc.dll
2018-04-13 19:08 - 2018-02-10 21:11 - 000119296 _____ (Microsoft Corporation) C:\Windows\system32\racpldlg.dll
2018-04-13 19:08 - 2018-02-10 20:36 - 000108032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msra.exe
2018-04-13 19:08 - 2018-02-10 20:36 - 000040960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdchange.exe
2018-04-13 19:08 - 2018-02-10 20:36 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsraLegacy.tlb
2018-04-13 19:08 - 2018-02-10 20:26 - 000653312 _____ (Microsoft Corporation) C:\Windows\system32\msra.exe
2018-04-13 19:08 - 2018-02-10 20:26 - 000051712 _____ (Microsoft Corporation) C:\Windows\system32\sdchange.exe
2018-04-13 19:08 - 2018-02-10 20:25 - 000014336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wmiacpi.sys
2018-04-13 19:08 - 2018-02-10 20:25 - 000009728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\errdev.sys
2018-04-13 19:08 - 2018-02-10 20:25 - 000007168 _____ (Microsoft Corporation) C:\Windows\system32\MsraLegacy.tlb
2018-04-13 19:08 - 2018-02-02 21:40 - 000114368 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2018-04-13 19:08 - 2018-02-02 21:29 - 002365952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2018-04-13 19:08 - 2018-02-02 21:29 - 000337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2018-04-13 19:08 - 2018-02-02 21:29 - 000025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msimsg.dll
2018-04-13 19:08 - 2018-02-02 21:28 - 001806848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2018-04-13 19:08 - 2018-02-02 21:16 - 003246080 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2018-04-13 19:08 - 2018-02-02 21:16 - 000504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2018-04-13 19:08 - 2018-02-02 21:16 - 000025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2018-04-13 19:08 - 2018-02-02 21:14 - 001942016 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2018-04-13 19:08 - 2018-02-02 21:14 - 000070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2018-04-13 19:08 - 2018-02-02 20:46 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2018-04-13 19:08 - 2018-02-02 20:36 - 000128512 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2018-04-13 19:08 - 2018-01-25 17:05 - 000995272 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000063832 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000020824 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000019800 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000017752 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000017752 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000016216 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000015704 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000014168 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000014168 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000013656 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000012632 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000012632 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000012632 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000012120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000012120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000012120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000012120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000012120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000011608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000011608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000011608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000011608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000922944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ucrtbase.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000066392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-private-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-math-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000019800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000017752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-string-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000017752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000016216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000015704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000014168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-time-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000014168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000013656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000012632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000012632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000012632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000012120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000012120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000012120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000012120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000012120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000011608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l2-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000011608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000011608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000011608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll
2018-04-13 19:08 - 2018-01-15 22:59 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2018-04-13 19:08 - 2018-01-15 22:40 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2018-04-13 19:08 - 2018-01-12 19:40 - 000407040 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2018-04-13 19:08 - 2018-01-12 19:26 - 000308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2018-04-11 19:22 - 2018-03-14 20:14 - 000135360 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2018-04-11 19:22 - 2018-03-14 20:09 - 000656384 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2018-04-11 19:22 - 2018-03-14 16:05 - 001993728 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2018-04-11 19:22 - 2018-03-14 16:05 - 001559552 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2018-04-11 19:22 - 2018-03-14 16:05 - 000739840 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2018-04-11 19:22 - 2018-03-14 16:05 - 000599552 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2018-04-11 19:22 - 2018-03-14 16:05 - 000450048 _____ (Microsoft Corporation) C:\Windows\system32\centel.dll
2018-04-11 19:22 - 2018-03-14 16:05 - 000414720 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2018-04-11 19:22 - 2018-03-14 16:05 - 000291840 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2018-04-11 19:22 - 2018-03-14 16:05 - 000237056 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2018-03-30 21:10 - 2018-02-19 00:34 - 000634272 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2018-04-29 15:17 - 2014-08-20 16:55 - 000000000 ____D C:\ProgramData\NVIDIA
2018-04-29 15:15 - 2016-07-01 23:00 - 000000000 ____D C:\Users\Alexander Dochev\Documents\Assassin's Creed Unity
2018-04-29 15:14 - 2016-11-15 16:30 - 000000000 ____D C:\Users\Alexander Dochev\AppData\Local\Battle.net
2018-04-29 15:13 - 2016-11-15 16:29 - 000000000 ____D C:\Program Files (x86)\Battle.net
2018-04-29 15:12 - 2014-10-30 23:08 - 000000000 ____D C:\Program Files (x86)\Steam
2018-04-29 15:09 - 2017-03-12 21:12 - 000000000 ____D C:\Program Files (x86)\Hi-Rez Studios
2018-04-29 15:09 - 2014-08-20 15:09 - 000000000 __SHD C:\Users\Alexander Dochev\IntelGraphicsProfiles
2018-04-29 15:08 - 2016-04-19 14:15 - 000000147 _____ C:\HaxLogs.txt
2018-04-29 15:07 - 2009-07-14 08:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2018-04-29 15:05 - 2009-07-14 07:45 - 000035664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2018-04-29 15:05 - 2009-07-14 07:45 - 000035664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2018-04-28 21:26 - 2014-11-28 21:45 - 000000000 ____D C:\Users\Alexander Dochev\AppData\LocalLow\Temp
2018-04-28 21:24 - 2014-10-26 21:12 - 000000000 ____D C:\Users\Alexander Dochev\AppData\Local\CrashDumps
2018-04-28 18:48 - 2017-05-19 21:20 - 000000000 ____D C:\Users\Alexander Dochev\Downloads\Fix my bleep bleep please
2018-04-28 18:40 - 2017-05-19 12:32 - 000000000 ____D C:\Qoobox
2018-04-28 18:33 - 2017-05-19 12:32 - 000000000 ____D C:\Windows\erdnt
2018-04-28 18:33 - 2009-07-14 05:34 - 000000215 _____ C:\Windows\system.ini
2018-04-28 18:11 - 2017-05-25 02:17 - 000000000 ____D C:\Windows\Minidump
2018-04-28 17:34 - 2014-08-20 15:10 - 000113824 _____ C:\Users\Alexander Dochev\AppData\Local\GDIPFONTCACHEV1.DAT
2018-04-28 17:32 - 2009-07-14 07:45 - 000444872 _____ C:\Windows\system32\FNTCACHE.DAT
2018-04-28 13:58 - 2014-08-24 20:23 - 000000000 ____D C:\Users\Alexander Dochev\Downloads\Fable.III-SKIDROW
2018-04-26 20:19 - 2009-07-14 06:20 - 000000000 ____D C:\Windows\system32\NDF
2018-04-26 19:29 - 2015-02-08 10:30 - 000000000 ____D C:\Users\Alexander Dochev\Downloads\Android
2018-04-26 01:29 - 2016-04-23 19:38 - 000000000 ____D C:\Users\Alexander Dochev\AppData\Roaming\discord
2018-04-24 23:19 - 2014-08-21 09:25 - 000000000 ___RD C:\Games
2018-04-23 21:33 - 2016-11-03 01:46 - 000000000 ____D C:\Program Files (x86)\GOG Galaxy
2018-04-23 21:32 - 2009-07-14 08:13 - 000783606 _____ C:\Windows\system32\PerfStringBackup.INI
2018-04-23 21:32 - 2009-07-14 06:20 - 000000000 ____D C:\Windows\inf
2018-04-23 21:26 - 2014-08-20 21:27 - 000000000 ____D C:\Users\Alexander Dochev
2018-04-23 21:24 - 2016-11-15 16:29 - 000000000 ____D C:\Users\Alexander Dochev\AppData\Roaming\Battle.net
2018-04-23 21:24 - 2016-05-05 15:16 - 000000000 ____D C:\Users\Alexander Dochev\Documents\Overwatch
2018-04-23 21:24 - 2014-10-28 02:42 - 000000000 ____D C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform
2018-04-23 21:23 - 2017-05-20 01:19 - 000000000 ____D C:\Program Files\Microsoft Security Client
2018-04-23 21:23 - 2017-05-20 01:19 - 000000000 ____D C:\Program Files (x86)\Microsoft Security Client
2018-04-23 21:23 - 2009-07-14 06:20 - 000000000 ____D C:\Windows\registration
2018-04-23 21:22 - 2018-02-07 12:17 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com
2018-04-22 21:34 - 2014-12-27 05:56 - 000000000 ____D C:\Users\Alexander Dochev\AppData\Local\Deployment
2018-04-15 15:59 - 2009-07-14 06:20 - 000000000 ____D C:\Windows\rescache
2018-04-15 03:31 - 2015-04-16 13:37 - 000000000 ____D C:\Windows\system32\appraiser
2018-04-15 03:31 - 2009-07-14 06:20 - 000000000 ____D C:\Windows\PolicyDefinitions
2018-04-15 03:14 - 2014-08-20 14:42 - 000000000 ____D C:\Windows\system32\MRT
2018-04-15 03:12 - 2017-10-12 03:05 - 136971704 ____C (Microsoft Corporation) C:\Windows\system32\MRT-KB890830.exe
2018-04-15 03:11 - 2014-08-20 21:27 - 136971704 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2018-04-15 03:07 - 2016-12-01 15:33 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2018-04-15 03:06 - 2009-07-14 05:34 - 000000514 _____ C:\Windows\win.ini
2018-04-11 18:59 - 2014-09-07 13:05 - 000804864 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2018-04-11 18:59 - 2014-09-07 13:05 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2018-04-11 18:59 - 2014-09-07 13:05 - 000004312 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2018-04-11 18:59 - 2014-09-07 13:05 - 000000000 ____D C:\Windows\SysWOW64\Macromed
2018-04-11 18:59 - 2014-09-07 13:05 - 000000000 ____D C:\Windows\system32\Macromed
2018-04-01 02:57 - 2017-06-01 22:25 - 000000000 ____D C:\Users\Alexander Dochev\AppData\Roaming\RenPy
2018-04-01 02:57 - 2014-08-20 17:05 - 000000000 ____D C:\Users\Alexander Dochev\AppData\Local\NVIDIA
 
==================== Files in the root of some directories =======
 
2018-04-28 15:06 - 2018-03-13 17:17 - 000440512 _____ (COMODO) C:\ProgramData\cmdres.dll
2017-05-18 17:25 - 2017-05-18 17:25 - 000248822 _____ () C:\Users\Alexander Dochev\AppData\Local\ars.cache
2017-05-18 17:26 - 2017-05-18 17:26 - 000468434 _____ () C:\Users\Alexander Dochev\AppData\Local\census.cache
2017-05-18 16:45 - 2017-05-18 16:45 - 000000036 _____ () C:\Users\Alexander Dochev\AppData\Local\housecall.guid.cache
2014-08-20 21:53 - 2016-06-22 09:38 - 000007633 _____ () C:\Users\Alexander Dochev\AppData\Local\resmon.resmoncfg
2017-05-18 16:58 - 2017-05-18 16:58 - 000000010 _____ () C:\Users\Alexander Dochev\AppData\Local\sponge.last.runtime.cache
 
==================== Bamital & volsnap ======================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 
LastRegBack: 2018-04-28 11:40
 
==================== End of FRST.txt ============================


#6 nasdaq

nasdaq

  • Malware Response Team
  • 40,476 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:10:37 PM

Posted 29 April 2018 - 01:25 PM

--RogueKiller--
  • Download & SAVE to your Desktop Download RogueKiller
  • Quit all programs that you may have started.
  • Please disconnect any USB or external drives from the computer before you run this scan!
  • For Vista or above, right-click the program file and select "Run as Administrator"
  • Accept the user agreements.
  • Execute the scan and wait until it has finished.
  • If a Windows opens to explain what [PUM's] are, read about it.
  • Click the RoguKiller icon on your taksbar to return to the report.
  • Click open the Report
  • Click Export TXT button
  • Save the file as ReportRogue.txt
  • Click the Remove button to delete the items in RED
  • Click Finish and close the program.
  • Locate the ReportRogue.txt file on your Desktop and copy/paste the contents in your next.
=======

#7 GhostlierCrib

GhostlierCrib
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:37 AM

Posted 29 April 2018 - 02:47 PM

Hi, 

Rogue Killer found and deleted some stuff, however the problem persists for some reason. Here's the log:

 

 RogueKiller V12.12.14.0 (x64) [Apr 23 2018] (Free) by Adlice Software

 
Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Alexander Dochev [Administrator]
Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
Mode : Scan -- Date : 04/29/2018 21:54:22 (Duration : 00:30:58)
Switches : -refid
 
¤¤¤ Processes : 1 ¤¤¤
[Proc.Injected] explorer.exe(3008) -- C:\Windows\explorer.exe[7] -> Found
 
¤¤¤ Registry : 12 ¤¤¤
[PUM.SearchPage] (X64) HKEY_USERS\S-1-5-21-1505688330-694015033-755604794-1000\Software\Microsoft\Internet Explorer\Main | Search Bar : Preserve  -> Found
[PUM.SearchPage] (X86) HKEY_USERS\S-1-5-21-1505688330-694015033-755604794-1000\Software\Microsoft\Internet Explorer\Main | Search Bar : Preserve  -> Found
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 78.90.164.1 89.190.192.247 ([Bulgaria][Bulgaria])  -> Found
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters | DhcpNameServer : 78.90.164.1 89.190.192.247 ([Bulgaria][Bulgaria])  -> Found
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{31D1BEB9-070E-4F50-B144-1BEFCE9738C9} | DhcpNameServer : 78.90.164.1 89.190.192.247 ([Bulgaria][Bulgaria])  -> Found
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{59836918-9A32-4EA5-BFE1-5E0E6EC2146F} | DhcpNameServer : 78.90.164.1 89.190.192.247 ([Bulgaria][Bulgaria])  -> Found
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{31D1BEB9-070E-4F50-B144-1BEFCE9738C9} | DhcpNameServer : 78.90.164.1 89.190.192.247 ([Bulgaria][Bulgaria])  -> Found
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{59836918-9A32-4EA5-BFE1-5E0E6EC2146F} | DhcpNameServer : 78.90.164.1 89.190.192.247 ([Bulgaria][Bulgaria])  -> Found
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {A5EBE166-9287-4CFB-9757-BB93019264A6} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\ProgramData\Tiancity\NGM\NGM.exe|Name=Nexon Game Manager| [7] -> Found
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {DBB00472-B6BB-4026-8732-1D50922BC8C6} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\ProgramData\Tiancity\NGM\NGM.exe|Name=Nexon Game Manager| [7] -> Found
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {A5EBE166-9287-4CFB-9757-BB93019264A6} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\ProgramData\Tiancity\NGM\NGM.exe|Name=Nexon Game Manager| [7] -> Found
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {DBB00472-B6BB-4026-8732-1D50922BC8C6} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\ProgramData\Tiancity\NGM\NGM.exe|Name=Nexon Game Manager| [7] -> Found
 
¤¤¤ Tasks : 1 ¤¤¤
[Hj.Shortcut] \{E9CE28AE-1CD2-4564-A6A0-25CF548AE18C} -- "C:\Program Files\Internet Explorer\iexplore.exe" (https://ui.skype.com/ui/0/7.29.80.102/en/abandoninstall?page=tsProgressBar) -> Found
 
¤¤¤ Files : 3 ¤¤¤
[PUP.AutoIt.Gen][File] C:\Program Files\Shark007\Tools\Settings64.exe -> Found
[PUP.AutoIt.Gen][File] C:\Program Files (x86)\Shark007\Advanced\Tools\conflict.exe -> Found
[PUP.AutoIt.Gen][File] C:\Program Files (x86)\Shark007\Advanced\Tools\Settings32.exe -> Found
 
¤¤¤ WMI : 0 ¤¤¤
 
¤¤¤ Hosts File : 0 ¤¤¤
 
¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤
 
¤¤¤ Web browsers : 0 ¤¤¤
 
¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: HGST HTS541010A9E680 ATA Device +++++
--- User ---
[MBR] f6126e0d53caa68d7ad12ac70502fdd9
[BSP] 194e004730112d949cd8660a67335bda : Windows Vista/7/8 MBR Code
Partition table:
0 - [XXXXXX] FAT32 (0xb) [VISIBLE] Offset (sectors): 2048 | Size: 7983 MB
1 - [ACTIVE] FAT32-LBA (0xc) [VISIBLE] Offset (sectors): 16351232 | Size: 7985 MB
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 32704512 | Size: 937899 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK


#8 nasdaq

nasdaq

  • Malware Response Team
  • 40,476 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:10:37 PM

Posted 30 April 2018 - 08:17 AM

Hi,

Please run the RogueKiller program and fix everything.

This will reset all the Default settings.

Restart the computer when completed.

-------------

Press the Windows key + r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and and click the OK key.
Please copy the entire contents of the code box below to the a new file.
 
start

CreateRestorePoint:
CloseProcesses:

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
CHR HKU\S-1-5-21-1505688330-694015033-755604794-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [dhdgffkkebhmkfjojejmpbldmpobfkfo] - hxxp://clients2.google.com/service/update2/crx
R1 gtkrnl; C:\Windows\System32\drivers\gtkrnl.sys [126856 2018-03-29] ()
C:\Windows\System32\drivers\gtkrnl.sys

Reboot:


End
Save the file as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

Your version of Java is outdated and needs to be updated to take advantage of fixes that have eliminated security vulnerabilities.

You can manually check your present version and update as recommended. (You need to check with Internet Explorer) <- Important.
https://www.java.com/en/download/installed.jsp

Be careful not to install malware posing as Java update!
Important read this blog.
http://blog.trendmicro.com/trendlabs-security-intelligence/malware-poses-as-an-update-for-java-0-day-fix/

Quoted from the page.
"In light of the recent events surrounding Java, users must seriously consider their use of Java. Do they really need it? If yes, make sure that users follow the steps we recommended and get the security update directly from the official oracle website." at:
http://www.oracle.com/technetwork/java/javase/downloads/index.html

How to disable Java in your browsers
http://www.infoworld.com/t/web-browsers/how-disable-java-in-your-browsers-210882

If still present after these updates remove these old version(s) via the Control Panel > Programs > Programs and Features.
Java 8 Update 161 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180161F0}) (Version: 8.0.1610.12 - Oracle Corporation)
Java 8 Update 161 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180161F0}) (Version: 8.0.1610.12 - Oracle Corporation)
Java SE Development Kit 8 Update 77 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180770}) (Version: 8.0.770.3 - Oracle Corporation)

==============

SystemLook (32-Bit Version) or SystemLook (64-Bit Version)
  • Double-click SystemLook.exe/SystemLook_x64.exe
  • to run it.
  • Copy and paste the content of the following bold text into the main textfield:
  • :dir
    C:\Users\Alexander Dochev\AppData\Roaming\Browsers /s
    C:\Windows\SysWOW64\NV
    C:\Windows\system32\NV
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
  • Note: The log can also be found on your Desktop entitled SystemLook.txt.
  • ===

    While I check your logs please contact Comodo and see what they can suggest about this certificate error.

    I also have scanned my computer with Comodo along the other anti - malware and the Comodo internet security essentials detects an untrusted root certificate "GlobalSigns Root CA" when trying to connect to any website on any browser.


    Comodo may be corrupted. If you can reinstall it.


#9 GhostlierCrib

GhostlierCrib
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:37 AM

Posted 30 April 2018 - 12:28 PM

Hi again, 

Rogue Killer detected the same thing as last time, even though I removed it the first time around. Another thing I noticed is that even yesterday after you made me run Rogue Killer for the first time my computer started booting slower, not by much - couple of seconds, but its noticeable. As for comodo - I completely uninstalled it a few days ago, when I first used it. The following are the new Rogue Killer log, the Fix log and the System look log.

 

RogueKiller V12.12.15.0 (x64) [Apr 30 2018] (Free) by Adlice Software
 
Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Alexander Dochev [Administrator]
Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
Mode : Scan -- Date : 04/30/2018 18:58:01 (Duration : 00:33:22)
 
¤¤¤ Processes : 1 ¤¤¤
[Proc.Injected] explorer.exe(3128) -- C:\Windows\explorer.exe[7] -> Found
 
¤¤¤ Registry : 5 ¤¤¤
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 78.90.164.1 89.190.192.247 ([Bulgaria][Bulgaria])  -> Found
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters | DhcpNameServer : 78.90.164.1 89.190.192.247 ([Bulgaria][Bulgaria])  -> Found
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{59836918-9A32-4EA5-BFE1-5E0E6EC2146F} | DhcpNameServer : 78.90.164.1 89.190.192.247 ([Bulgaria][Bulgaria])  -> Found
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{31D1BEB9-070E-4F50-B144-1BEFCE9738C9} | DhcpNameServer : 78.90.164.1 89.190.192.247 ([Bulgaria][Bulgaria])  -> Found
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{59836918-9A32-4EA5-BFE1-5E0E6EC2146F} | DhcpNameServer : 78.90.164.1 89.190.192.247 ([Bulgaria][Bulgaria])  -> Found
 
¤¤¤ Tasks : 0 ¤¤¤
 
¤¤¤ Files : 0 ¤¤¤
 
¤¤¤ WMI : 0 ¤¤¤
 
¤¤¤ Hosts File : 0 ¤¤¤
 
¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤
 
¤¤¤ Web browsers : 0 ¤¤¤
 
¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: HGST HTS541010A9E680 ATA Device +++++
--- User ---
[MBR] f6126e0d53caa68d7ad12ac70502fdd9
[BSP] 194e004730112d949cd8660a67335bda : Windows Vista/7/8 MBR Code
Partition table:
0 - [XXXXXX] FAT32 (0xb) [VISIBLE] Offset (sectors): 2048 | Size: 7983 MB
1 - [ACTIVE] FAT32-LBA (0xc) [VISIBLE] Offset (sectors): 16351232 | Size: 7985 MB
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 32704512 | Size: 937899 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK
 
 
 
Fix result of Farbar Recovery Scan Tool (x64) Version: 25.04.2018
Ran by Alexander Dochev (30-04-2018 19:44:03) Run:4
Running from C:\Users\Alexander Dochev\Desktop
Loaded Profiles: Alexander Dochev (Available Profiles: Alexander Dochev)
Boot Mode: Normal
==============================================
 
fixlist content:
*****************
start
 
CreateRestorePoint:
CloseProcesses:
 
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
CHR HKU\S-1-5-21-1505688330-694015033-755604794-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [dhdgffkkebhmkfjojejmpbldmpobfkfo] - hxxp://clients2.google.com/service/update2/crx
R1 gtkrnl; C:\Windows\System32\drivers\gtkrnl.sys [126856 2018-03-29] ()
C:\Windows\System32\drivers\gtkrnl.sys
 
Reboot:
 
 
End
*****************
 
Restore point was successfully created.
Processes closed successfully.
"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" => removed successfully
"HKU\S-1-5-21-1505688330-694015033-755604794-1000\SOFTWARE\Google\Chrome\Extensions\dhdgffkkebhmkfjojejmpbldmpobfkfo" => removed successfully
gtkrnl => Unable to stop service.
"HKLM\System\CurrentControlSet\Services\gtkrnl" => removed successfully
gtkrnl => service removed successfully
C:\Windows\System32\drivers\gtkrnl.sys => moved successfully
 
 
The system needed a reboot.
 
==== End of Fixlog 19:45:01 ====
 
 
SystemLook 04.09.10 by jpshortstuff
Log created at 20:02 on 30/04/2018 by Alexander Dochev
Administrator - Elevation successful
 
========== dir ==========
 
C:\Users\Alexander Dochev\AppData\Roaming\Browsers - Unable to find folder.
 
C:\Windows\SysWOW64\NV - Parameters: "(none)"
 
---Files---
ig75icd32.dll --a---- 142816 bytes [23:59 28/03/2018] [16:12 25/03/2018]
nvumdshim.dll --a---- 419672 bytes [23:59 28/03/2018] [16:13 25/03/2018]
 
---Folders---
None found.
 
C:\Windows\system32\NV - Parameters: "(none)"
 
---Files---
ig75icd64.dll --a---- 165136 bytes [23:59 28/03/2018] [16:12 25/03/2018]
nvumdshimx.dll --a---- 505232 bytes [23:59 28/03/2018] [16:13 25/03/2018]
 
---Folders---
None found.
 
-= EOF =-


#10 nasdaq

nasdaq

  • Malware Response Team
  • 40,476 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:10:37 PM

Posted 30 April 2018 - 01:02 PM

Hi,

Please check with your Internet Provider if the IP addesses in bold are required for your services.

[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 78.90.164.1 89.190.192.247 ([Bulgaria][Bulgaria]) -> Found

Let me know.

Edited by nasdaq, 30 April 2018 - 01:04 PM.


#11 GhostlierCrib

GhostlierCrib
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:37 AM

Posted 30 April 2018 - 01:15 PM

The ISPs here are a joke. The person I talked with said that she doesn't really know, but I'm guessing that's the case because after removing it with Rogue Killer my internet connection completely stopped, until I restarted the computer. 



#12 nasdaq

nasdaq

  • Malware Response Team
  • 40,476 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:10:37 PM

Posted 01 May 2018 - 06:35 AM

Hi,

The person I talked with said that she doesn't really know, but I'm guessing that's the case because after removing it with Rogue Killer my internet connection completely stopped, until I restarted the computer.

Restarting the computer is sometime required to reset the Registry.

Is the computer running better now?

If not please run the RogueKiller and post a fresh log.

Also run the Farbar program and post a fresh FRST.txt log for my review.

#13 GhostlierCrib

GhostlierCrib
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:37 AM

Posted 01 May 2018 - 07:59 AM

Hey, 

Computer seems to still boot a bit slower than usual, but other than that everything else seems to be fine now. Thanks! I would still appreciate you taking a look at the logs, just in case. 

 

RogueKiller V12.12.15.0 (x64) [Apr 30 2018] (Free) by Adlice Software
 
Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Alexander Dochev [Administrator]
Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
Mode : Scan -- Date : 05/01/2018 14:58:32 (Duration : 00:36:42)
 
¤¤¤ Processes : 0 ¤¤¤
 
¤¤¤ Registry : 6 ¤¤¤
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 78.90.164.1 89.190.192.247 ([Bulgaria][Bulgaria])  -> Found
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters | DhcpNameServer : 78.90.164.1 89.190.192.247 ([Bulgaria][Bulgaria])  -> Found
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{31D1BEB9-070E-4F50-B144-1BEFCE9738C9} | DhcpNameServer : 78.90.164.1 89.190.192.247 ([Bulgaria][Bulgaria])  -> Found
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{59836918-9A32-4EA5-BFE1-5E0E6EC2146F} | DhcpNameServer : 78.90.164.1 89.190.192.247 ([Bulgaria][Bulgaria])  -> Found
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{31D1BEB9-070E-4F50-B144-1BEFCE9738C9} | DhcpNameServer : 78.90.164.1 89.190.192.247 ([Bulgaria][Bulgaria])  -> Found
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{59836918-9A32-4EA5-BFE1-5E0E6EC2146F} | DhcpNameServer : 78.90.164.1 89.190.192.247 ([Bulgaria][Bulgaria])  -> Found
 
¤¤¤ Tasks : 0 ¤¤¤
 
¤¤¤ Files : 0 ¤¤¤
 
¤¤¤ WMI : 0 ¤¤¤
 
¤¤¤ Hosts File : 0 ¤¤¤
 
¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤
 
¤¤¤ Web browsers : 0 ¤¤¤
 
¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: HGST HTS541010A9E680 ATA Device +++++
--- User ---
[MBR] f6126e0d53caa68d7ad12ac70502fdd9
[BSP] 194e004730112d949cd8660a67335bda : Windows Vista/7/8 MBR Code
Partition table:
0 - [XXXXXX] FAT32 (0xb) [VISIBLE] Offset (sectors): 2048 | Size: 7983 MB
1 - [ACTIVE] FAT32-LBA (0xc) [VISIBLE] Offset (sectors): 16351232 | Size: 7985 MB
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 32704512 | Size: 937899 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK
 
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 25.04.2018
Ran by Alexander Dochev (administrator) on MYPC (01-05-2018 15:36:11)
Running from C:\Users\Alexander Dochev\Desktop
Loaded Profiles: Alexander Dochev (Available Profiles: Alexander Dochev)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
() C:\ProgramData\VIVACOM 3G USB Modem\OnlineUpdate\ouc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Disc Soft Ltd) C:\Program Files (x86)\DAEMON Tools Ultra\DiscSoftBusService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Node.js) C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(HP Inc.) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
==================== Registry (Whitelisted) ===========================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7666392 2014-12-12] (Realtek Semiconductor)
HKLM\...\Run: [XboxStat] => C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-10-01] (Microsoft Corporation)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2818800 2014-06-17] (Synaptics Incorporated)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1353680 2016-11-14] (Microsoft Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [588704 2018-03-28] (Oracle Corporation)
HKU\S-1-5-21-1505688330-694015033-755604794-1000\...\Run: [GalaxyClient] => C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe [6448712 2018-04-23] (GOG.com)
HKU\S-1-5-21-1505688330-694015033-755604794-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3199776 2018-04-03] (Valve Corporation)
HKU\S-1-5-21-1505688330-694015033-755604794-1000\...\Run: [DAEMON Tools Ultra Agent] => C:\Program Files (x86)\DAEMON Tools Ultra\DTAgent.exe [3639568 2014-07-10] (Disc Soft Ltd)
HKU\S-1-5-21-1505688330-694015033-755604794-1000\...\Run: [Discord] => C:\Users\Alexander Dochev\AppData\Local\Discord\app-0.0.300\Discord.exe [57821176 2018-01-08] (Discord Inc.)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [182784 2018-03-25] (NVIDIA Corporation)
AppInit_DLLs:  C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [182784 2018-03-25] (NVIDIA Corporation)
AppInit_DLLs:  C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [182784 2018-03-25] (NVIDIA Corporation)
AppInit_DLLs:  C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [182784 2018-03-25] (NVIDIA Corporation)
AppInit_DLLs:  C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [182784 2018-03-25] (NVIDIA Corporation)
AppInit_DLLs:  C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [182784 2018-03-25] (NVIDIA Corporation)
AppInit_DLLs: ,C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [182784 2018-03-25] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [159704 2018-03-25] (NVIDIA Corporation)
Lsa: [Notification Packages] scecli C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
GroupPolicy: Restriction - Chrome <==== ATTENTION
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Tcpip\Parameters: [DhcpNameServer] 78.90.164.1 89.190.192.247
Tcpip\..\Interfaces\{187A61D7-4EE8-4CCB-AC90-AAB6E5A3987F}: [NameServer] 212.39.90.42 212.39.90.43
Tcpip\..\Interfaces\{31D1BEB9-070E-4F50-B144-1BEFCE9738C9}: [DhcpNameServer] 78.90.164.1 89.190.192.247
Tcpip\..\Interfaces\{59836918-9A32-4EA5-BFE1-5E0E6EC2146F}: [DhcpNameServer] 78.90.164.1 89.190.192.247
Tcpip\..\Interfaces\{67CE52F9-19DF-4B43-9DE2-189F201BF4C2}: [NameServer]  
Tcpip\..\Interfaces\{C8B800E2-3557-4B9B-97B2-F80F94928681}: [NameServer]  
 
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617911&ResetID=131413247638939178&GUID=3F0DDCEE-AD44-4446-9008-703275629452
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617911&ResetID=131413247638939178&GUID=3F0DDCEE-AD44-4446-9008-703275629452
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1505688330-694015033-755604794-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1505688330-694015033-755604794-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.co.uk/
SearchScopes: HKU\S-1-5-21-1505688330-694015033-755604794-1000 -> DefaultScope {1348A74C-C71D-415F-919A-6CA4703F72F2} URL = hxxps://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-1505688330-694015033-755604794-1000 -> {1348A74C-C71D-415F-919A-6CA4703F72F2} URL = hxxps://www.google.com/search?q={searchTerms}
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2018-02-15] (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2017-02-23] (Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2017-08-24] (Microsoft Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_171\bin\ssv.dll [2018-04-30] (Oracle Corporation)
BHO-x32: ArcPluginIEBHO Class -> {84BFE29A-8139-402a-B2A4-C23AE9E1A75F} -> C:\Program Files (x86)\Arc\Plugins\ArcPluginIE.dll [2017-08-31] (Perfect World Entertainment Inc)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2014-01-21] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2017-02-23] (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_171\bin\jp2ssv.dll [2018-04-30] (Oracle Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2017-08-15] (Microsoft Corporation)
 
FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2015-07-12] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2015-07-12] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.171.2 -> C:\Program Files (x86)\Java\jre1.8.0_171\bin\dtplugin\npDeployJava1.dll [2018-04-30] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.171.2 -> C:\Program Files (x86)\Java\jre1.8.0_171\bin\plugin2\npjp2.dll [2018-04-30] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-10-18] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-21] (Microsoft Corporation)
FF Plugin-x32: @perfectworld.com/npArcPlayNowPlugin -> C:\Program Files (x86)\Arc\Plugins\npArcPluginFF.dll [2017-08-31] (Perfect World Entertainment Inc)
FF Plugin-x32: @tiancity.com/NxGame -> C:\ProgramData\Tiancity\NGM\npNxGameCN.dll [2017-09-02] (Nexon)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-16] (Google Inc.)
 
Chrome: 
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> hxxp://www.google.co.uk/
CHR StartupUrls: Default -> "hxxps://www.google.co.uk/"
CHR Profile: C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default [2018-05-01]
CHR Extension: (YouTube) - C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-06-07]
CHR Extension: (Dark Reader) - C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default\Extensions\eimadpbcbfnmbkopoojfekhnkhdbieeh [2018-04-26]
CHR Extension: (Assassin's Creed III) - C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default\Extensions\geadmffjboclimmeiaimcafapjaefnfn [2018-04-29]
CHR Extension: (AdBlock) - C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2018-04-24]
CHR Extension: (Google Maps) - C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default\Extensions\lneaknkopdijkpnocmklfnjbeapigfbh [2017-06-07]
CHR Extension: (What are you a bleep bleep?(iDubbbzTV)) - C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfmdkhjclbbjlkgjiajngllhmanljklb [2017-06-07]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-04-04]
CHR Extension: (iDubbbzTv Memes!) - C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default\Extensions\oaakdddcpbpecmmeikbdbfiopeagmppd [2017-06-07]
CHR Extension: (IT'S TIME TO STOP!) - C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfcacfgohgdodgmahbjkbndbdkmfknlo [2017-09-27]
CHR Extension: (Chrome Media Router) - C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-04-24]
CHR Extension: (That's Pretty Good (iDubbbzTV)) - C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pnidecdngnainebcfbmebgpkmnmljdng [2017-06-28]
CHR Profile: C:\Users\Alexander Dochev\AppData\Local\Google\Chrome\User Data\System Profile [2018-04-29]
 
==================== Services (Whitelisted) ====================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
S3 ArcService; C:\Program Files (x86)\Arc\ArcService.exe [87064 2017-08-31] (Perfect World Entertainment Inc)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [7013384 2018-03-10] ()
R3 Disc Soft Bus Service; C:\Program Files (x86)\DAEMON Tools Ultra\DiscSoftBusService.exe [887056 2014-07-10] (Disc Soft Ltd)
S3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [383016 2017-08-14] (EasyAntiCheat Ltd)
S3 GalaxyClientService; C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe [665160 2018-04-23] (GOG.com)
S3 GalaxyCommunication; C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe [8109640 2018-04-23] (GOG.com)
U2 HiPatchService; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9728 2017-02-23] (Hi-Rez Studios) [File not signed]
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [332144 2017-11-21] (HP Inc.)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [355232 2015-08-09] (Intel Corporation)
R2 Intel® Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-28] (Intel® Corporation) [File not signed]
S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-28] (Intel® Corporation)
R2 Intel® ME Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [131544 2015-07-12] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [169432 2015-07-12] (Intel Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [119864 2016-11-14] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [361816 2016-11-14] (Microsoft Corporation)
R2 NvContainerLocalSystem; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [522688 2018-03-14] (NVIDIA Corporation)
S3 NvContainerNetworkService; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [522688 2018-03-14] (NVIDIA Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [292568 2014-12-12] (Realtek Semiconductor)
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [191728 2014-06-17] (Synaptics Incorporated)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5426448 2014-12-15] (TeamViewer GmbH)
S2 VIVACOM 3G USB Modem. RunOuc; C:\Program Files (x86)\VIVACOM 3G USB Modem\UpdateDog\ouc.exe [655712 2014-09-03] ()
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2014-02-13] (Microsoft Corporation)
R2 NVDisplay.ContainerLocalSystem; "C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe" -s NVDisplay.ContainerLocalSystem -f "C:\ProgramData\NVIDIA\NVDisplay.ContainerLocalSystem.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem" -r -p 30000
R2 NvTelemetryContainer; "C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe" -s NvTelemetryContainer -f "C:\ProgramData\NVIDIA\NvTelemetryContainer.log" -l 3 -d "C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\plugins" -r
 
===================== Drivers (Whitelisted) ======================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [172760 2013-10-02] (Broadcom Corporation.)
R3 dtscsibus; C:\Windows\System32\DRIVERS\dtscsibus.sys [29696 2014-08-20] (Disc Soft Ltd)
S3 EvolveVirtualAdapter; C:\Windows\System32\DRIVERS\evolve.sys [21656 2015-03-03] (Echobit, LLC)
S3 huawei_wwanecm; C:\Windows\System32\DRIVERS\ew_juwwanecm.sys [238080 2014-09-03] (Huawei Technologies Co., Ltd.)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-11-08] (Intel Corporation)
S3 INETMON; C:\Windows\System32\Drivers\INETMON.sys [29088 2013-08-14] ()
R3 ISCT; C:\Windows\System32\DRIVERS\ISCTD64.sys [46568 2013-01-19] ()
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [100312 2015-07-12] (Intel Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [295000 2016-08-25] (Microsoft Corporation)
R3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [135928 2016-08-25] (Microsoft Corporation)
S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [31168 2018-03-14] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [59240 2017-12-15] (NVIDIA Corporation)
R3 nvvhci; C:\Windows\System32\DRIVERS\nvvhci.sys [58680 2018-01-10] (NVIDIA Corporation)
R3 RTSPER; C:\Windows\System32\DRIVERS\RtsPer.sys [466136 2014-01-15] (Realsil Semiconductor Corporation)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [31472 2014-06-17] (Synaptics Incorporated)
S3 ssudobex; C:\Windows\System32\DRIVERS\ssudobex.sys [206080 2014-01-22] (DEVGURU Co., LTD.(www.devguru.co.kr))
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2018-05-01 15:36 - 2018-05-01 15:36 - 000021020 _____ C:\Users\Alexander Dochev\Desktop\FRST.txt
2018-05-01 15:35 - 2018-05-01 15:35 - 000004890 _____ C:\Users\Alexander Dochev\Desktop\RogueReport.txt
2018-05-01 02:35 - 2018-05-01 02:35 - 000000000 ____D C:\Program Files (x86)\Shark007
2018-05-01 02:27 - 2018-05-01 02:27 - 000000000 ____D C:\ProgramData\Reason
2018-04-30 18:57 - 2018-04-30 18:57 - 000000858 _____ C:\Users\Alexander Dochev\Desktop\RogueKiller.lnk
2018-04-30 18:57 - 2018-04-30 18:57 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller
2018-04-30 18:57 - 2018-04-30 18:57 - 000000000 ____D C:\Program Files\RogueKiller
2018-04-28 20:16 - 2018-05-01 15:36 - 000000000 ____D C:\Users\Alexander Dochev\Desktop\Help pls
2018-04-28 19:44 - 2018-04-28 19:44 - 002405888 _____ (Farbar) C:\Users\Alexander Dochev\Desktop\FRST64.exe
2018-04-28 18:14 - 2018-04-28 18:16 - 000224652 _____ C:\TDSSKiller.3.1.0.17_28.04.2018_18.14.05_log.txt
2018-04-28 17:23 - 2018-04-28 17:31 - 000000000 ____D C:\Program Files (x86)\DLL Suite
2018-04-28 15:27 - 2018-04-28 15:27 - 001700352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdiplus.dll
2018-04-28 15:27 - 2018-04-28 15:27 - 001060864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc71.dll
2018-04-28 15:06 - 2018-03-13 17:17 - 000440512 _____ (COMODO) C:\ProgramData\cmdres.dll
2018-04-28 14:05 - 2018-04-28 15:27 - 000000000 ____D C:\Users\Alexander Dochev\AppData\Local\Comodo
2018-04-28 13:42 - 2018-04-28 13:42 - 000000000 ____D C:\ProgramData\Emsisoft
2018-04-26 13:06 - 2018-04-26 13:06 - 000000000 ____D C:\Users\Alexander Dochev\AppData\Local\ESET
2018-04-26 12:48 - 2018-05-01 15:36 - 000000000 ____D C:\FRST
2018-04-22 19:48 - 2018-04-22 20:58 - 000000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2018-04-22 19:27 - 2018-04-22 19:48 - 000000000 ____D C:\ProgramData\Malwarebytes
2018-04-22 19:27 - 2018-04-22 19:27 - 000000000 ____D C:\Program Files\Malwarebytes
2018-04-22 14:12 - 2018-04-26 02:17 - 000000000 ____D C:\AdwCleaner
2018-04-22 11:52 - 2018-04-22 11:52 - 000000000 ____D C:\Users\Alexander Dochev\AppData\LocalLow\Moe Wars
2018-04-13 19:08 - 2018-03-31 05:09 - 005583040 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2018-04-13 19:08 - 2018-03-31 05:09 - 000708288 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2018-04-13 19:08 - 2018-03-31 05:09 - 000262336 _____ (Microsoft Corporation) C:\Windows\system32\hal.dll
2018-04-13 19:08 - 2018-03-31 05:09 - 000154816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2018-04-13 19:08 - 2018-03-31 05:09 - 000095424 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2018-04-13 19:08 - 2018-03-31 04:45 - 000631640 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2018-04-13 19:08 - 2018-03-31 04:39 - 004046528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2018-04-13 19:08 - 2018-03-31 04:39 - 003958464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2018-04-13 19:08 - 2018-03-31 04:38 - 001665336 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 001461248 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 001212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 001163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000731648 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000361984 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000094720 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000007168 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:12 - 001314064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 001114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000554496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000070144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 04:06 - 000148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2018-04-13 19:08 - 2018-03-31 04:06 - 000064512 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2018-04-13 19:08 - 2018-03-31 04:06 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2018-04-13 19:08 - 2018-03-31 04:06 - 000017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2018-04-13 19:08 - 2018-03-31 04:03 - 000338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2018-04-13 19:08 - 2018-03-31 04:02 - 000296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2018-04-13 19:08 - 2018-03-31 04:02 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\videoprt.sys
2018-04-13 19:08 - 2018-03-31 03:59 - 000160256 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2018-04-13 19:08 - 2018-03-31 03:58 - 000291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2018-04-13 19:08 - 2018-03-31 03:58 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2018-04-13 19:08 - 2018-03-31 03:58 - 000112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2018-04-13 19:08 - 2018-03-31 03:58 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2018-04-13 19:08 - 2018-03-31 03:51 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2018-04-13 19:08 - 2018-03-31 03:47 - 000036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2018-04-13 19:08 - 2018-03-31 03:47 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2018-04-13 19:08 - 2018-03-31 03:47 - 000014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2018-04-13 19:08 - 2018-03-31 03:47 - 000007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2018-04-13 19:08 - 2018-03-31 03:47 - 000006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 03:47 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 03:47 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 03:47 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2018-04-13 19:08 - 2018-03-31 03:47 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2018-04-13 19:08 - 2018-03-28 10:30 - 003225600 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2018-04-13 19:08 - 2018-03-23 21:50 - 000396952 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2018-04-13 19:08 - 2018-03-23 20:59 - 000348824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2018-04-13 19:08 - 2018-03-23 02:00 - 025742336 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2018-04-13 19:08 - 2018-03-23 00:32 - 002724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2018-04-13 19:08 - 2018-03-23 00:32 - 000004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2018-04-13 19:08 - 2018-03-23 00:26 - 020287488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2018-04-13 19:08 - 2018-03-23 00:19 - 002901504 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2018-04-13 19:08 - 2018-03-23 00:18 - 000066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2018-04-13 19:08 - 2018-03-23 00:17 - 000578048 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2018-04-13 19:08 - 2018-03-23 00:17 - 000417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2018-04-13 19:08 - 2018-03-23 00:17 - 000088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2018-04-13 19:08 - 2018-03-23 00:17 - 000048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2018-04-13 19:08 - 2018-03-23 00:15 - 005780480 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2018-04-13 19:08 - 2018-03-23 00:10 - 000054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2018-04-13 19:08 - 2018-03-23 00:09 - 000034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2018-04-13 19:08 - 2018-03-23 00:07 - 000615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2018-04-13 19:08 - 2018-03-23 00:06 - 000794112 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2018-04-13 19:08 - 2018-03-23 00:06 - 000144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2018-04-13 19:08 - 2018-03-23 00:06 - 000116224 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2018-04-13 19:08 - 2018-03-23 00:05 - 000814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2018-04-13 19:08 - 2018-03-23 00:04 - 002724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2018-04-13 19:08 - 2018-03-22 23:58 - 000969216 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2018-04-13 19:08 - 2018-03-22 23:55 - 000489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2018-04-13 19:08 - 2018-03-22 23:52 - 000499712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2018-04-13 19:08 - 2018-03-22 23:52 - 000062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2018-04-13 19:08 - 2018-03-22 23:51 - 000341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2018-04-13 19:08 - 2018-03-22 23:51 - 000047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2018-04-13 19:08 - 2018-03-22 23:50 - 000064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2018-04-13 19:08 - 2018-03-22 23:49 - 000077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2018-04-13 19:08 - 2018-03-22 23:48 - 002295296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2018-04-13 19:08 - 2018-03-22 23:48 - 000107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2018-04-13 19:08 - 2018-03-22 23:48 - 000087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2018-04-13 19:08 - 2018-03-22 23:45 - 000199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2018-04-13 19:08 - 2018-03-22 23:45 - 000047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2018-04-13 19:08 - 2018-03-22 23:45 - 000030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2018-04-13 19:08 - 2018-03-22 23:44 - 000092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2018-04-13 19:08 - 2018-03-22 23:43 - 000476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2018-04-13 19:08 - 2018-03-22 23:42 - 000661504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2018-04-13 19:08 - 2018-03-22 23:42 - 000315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2018-04-13 19:08 - 2018-03-22 23:42 - 000115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2018-04-13 19:08 - 2018-03-22 23:41 - 000620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2018-04-13 19:08 - 2018-03-22 23:40 - 000152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2018-04-13 19:08 - 2018-03-22 23:33 - 000416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2018-04-13 19:08 - 2018-03-22 23:31 - 000262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2018-04-13 19:08 - 2018-03-22 23:29 - 015282688 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2018-04-13 19:08 - 2018-03-22 23:29 - 000809472 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2018-04-13 19:08 - 2018-03-22 23:29 - 000728064 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2018-04-13 19:08 - 2018-03-22 23:29 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2018-04-13 19:08 - 2018-03-22 23:28 - 000091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2018-04-13 19:08 - 2018-03-22 23:28 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2018-04-13 19:08 - 2018-03-22 23:27 - 002135552 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2018-04-13 19:08 - 2018-03-22 23:27 - 001359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2018-04-13 19:08 - 2018-03-22 23:25 - 000168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2018-04-13 19:08 - 2018-03-22 23:25 - 000076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2018-04-13 19:08 - 2018-03-22 23:24 - 000279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2018-04-13 19:08 - 2018-03-22 23:22 - 000130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2018-04-13 19:08 - 2018-03-22 23:21 - 004496896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2018-04-13 19:08 - 2018-03-22 23:20 - 013680128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2018-04-13 19:08 - 2018-03-22 23:17 - 000230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2018-04-13 19:08 - 2018-03-22 23:15 - 003241472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2018-04-13 19:08 - 2018-03-22 23:15 - 000696320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2018-04-13 19:08 - 2018-03-22 23:14 - 002059776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2018-04-13 19:08 - 2018-03-22 23:14 - 001155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2018-04-13 19:08 - 2018-03-22 23:04 - 001545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2018-04-13 19:08 - 2018-03-22 22:55 - 002767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2018-04-13 19:08 - 2018-03-22 22:53 - 000800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2018-04-13 19:08 - 2018-03-22 22:52 - 001313792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2018-04-13 19:08 - 2018-03-22 22:51 - 000710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2018-04-13 19:08 - 2018-03-10 20:11 - 000340480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msexcl40.dll
2018-04-13 19:08 - 2018-03-09 21:18 - 000309440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2018-04-13 19:08 - 2018-03-09 21:12 - 000383680 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2018-04-13 19:08 - 2018-03-09 21:12 - 000111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\t2embed.dll
2018-04-13 19:08 - 2018-03-09 21:12 - 000071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2018-04-13 19:08 - 2018-03-09 21:12 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2018-04-13 19:08 - 2018-03-09 21:11 - 000010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2018-04-13 19:08 - 2018-03-09 21:07 - 000152064 _____ (Microsoft Corporation) C:\Windows\system32\t2embed.dll
2018-04-13 19:08 - 2018-03-09 21:07 - 000100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2018-04-13 19:08 - 2018-03-09 21:07 - 000041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2018-04-13 19:08 - 2018-03-09 21:06 - 000046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2018-04-13 19:08 - 2018-03-09 21:06 - 000014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2018-04-13 19:08 - 2018-03-09 20:31 - 000034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2018-04-13 19:08 - 2018-03-06 21:13 - 000148160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\basecsp.dll
2018-04-13 19:08 - 2018-03-06 21:11 - 000184320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scksp.dll
2018-04-13 19:08 - 2018-03-06 21:11 - 000052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wsnmp32.dll
2018-04-13 19:08 - 2018-03-06 21:10 - 000170176 _____ (Microsoft Corporation) C:\Windows\system32\basecsp.dll
2018-04-13 19:08 - 2018-03-06 21:07 - 000229376 _____ (Microsoft Corporation) C:\Windows\system32\scksp.dll
2018-04-13 19:08 - 2018-03-06 21:07 - 000067072 _____ (Microsoft Corporation) C:\Windows\system32\wsnmp32.dll
2018-04-13 19:08 - 2018-02-22 06:28 - 000217600 _____ (Microsoft Corporation) C:\Windows\system32\WinSCard.dll
2018-04-13 19:08 - 2018-02-22 06:06 - 000134656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinSCard.dll
2018-04-13 19:08 - 2018-02-10 21:35 - 000367296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msrpc.sys
2018-04-13 19:08 - 2018-02-10 21:35 - 000334528 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\acpi.sys
2018-04-13 19:08 - 2018-02-10 21:35 - 000185024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pci.sys
2018-04-13 19:08 - 2018-02-10 21:35 - 000122560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\NV_AGP.SYS
2018-04-13 19:08 - 2018-02-10 21:35 - 000068288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volmgr.sys
2018-04-13 19:08 - 2018-02-10 21:35 - 000064192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ULIAGPKX.SYS
2018-04-13 19:08 - 2018-02-10 21:35 - 000063168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\termdd.sys
2018-04-13 19:08 - 2018-02-10 21:35 - 000060608 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\AGP440.sys
2018-04-13 19:08 - 2018-02-10 21:35 - 000036032 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vdrvroot.sys
2018-04-13 19:08 - 2018-02-10 21:35 - 000031936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mssmbios.sys
2018-04-13 19:08 - 2018-02-10 21:35 - 000023744 _____ (Microsoft Corporation) C:\Windows\system32\streamci.dll
2018-04-13 19:08 - 2018-02-10 21:35 - 000020160 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\isapnp.sys
2018-04-13 19:08 - 2018-02-10 21:35 - 000015040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msisadrv.sys
2018-04-13 19:08 - 2018-02-10 21:35 - 000012096 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\swenum.sys
2018-04-13 19:08 - 2018-02-10 21:23 - 002292224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSVidCtl.dll
2018-04-13 19:08 - 2018-02-10 21:23 - 000330240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\zipfldr.dll
2018-04-13 19:08 - 2018-02-10 21:23 - 000111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\racpldlg.dll
2018-04-13 19:08 - 2018-02-10 21:11 - 003665920 _____ (Microsoft Corporation) C:\Windows\system32\MSVidCtl.dll
2018-04-13 19:08 - 2018-02-10 21:11 - 000369664 _____ (Microsoft Corporation) C:\Windows\system32\zipfldr.dll
2018-04-13 19:08 - 2018-02-10 21:11 - 000133120 _____ (Microsoft Corporation) C:\Windows\system32\msrahc.dll
2018-04-13 19:08 - 2018-02-10 21:11 - 000119296 _____ (Microsoft Corporation) C:\Windows\system32\racpldlg.dll
2018-04-13 19:08 - 2018-02-10 20:36 - 000108032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msra.exe
2018-04-13 19:08 - 2018-02-10 20:36 - 000040960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdchange.exe
2018-04-13 19:08 - 2018-02-10 20:36 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsraLegacy.tlb
2018-04-13 19:08 - 2018-02-10 20:26 - 000653312 _____ (Microsoft Corporation) C:\Windows\system32\msra.exe
2018-04-13 19:08 - 2018-02-10 20:26 - 000051712 _____ (Microsoft Corporation) C:\Windows\system32\sdchange.exe
2018-04-13 19:08 - 2018-02-10 20:25 - 000014336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wmiacpi.sys
2018-04-13 19:08 - 2018-02-10 20:25 - 000009728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\errdev.sys
2018-04-13 19:08 - 2018-02-10 20:25 - 000007168 _____ (Microsoft Corporation) C:\Windows\system32\MsraLegacy.tlb
2018-04-13 19:08 - 2018-02-02 21:40 - 000114368 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2018-04-13 19:08 - 2018-02-02 21:29 - 002365952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2018-04-13 19:08 - 2018-02-02 21:29 - 000337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2018-04-13 19:08 - 2018-02-02 21:29 - 000025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msimsg.dll
2018-04-13 19:08 - 2018-02-02 21:28 - 001806848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2018-04-13 19:08 - 2018-02-02 21:16 - 003246080 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2018-04-13 19:08 - 2018-02-02 21:16 - 000504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2018-04-13 19:08 - 2018-02-02 21:16 - 000025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2018-04-13 19:08 - 2018-02-02 21:14 - 001942016 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2018-04-13 19:08 - 2018-02-02 21:14 - 000070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2018-04-13 19:08 - 2018-02-02 20:46 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2018-04-13 19:08 - 2018-02-02 20:36 - 000128512 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2018-04-13 19:08 - 2018-01-25 17:05 - 000995272 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000063832 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000020824 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000019800 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000017752 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000017752 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000016216 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000015704 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000014168 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000014168 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000013656 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000012632 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000012632 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000012632 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000012120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000012120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000012120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000012120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000012120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000011608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000011608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000011608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:05 - 000011608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000922944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ucrtbase.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000066392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-private-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-math-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000019800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000017752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-string-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000017752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000016216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000015704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000014168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-time-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000014168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000013656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000012632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000012632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000012632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000012120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000012120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000012120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000012120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000012120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000011608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l2-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000011608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000011608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll
2018-04-13 19:08 - 2018-01-25 17:04 - 000011608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll
2018-04-13 19:08 - 2018-01-15 22:59 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2018-04-13 19:08 - 2018-01-15 22:40 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2018-04-13 19:08 - 2018-01-12 19:40 - 000407040 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2018-04-13 19:08 - 2018-01-12 19:26 - 000308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2018-04-11 19:22 - 2018-03-14 20:14 - 000135360 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2018-04-11 19:22 - 2018-03-14 20:09 - 000656384 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2018-04-11 19:22 - 2018-03-14 16:05 - 001993728 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2018-04-11 19:22 - 2018-03-14 16:05 - 001559552 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2018-04-11 19:22 - 2018-03-14 16:05 - 000739840 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2018-04-11 19:22 - 2018-03-14 16:05 - 000599552 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2018-04-11 19:22 - 2018-03-14 16:05 - 000450048 _____ (Microsoft Corporation) C:\Windows\system32\centel.dll
2018-04-11 19:22 - 2018-03-14 16:05 - 000414720 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2018-04-11 19:22 - 2018-03-14 16:05 - 000291840 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2018-04-11 19:22 - 2018-03-14 16:05 - 000237056 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2018-05-01 14:58 - 2017-05-19 21:20 - 000000000 ____D C:\Users\Alexander Dochev\Downloads\Fix my bleep bleep please
2018-05-01 14:58 - 2017-05-19 20:26 - 000028272 _____ C:\Windows\system32\Drivers\TrueSight.sys
2018-05-01 14:57 - 2016-11-15 16:30 - 000000000 ____D C:\Users\Alexander Dochev\AppData\Local\Battle.net
2018-05-01 14:57 - 2014-10-30 23:08 - 000000000 ____D C:\Program Files (x86)\Steam
2018-05-01 14:37 - 2009-07-14 07:45 - 000035664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2018-05-01 14:37 - 2009-07-14 07:45 - 000035664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2018-05-01 13:58 - 2017-08-22 12:55 - 000000000 ____D C:\Users\Alexander Dochev\Downloads\Ebay
2018-05-01 12:48 - 2014-08-20 16:55 - 000000000 ____D C:\ProgramData\NVIDIA
2018-05-01 04:09 - 2016-11-15 16:29 - 000000000 ____D C:\Program Files (x86)\Battle.net
2018-05-01 02:44 - 2016-07-01 23:00 - 000000000 ____D C:\Users\Alexander Dochev\Documents\Assassin's Creed Unity
2018-05-01 02:44 - 2014-08-20 15:09 - 000000000 __SHD C:\Users\Alexander Dochev\IntelGraphicsProfiles
2018-05-01 02:43 - 2017-03-12 21:12 - 000000000 ____D C:\Program Files (x86)\Hi-Rez Studios
2018-05-01 02:43 - 2016-04-19 14:15 - 000000147 _____ C:\HaxLogs.txt
2018-05-01 02:42 - 2009-07-14 08:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2018-05-01 02:37 - 2009-07-14 07:57 - 000001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2018-05-01 02:16 - 2014-09-12 23:24 - 000000000 ____D C:\Users\Alexander Dochev\AppData\Local\ElevatedDiagnostics
2018-04-30 19:57 - 2016-04-19 06:52 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit
2018-04-30 19:57 - 2016-04-19 06:50 - 000000000 ____D C:\Program Files\Java
2018-04-30 19:57 - 2015-06-03 06:32 - 000000000 ____D C:\Program Files (x86)\Java
2018-04-30 19:57 - 2014-10-22 09:44 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2018-04-30 19:56 - 2015-06-03 06:32 - 000098760 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2018-04-29 22:41 - 2014-08-21 09:25 - 000000000 ___RD C:\Games
2018-04-28 21:26 - 2014-11-28 21:45 - 000000000 ____D C:\Users\Alexander Dochev\AppData\LocalLow\Temp
2018-04-28 21:24 - 2014-10-26 21:12 - 000000000 ____D C:\Users\Alexander Dochev\AppData\Local\CrashDumps
2018-04-28 18:40 - 2017-05-19 12:32 - 000000000 ____D C:\Qoobox
2018-04-28 18:33 - 2017-05-19 12:32 - 000000000 ____D C:\Windows\erdnt
2018-04-28 18:33 - 2009-07-14 05:34 - 000000215 _____ C:\Windows\system.ini
2018-04-28 18:11 - 2017-05-25 02:17 - 000000000 ____D C:\Windows\Minidump
2018-04-28 17:34 - 2014-08-20 15:10 - 000113824 _____ C:\Users\Alexander Dochev\AppData\Local\GDIPFONTCACHEV1.DAT
2018-04-28 17:32 - 2009-07-14 07:45 - 000444872 _____ C:\Windows\system32\FNTCACHE.DAT
2018-04-28 13:58 - 2014-08-24 20:23 - 000000000 ____D C:\Users\Alexander Dochev\Downloads\Fable.III-SKIDROW
2018-04-26 20:19 - 2009-07-14 06:20 - 000000000 ____D C:\Windows\system32\NDF
2018-04-26 19:29 - 2015-02-08 10:30 - 000000000 ____D C:\Users\Alexander Dochev\Downloads\Android
2018-04-26 01:29 - 2016-04-23 19:38 - 000000000 ____D C:\Users\Alexander Dochev\AppData\Roaming\discord
2018-04-23 21:33 - 2016-11-03 01:46 - 000000000 ____D C:\Program Files (x86)\GOG Galaxy
2018-04-23 21:32 - 2009-07-14 08:13 - 000783606 _____ C:\Windows\system32\PerfStringBackup.INI
2018-04-23 21:32 - 2009-07-14 06:20 - 000000000 ____D C:\Windows\inf
2018-04-23 21:26 - 2014-08-20 21:27 - 000000000 ____D C:\Users\Alexander Dochev
2018-04-23 21:24 - 2016-11-15 16:29 - 000000000 ____D C:\Users\Alexander Dochev\AppData\Roaming\Battle.net
2018-04-23 21:24 - 2016-05-05 15:16 - 000000000 ____D C:\Users\Alexander Dochev\Documents\Overwatch
2018-04-23 21:24 - 2014-10-28 02:42 - 000000000 ____D C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform
2018-04-23 21:23 - 2017-05-20 01:19 - 000000000 ____D C:\Program Files\Microsoft Security Client
2018-04-23 21:23 - 2017-05-20 01:19 - 000000000 ____D C:\Program Files (x86)\Microsoft Security Client
2018-04-23 21:23 - 2009-07-14 06:20 - 000000000 ____D C:\Windows\registration
2018-04-23 21:22 - 2018-02-07 12:17 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com
2018-04-22 21:34 - 2014-12-27 05:56 - 000000000 ____D C:\Users\Alexander Dochev\AppData\Local\Deployment
2018-04-15 15:59 - 2009-07-14 06:20 - 000000000 ____D C:\Windows\rescache
2018-04-15 03:31 - 2015-04-16 13:37 - 000000000 ____D C:\Windows\system32\appraiser
2018-04-15 03:31 - 2009-07-14 06:20 - 000000000 ____D C:\Windows\PolicyDefinitions
2018-04-15 03:14 - 2014-08-20 14:42 - 000000000 ____D C:\Windows\system32\MRT
2018-04-15 03:12 - 2017-10-12 03:05 - 136971704 ____C (Microsoft Corporation) C:\Windows\system32\MRT-KB890830.exe
2018-04-15 03:11 - 2014-08-20 21:27 - 136971704 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2018-04-15 03:07 - 2016-12-01 15:33 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2018-04-15 03:06 - 2009-07-14 05:34 - 000000514 _____ C:\Windows\win.ini
2018-04-11 18:59 - 2014-09-07 13:05 - 000804864 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2018-04-11 18:59 - 2014-09-07 13:05 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2018-04-11 18:59 - 2014-09-07 13:05 - 000004312 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2018-04-11 18:59 - 2014-09-07 13:05 - 000000000 ____D C:\Windows\SysWOW64\Macromed
2018-04-11 18:59 - 2014-09-07 13:05 - 000000000 ____D C:\Windows\system32\Macromed
2018-04-01 02:57 - 2017-06-01 22:25 - 000000000 ____D C:\Users\Alexander Dochev\AppData\Roaming\RenPy
2018-04-01 02:57 - 2014-08-20 17:05 - 000000000 ____D C:\Users\Alexander Dochev\AppData\Local\NVIDIA
 
==================== Files in the root of some directories =======
 
2018-04-28 15:06 - 2018-03-13 17:17 - 000440512 _____ (COMODO) C:\ProgramData\cmdres.dll
2017-05-18 17:25 - 2017-05-18 17:25 - 000248822 _____ () C:\Users\Alexander Dochev\AppData\Local\ars.cache
2017-05-18 17:26 - 2017-05-18 17:26 - 000468434 _____ () C:\Users\Alexander Dochev\AppData\Local\census.cache
2017-05-18 16:45 - 2017-05-18 16:45 - 000000036 _____ () C:\Users\Alexander Dochev\AppData\Local\housecall.guid.cache
2014-08-20 21:53 - 2016-06-22 09:38 - 000007633 _____ () C:\Users\Alexander Dochev\AppData\Local\resmon.resmoncfg
2017-05-18 16:58 - 2017-05-18 16:58 - 000000010 _____ () C:\Users\Alexander Dochev\AppData\Local\sponge.last.runtime.cache
 
Some files in TEMP:
====================
2018-04-29 21:53 - 2018-03-31 04:38 - 001665336 _____ (Microsoft Corporation) C:\Users\Alexander Dochev\AppData\Local\Temp\dllnt_dump.dll
 
==================== Bamital & volsnap ======================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 
LastRegBack: 2018-04-28 11:40
 
==================== End of FRST.txt ============================


#14 nasdaq

nasdaq

  • Malware Response Team
  • 40,476 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:10:37 PM

Posted 01 May 2018 - 09:00 AM

Hi,

Hi,

Navigate to this site.

https://who.is/

In the top section you will ble given your I.P. Address

What is it?

#15 GhostlierCrib

GhostlierCrib
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:37 AM

Posted 01 May 2018 - 09:02 AM

Hi, 

 

Here's my IP:  -Removed so I don't get DDoSed or something-


Edited by GhostlierCrib, 01 May 2018 - 03:09 PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users