Премини към съдържанието

Филтри за търсене

Показани резултати за тагове 'ПРИКЛЮЧЕН'.

  • Търсене по таг

    Въведете тагове разделени със запетая
  • Търсене по автор

Търсене в


Форуми

  • Софтуер
    • Нови Програми
    • Търсене на Програми
    • Програми - Проблеми и Дискусии
    • Драйвери - Търсене, Проблеми, Линкове
    • Операционни системи
    • Сигурност и антивирусна защита
    • Игри
  • Хардуер
    • Общи хардуерни въпроси
    • Преносими компютри
    • Дънни платки
    • Запаметяващи устройства и памети
    • Монитори, Аудио и Видеокарти
    • Периферия
    • Овърклок и PC модинг
    • Нови конфигурации и части, въпроси, препоръки и мнения
  • Мобилни телефони, GSM, Мобилни приложения, Комуникации
    • Мобилни телефони - Въпроси, Проблеми, Софтуер
    • Съвети при избор на телефон
    • Мобилни Приложения (Apps)
    • Мобилни оператори, Мрежи, Промоции, Абонаменти, Услуги
    • Други теми относно мобилни телефони
  • Уеб дизайн, Графичен дизайн, Програмиране
    • Програмиране
    • Графичен Дизайн и Визуални изкуства
    • CMS, Форумни и Торент системи
    • Хостинг, Домейни, Уеб сървъри
    • SEO, Уеб оптимизация и стандарти
  • Битова Техника
    • Аудиотехника
    • Телевизори, Видео и Фото техника, Видео наблюдение
    • Климатици - проблеми, съвети, въпроси
    • Бойлери, Печки, Отопление
    • Друга битова техника
  • Интернет, Локални Мрежи и GPS Навигации
    • Интернет, WiFi, xDSL и Локална Мрежа
    • Биткойн и Криптовалути
    • Онлайн бизнес, AdSense, Affilate програми
    • Рутери, Модеми, Суичове
    • Facebook - проблеми, въпроси, вируси
    • Skype, VoIP - Интернет телефония
    • GPS, Навигационни системи - Въпроси, Карти, Проблеми
  • Изкуство
    • Музика
    • Кино и Телевизия
    • Поезия и Лично творчество
    • Изкуство - Изящно, Приложно и Сценично
    • Фотография и Фотографска техника
    • Литература, Книги (e-books, video trainings, tutorials & etc.)
  • Други
    • Статии и ревюта
    • Образование и обща култура
    • Религия, Мистика, Езотерика
    • История
    • Философия
    • Психология и Психотерапия
    • Новини от България и Света
    • Българите по света
    • Политика
    • Право и Юридически консултации
    • Здраве и Mедицина
    • Банки, Застраховане, Финанси, Кредити
    • Тийн Зона (Teen Zone)
    • Купувам / Продавам
    • Всичко останало
  • Хоби, Развлечение и Свободно време
  • За kaldata.com
  • Теми
  • Photoshop майнаци Теми
  • python3 data types
  • какви са ви любимите игри?? Темиигри за вас
  • супрески игри и рекорди Темиигри за вас

Блогове

Няма резултати

Няма резултати

Категории

  • Компютри
    • Компютърни конфигурации
    • Компютърни компоненти
    • Периферни устройства
    • Дънни платки
    • Мултимедия
    • Компютърни игри и софтуер
    • Администриране и интернет услуги
    • Компютърни аксесоари
    • Лаптопи и таблети
    • Видеокарти
    • Монитори
    • Процесори
    • Хард дискове и Памети
    • Други
  • Електроника
    • Телефони, GSM апарати
    • Аудио
    • Битова електроника
    • GPS и навигационни системи
    • Фотоапарати и обективи
    • TV и Видео
    • Други
  • Имоти
    • Гарсониери
    • Къщи и вили
    • Търговски площи
    • Гаражи
    • Апартаменти
    • Терени
    • Офиси
    • Други имоти в продажба
  • Авто-мото
    • Автомобили
    • Велосипеди
    • Лодки
    • Резервни части
    • Авто аксесоари
    • Мотоциклети
    • Скутери и ATV
    • Камиони и Автобуси
    • Авто сервизи и Rent-a-Car
    • Други
  • Работа
    • Работа в страната
    • Работа в чужбина
    • Стажове
    • Работа от вкъщи
    • Непълно работно време
  • Услуги
  • Строителство
  • Туризъм
  • Курсове и обучение
  • Домашни любимци
  • Други
  • супрески игри и рекорди Обяви
  • супрески игри и рекорди Обяви

Категории

  • Домашни любимци и Животни
  • Игри
  • Инциденти и Екстремни
  • Коли и превозни средства
  • Музика
    • Българска музика
    • Джаз
    • Електронна
    • Метъл и Рок
    • Народна и Фолклор
    • Поп и Диско
    • Поп-фолк
    • Рап и хип-хоп
    • Ритъм енд блус и соул
    • Друга
  • Новини и политика
  • Реклами
  • Смях и Развлечение
  • Спорт
  • Технологии, Компютри, Хардуер
  • ТВ Предавания и Шоу Програми
  • Хора и блогове
  • Филми и анимация
  • Други
  • Old School Hip-Hop and Electroo 80" Видео клипчета

Календари

  • Събития
  • Изложения
  • Семинари
  • Парти
  • Празници в България

Групи продукти

  • Банер Реклами

Търсене в...

Търси резултати които съдържат...


Дата

  • Начало

    Край


Последно обновяване

  • Начало

    Край


Филтриране по брой...

Регистрация

  • Начало

    Край


Група


Skype


Facebook


Google+


Twitter


ICQ


Yahoo


Интернет сайт


Град


Интереси

Открити 70 резултата

  1. Здравейте, Компютърът ми е заразен с вируса CTB-Locker. Прочетох информативно нещата - криптираха се всички свалени файлове, които имах до момента на компютъра! Свалих програмата Spy Hunter 4, която откри общо 4 "зарази". Отделно свалих и ESET NOD32 Antivirus 8, която откри още 14 заплахи - троянски кон. Нямам представа по-нататък как да действам. Някой може ли да ми окаже съдействие? Предварително благодаря!
  2. върнах системата от преди 5 дни, когато беше чиста но файловете останаха криптирани. https://www.kaldata.com/forums/topic/132819-%D1%81%D0%B8%D1%81%D1%82%D0%B5%D0%BC%D0%B0%D1%82%D0%B0-%D0%BC%D0%B8-%D0%B5-%D0%B8%D0%BD%D1%84%D0%B5%D0%BA%D1%82%D0%B8%D1%80%D0%B0%D0%BD%D0%B0-%D0%BA%D0%B0%D0%BA%D0%B2%D0%BE-%D0%B4%D0%B0-%D0%BF%D1%80%D0%B0%D0%B2%D1%8F-%D1%81%D0%B5%D0%B3%D0%B0/ прикачвам файловете от сканирането.. FRST.txt Addition.txt
  3. Здравейте, първо искам да се извиня , че отново пускам такава тема, но преди малко забелязах че на предната сте сложили таг "приключена", та се сетих че може би пък никой няма да я погледне, като е приключена. За това пукам нова. Съжалявам ако сте я прегледали отново и просто трябва да изчакам за отговора, изтрийте тази тема и да се прехвърлим в другата .. или вие ще кажете. Не знам .. Искам просто да разбера дали е хардуерен проблема или е вирус или някакъв софтуер. Прилагам файловете от Farbar Recovery scanner. FRST.txt Addition.txt
  4. Здравейте. От скоро имам проблем. Операционната система стартира бавно, програмите се отварят бавно, AIDA64 дори вече не отваря, а Speccy я чакам да анализира много време, а преди анализираше за секунди компонентите и температурите. В Task Manager-а ми пише че SSHD-то ми е натоварено на 99% Ето и логовете::: Additional scan result of Farbar Recovery Scan Tool (x64) Version:20-07-2015 Ran by Y510p at 2015-07-25 00:47:11 Running from C:\Users\Y510p\Downloads Boot Mode: Normal ========================================================== ==================== Accounts: ============================= Administrator (S-1-5-21-3436730813-759228368-3301738520-500 - Administrator - Disabled) Guest (S-1-5-21-3436730813-759228368-3301738520-501 - Limited - Disabled) UpdatusUser (S-1-5-21-3436730813-759228368-3301738520-1002 - Limited - Enabled) => C:\Users\UpdatusUser.lenovo Y510p (S-1-5-21-3436730813-759228368-3301738520-1001 - Administrator - Enabled) => C:\Users\Y510p ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) µTorrent (HKU\S-1-5-21-3436730813-759228368-3301738520-1001\...\uTorrent) (Version: 3.4.3.40760 - BitTorrent Inc.) Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.6.0.19140 - Adobe Systems Incorporated) Adobe Community Help (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.0.0.400 - Adobe Systems Incorporated) Adobe Flash Player 18 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 18.0.0.209 - Adobe Systems Incorporated) Adobe Media Player (HKLM-x32\...\com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.8 - Adobe Systems Incorporated) Adobe Photoshop CS5 (HKLM-x32\...\{15FEDA5F-141C-4127-8D7E-B962D1742728}) (Version: 12.0 - Adobe Systems Incorporated) AIDA64 Extreme v4.60 (HKLM-x32\...\AIDA64 Extreme_is1) (Version: 4.60 - FinalWire Ltd.) Anomaly Warzone Earth (HKLM-x32\...\Steam App 91200) (Version: - 11 bit studios) Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.3.2223 - AVAST Software) AVG PC TuneUp 2015 (en-US) (x32 Version: 15.0.1001.373 - AVG Technologies) Hidden AVG PC TuneUp 2015 (HKLM-x32\...\AVG PC TuneUp) (Version: 15.0.1001.373 - AVG Technologies) AVG PC TuneUp 2015 (x32 Version: 15.0.1001.373 - AVG Technologies) Hidden Batman Arkham Origins (HKLM-x32\...\QmF0bWFuQXJraGFtT3JpZ2lucw==_is1) (Version: 1 - ) Counter-Strike Global Offensive version 1.34.4.5 (HKLM\...\{BD051FE3-1575-4CD6-81ED-E905FA94720B}_is1) (Version: 1.34.4.5 - Strogino CS Portal) Crysis 3 (HKLM-x32\...\Q3J5c2lzMw==_is1) (Version: 1 - ) DAEMON Tools Lite (HKLM\...\DAEMON Tools Lite) (Version: 10.1.0.0074 - Disc Soft Ltd) Enclave (HKLM-x32\...\Steam App 253980) (Version: - Starbreeze) Energy Management (HKLM-x32\...\InstallShield_{D0956C11-0F60-43FE-99AD-524E833471BB}) (Version: 8.0.2.14 - Lenovo) Energy Management (x32 Version: 8.0.2.14 - Lenovo) Hidden Fraps (remove only) (HKLM-x32\...\Fraps) (Version: - ) Free Hide IP (HKLM-x32\...\FreeHideIP) (Version: 4.0.6.2 - ) GameMaker 8.1 (HKU\S-1-5-21-3436730813-759228368-3301738520-1001\...\GameMaker81) (Version: - ) Grand Theft Auto IV (HKLM-x32\...\{579BA58C-F33D-4970-9953-B94B43768AC3}) (Version: 1.00.0000 - Rockstar Games) Grand Theft Auto IV (x32 Version: 1.0.0013.131 - Rockstar Games Inc.) Hidden Intel® PROSet/Wireless Software (HKLM-x32\...\{72814a2c-2e03-4a50-b30a-43e7884b3934}) (Version: 16.5.1 - Intel Corporation) Java 8 Update 51 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418051F0}) (Version: 8.0.510 - Oracle Corporation) Knights and Merchants (HKLM-x32\...\Steam App 253900) (Version: - Topware Interactive) League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games) League of Legends (x32 Version: 3.0.1 - Riot Games) Hidden Lenovo EasyCamera (HKLM-x32\...\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.2.9200.10260 - Realtek Semiconductor Corp.) Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 8.0.0.2105 - CyberLink Corp.) Lenovo OneKey Recovery (Version: 8.0.0.2105 - CyberLink Corp.) Hidden Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation) Microsoft Games for Windows Marketplace (HKLM-x32\...\{67F42018-F647-4D3C-BE62-F8CB4FE2FCD5}) (Version: 3.5.67.0 - Microsoft Corporation) Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4569.1506 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation) Minecraft 1.7.9 (HKLM-x32\...\Minecraft 1.7.9) (Version: 1.7.9 - Mojang) Mozilla Firefox 39.0 (x86 bg) (HKLM-x32\...\Mozilla Firefox 39.0 (x86 bg)) (Version: 39.0 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 39.0 - Mozilla) Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.7.9.2 - Notepad++ Team) NVIDIA Graphics Driver 332.10 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 332.10 - NVIDIA Corporation) NVIDIA PhysX System Software 9.13.0927 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0927 - NVIDIA Corporation) NVIDIA Update 1.15.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.15.2 - NVIDIA Corporation) Outils de vérification linguistique 2013 de Microsoft Office - Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden PDF Settings CS5 (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden Qualcomm Atheros Inc.® AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.21 - Qualcomm Atheros Inc.) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7030 - Realtek Semiconductor Corp.) Skype™ 7.6 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.6.105 - Skype Technologies S.A.) Sniper Elite 3 (HKLM-x32\...\U25pcGVyRWxpdGUz_is1) (Version: 1 - ) Speccy (HKLM\...\Speccy) (Version: 1.28 - Piriform) StarCraft II: Heart of the Swarm © Blizzard Entertainment version 1 (HKLM-x32\...\U3RhckNyYWZ0IElJOiBIZWFydCBvZiB0aGUgU3dhcm0gKGMp~BFC02D25_is1) (Version: 1 - ) Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation) Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.10.12 - Synaptics Incorporated) The Amazing Spider Man 2 Bundle (HKLM-x32\...\The Amazing Spider Man 2 Bundle_is1) (Version: - ) The Amazing Spider-Man (HKLM-x32\...\ASM_Laguna_is1) (Version: - ) TrackerPro 1.0 (HKLM-x32\...\TrackerPro) (Version: 1.0 - Evisoft) VMware Workstation (HKLM-x32\...\VMware_Workstation) (Version: 9.0.2 - VMware, Inc) VMware Workstation (Version: 9.0.2 - VMware, Inc.) Hidden Windows Driver Package - Lenovo (ACPIVPC) System (02/17/2013 9.52.0.776) (HKLM\...\35DD26BE48DAF4A9F35F969F3CB1E3E1435E661E) (Version: 02/17/2013 9.52.0.776 - Lenovo) Windows Driver Package - Lenovo (WUDFRd) LenovoVhid (07/25/2013 10.30.0.288) (HKLM\...\6BCA401E9CBEED970D75F55FA5320F60D11984E9) (Version: 07/25/2013 10.30.0.288 - Lenovo) WinRAR 5.21 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.21.0 - win.rar GmbH) World of Tanks (HKU\S-1-5-21-3436730813-759228368-3301738520-1001\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C812eu}_is1) (Version: - Wargaming.net) ==================== Custom CLSID (Whitelisted): ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== Restore Points ========================= 18-07-2015 10:50:13 Installed Lenovo EasyCamera 20-07-2015 11:31:29 Windows Modules Installer 21-07-2015 14:25:08 Installed DirectX 22-07-2015 18:40:09 Installed DirectX 23-07-2015 22:50:01 Installed DirectX 25-07-2015 00:30:57 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 ==================== Hosts content: =============================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2013-08-22 06:25 - 2015-07-18 23:06 - 00000852 ____A C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 activate.adobe.com ==================== Scheduled Tasks (Whitelisted) ============= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) Task: {1B128BF9-EF9B-4BC9-89DA-B1083AE5F31E} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation) Task: {27798C5C-A12A-4F3B-B73A-A3093992356A} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation) Task: {34ED3CCB-EB46-4E78-9056-D06462F5BEF1} - System32\Tasks\AdobeAAMUpdater-1.0-lenovo-Y510p => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2011-03-15] (Adobe Systems Incorporated) Task: {756595A3-0295-4977-B8A4-8FDBF4E4AF39} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-07-18] (AVAST Software) Task: {7AF53989-98F4-4F51-86E0-B1EFFEC4A324} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => E:\AVG TuneUP\OneClick.exe [2015-01-30] (AVG Technologies) Task: {80E875CE-D4F8-4500-840B-DC6A8481E96B} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation) Task: {D03CB292-7189-4F30-84FF-41BC8ED741B5} - System32\Tasks\Java Platform SE Auto Updater => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2015-06-08] (Oracle Corporation) Task: {DC0ADC74-8A1D-41E1-BF80-6D7E48661F3C} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-07-03] (Microsoft Corporation) Task: {E3D7984F-49F4-4F9E-8850-F3F5D238FED5} - System32\Tasks\AutoKMS => C:\Windows\AutoKMS\AutoKMS.exe [2015-07-18] () Task: {F1D438D0-8351-4BD3-8437-4F33A0A1CA5D} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2013-09-17] (Synaptics Incorporated) (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) ==================== Loaded Modules (Whitelisted) ============== 2015-01-30 17:23 - 2015-01-30 17:23 - 00712504 _____ () E:\AVG TuneUP\avgrepliba.dll 2015-07-18 12:11 - 2013-12-12 17:21 - 00117536 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll 2015-01-30 17:23 - 2015-01-30 17:23 - 00855864 _____ () E:\AVG TuneUP\tulnga.dll 2014-05-14 08:15 - 2014-05-14 08:15 - 08890536 _____ () C:\Program Files\Microsoft Office\Office15\1033\GrooveIntlResource.dll 2005-09-19 07:30 - 2005-09-19 07:30 - 01629696 _____ () C:\Program Files (x86)\Evisoft\TrackerPro\encreasebt.exe 2015-07-18 13:08 - 2015-07-18 13:08 - 00102864 _____ () C:\Program Files\AVAST Software\Avast\log.dll 2015-07-18 13:08 - 2015-07-18 13:08 - 00123976 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll 2015-07-23 13:33 - 2015-07-23 13:33 - 02957312 _____ () C:\Program Files\AVAST Software\Avast\defs\15072300\algo.dll 2015-07-23 21:43 - 2015-07-23 21:43 - 02957312 _____ () C:\Program Files\AVAST Software\Avast\defs\15072301\algo.dll 2015-07-25 00:27 - 2015-07-25 00:27 - 02960384 _____ () C:\Program Files\AVAST Software\Avast\defs\15072402\algo.dll 2013-02-26 02:28 - 2013-02-26 02:28 - 01260624 _____ () C:\Program Files (x86)\VMware\VMware Workstation\libxml2.dll 2015-07-18 13:08 - 2015-07-18 13:08 - 40540672 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll 2014-05-14 08:15 - 2014-05-14 08:15 - 08890536 _____ () C:\Program Files (x86)\Microsoft Office\Office15\1033\GrooveIntlResource.dll 2015-07-18 13:08 - 2015-07-18 13:08 - 00985600 _____ () C:\Program Files\AVAST Software\Avast\ffmpegsumo.dll 2015-02-14 17:40 - 2015-02-14 17:40 - 00381440 _____ () C:\Windows\mod_frst.exe ==================== Alternate Data Streams (Whitelisted) ========= (If an entry is included in the fixlist, only the ADS will be removed.) ==================== Safe Mode (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== EXE Association (Whitelisted) =============== (If an entry is included in the fixlist, the registry item will be restored to default or removed.) ==================== Internet Explorer trusted/restricted =============== (If an entry is included in the fixlist, it will be removed from the registry.) ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-3436730813-759228368-3301738520-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Y510p\Desktop\Batman-Arkham-Origins-screenshot-rero-7.jpg DNS Servers: 192.168.0.1 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) Windows Firewall is enabled. ==================== MSCONFIG/TASK MANAGER disabled items == (Currently there is no automatic fix for this section.) HKLM\...\StartupApproved\Run: => "AdobeAAMUpdater-1.0" HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched" HKLM\...\StartupApproved\Run32: => "SwitchBoard" HKLM\...\StartupApproved\Run32: => "AdobeCS5ServiceManager" HKLM\...\StartupApproved\Run32: => "vmware-tray.exe" HKU\S-1-5-21-3436730813-759228368-3301738520-1001\...\StartupApproved\Run: => "Skype" HKU\S-1-5-21-3436730813-759228368-3301738520-1001\...\StartupApproved\Run: => "DAEMON Tools Lite Automount" HKU\S-1-5-21-3436730813-759228368-3301738520-1001\...\StartupApproved\Run: => "RGSC" HKU\S-1-5-21-3436730813-759228368-3301738520-1001\...\StartupApproved\Run: => "Steam" ==================== FirewallRules (Whitelisted) =============== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139 FirewallRules: [sPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppextcomobj.exe FirewallRules: [sPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppextcomobj.exe FirewallRules: [{2E272693-9D00-4082-9E94-8D3CD55FE799}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe FirewallRules: [{64F83FDE-AB7C-48FB-B073-E12708C7F9FE}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe FirewallRules: [{54D360AE-EA59-46A9-B309-660E594FC077}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe FirewallRules: [TCP Query User{BB9045C8-272D-46A4-8435-0E7FB3FA79F0}C:\users\y510p\appdata\local\microsoft\windows\inetcache\ie\2wvm1gca\utorrent_rc3.4build30553.exe] => (Allow) C:\users\y510p\appdata\local\microsoft\windows\inetcache\ie\2wvm1gca\utorrent_rc3.4build30553.exe FirewallRules: [uDP Query User{9C91F867-B587-4B56-9477-33DE31CD62A7}C:\users\y510p\appdata\local\microsoft\windows\inetcache\ie\2wvm1gca\utorrent_rc3.4build30553.exe] => (Allow) C:\users\y510p\appdata\local\microsoft\windows\inetcache\ie\2wvm1gca\utorrent_rc3.4build30553.exe FirewallRules: [TCP Query User{354C7FBC-BBE0-413F-A266-CD6441DEACCD}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe FirewallRules: [uDP Query User{CB79E1D2-43BB-4294-B4F3-3F62F27FF55B}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe FirewallRules: [{04EE9326-34E6-4989-9148-B9825CB88E46}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{09D904CD-5B5E-4E6D-8802-50BB93EA59E0}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{FDB71CFA-67DD-4A83-9305-96339E53DBC6}] => (Allow) C:\Users\Y510p\AppData\Roaming\uTorrent\uTorrent.exe FirewallRules: [{C42B04B6-1327-4B7F-BFAB-6E7E01E534B3}] => (Allow) C:\Users\Y510p\AppData\Roaming\uTorrent\uTorrent.exe FirewallRules: [{0AFCE07B-A858-4873-AD41-7E51F1815993}] => (Allow) C:\Users\Y510p\AppData\Roaming\uTorrent\uTorrent.exe FirewallRules: [{2E87AF37-CA38-4E1D-9ABB-5FC4D10B833C}] => (Allow) C:\Users\Y510p\AppData\Roaming\uTorrent\uTorrent.exe FirewallRules: [{FF4AB0F1-D3DC-4E77-A5C1-23F6FEC24F93}] => (Allow) C:\Users\Y510p\AppData\Roaming\uTorrent\uTorrent.exe FirewallRules: [{4BC87ACC-319D-4BCD-99CA-26DF59D80853}] => (Allow) C:\Users\Y510p\AppData\Roaming\uTorrent\uTorrent.exe FirewallRules: [TCP Query User{C668F68E-0ED0-4459-ABAA-719CD4287930}E:\counter-strike global offensive\csgo.exe] => (Block) E:\counter-strike global offensive\csgo.exe FirewallRules: [uDP Query User{51560BA6-9403-40D9-8CB0-D21A0E3A4A57}E:\counter-strike global offensive\csgo.exe] => (Block) E:\counter-strike global offensive\csgo.exe FirewallRules: [TCP Query User{4161D17A-D374-4BCF-972C-5871C6D818CF}C:\program files\java\jre1.8.0_51\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_51\bin\javaw.exe FirewallRules: [uDP Query User{CF68349F-CD83-4251-BFEB-9C14E3AA6503}C:\program files\java\jre1.8.0_51\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_51\bin\javaw.exe FirewallRules: [TCP Query User{F8FC2B40-0E9B-4169-A337-0D9C3F9114A2}E:\counter-strike 1.6\hl.exe] => (Allow) E:\counter-strike 1.6\hl.exe FirewallRules: [uDP Query User{98B4C198-AFFA-4719-90DF-53ECCE40BDBF}E:\counter-strike 1.6\hl.exe] => (Allow) E:\counter-strike 1.6\hl.exe FirewallRules: [{0D2C452F-4CD5-4096-AE39-29B72FD89A53}] => (Allow) E:\Grand Theft Auto IV\Grand Theft Auto IV\LaunchGTAIV.exe FirewallRules: [{B60AE6EE-15D7-4DA6-9E42-15DD1A29D61C}] => (Allow) E:\Grand Theft Auto IV\Grand Theft Auto IV\LaunchGTAIV.exe FirewallRules: [TCP Query User{702A1E8E-FDD8-4198-9478-7F643874D2A3}E:\grand theft auto iv\grand theft auto iv\gtaiv.exe] => (Allow) E:\grand theft auto iv\grand theft auto iv\gtaiv.exe FirewallRules: [uDP Query User{97F68879-3B54-490F-B998-72D6B4F9248E}E:\grand theft auto iv\grand theft auto iv\gtaiv.exe] => (Allow) E:\grand theft auto iv\grand theft auto iv\gtaiv.exe FirewallRules: [TCP Query User{BAB9EFC8-71BE-481E-A50C-CE2ACB1DF086}E:\world_of_tanks\wotlauncher.exe] => (Allow) E:\world_of_tanks\wotlauncher.exe FirewallRules: [uDP Query User{F732AA84-953D-4B51-9A15-EF9B18605472}E:\world_of_tanks\wotlauncher.exe] => (Allow) E:\world_of_tanks\wotlauncher.exe FirewallRules: [TCP Query User{5BEA42E2-8842-4286-9487-E4D57B389235}E:\world_of_tanks\worldoftanks.exe] => (Allow) E:\world_of_tanks\worldoftanks.exe FirewallRules: [uDP Query User{4980AEE3-4D56-40D8-9D6C-5B640CCC2CE4}E:\world_of_tanks\worldoftanks.exe] => (Allow) E:\world_of_tanks\worldoftanks.exe FirewallRules: [{E40800B5-C3FB-40E6-9B00-37AE09EC108E}] => (Block) E:\StarCraft II\Versions\Base24944\SC2.exe FirewallRules: [{CB9A79AB-0622-4DE8-9374-222F590299EA}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe FirewallRules: [{321CA1B1-C901-4C03-B065-33C95F0FBAE3}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe FirewallRules: [{B31FB705-2765-4503-AB8E-750D7E58307B}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe FirewallRules: [{16754680-BA82-4C53-81F9-F906583C9386}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe FirewallRules: [{7B19D829-866C-41DA-B176-287033114BE1}] => (Allow) C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe FirewallRules: [{1B5B5FCB-9AB6-4B36-A835-F4607B7C6E83}] => (Allow) C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe FirewallRules: [{BA77A4A3-71C1-4478-B423-FF715C80010D}] => (Allow) C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe FirewallRules: [{A2DA2EB4-CA30-4347-A6C5-F2468E658B0E}] => (Allow) C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe FirewallRules: [{07F55A63-C510-404D-AF41-62A63F90432C}] => (Allow) E:\Steam\Steam.exe FirewallRules: [{43B88AE8-6F20-4D07-8B91-ECF3AA52B1BF}] => (Allow) E:\Steam\Steam.exe FirewallRules: [{95951F08-3136-49B9-8B3D-11370D7D28AD}] => (Allow) E:\Steam\bin\steamwebhelper.exe FirewallRules: [{B7D2D44F-D21F-47E2-9717-FF9F2CCCFC35}] => (Allow) E:\Steam\bin\steamwebhelper.exe FirewallRules: [{2F5875D8-C9C4-49B2-8A6D-80D64123F702}] => (Allow) E:\Steam\steamapps\common\Enclave\Enclave.exe FirewallRules: [{9ACB7A63-9485-4194-959A-BE1995A63FC9}] => (Allow) E:\Steam\steamapps\common\Enclave\Enclave.exe FirewallRules: [{C872565E-5905-47D1-BB4E-6D9033609DC4}] => (Allow) E:\Steam\steamapps\common\Anomaly Warzone Earth\AnomalyWarzoneEarth.exe FirewallRules: [{76BCE8EB-20BA-4030-99AF-EC85CC7ED9EA}] => (Allow) E:\Steam\steamapps\common\Anomaly Warzone Earth\AnomalyWarzoneEarth.exe FirewallRules: [{22C490D3-2612-4682-8C8B-4C5AEEEF57E0}] => (Allow) E:\Steam\steamapps\common\Knights and Merchants Historical Version\KM_TPR.exe FirewallRules: [{09E66D89-C5CF-488B-A8A2-BB0973304015}] => (Allow) E:\Steam\steamapps\common\Knights and Merchants Historical Version\KM_TPR.exe FirewallRules: [{3472A815-866E-4A85-ACCE-D030CF973BE0}] => (Allow) E:\Steam\steamapps\common\Knights and Merchants Historical Version\hd\Knights_and_Merchants_steam.exe FirewallRules: [{0464D2BC-3D80-44CD-97AC-81BB5BDE0BCF}] => (Allow) E:\Steam\steamapps\common\Knights and Merchants Historical Version\hd\Knights_and_Merchants_steam.exe ==================== Faulty Device Manager Devices ============= Name: PCI Simple Communications Controller Description: PCI Simple Communications Controller Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. ==================== Event log errors: ========================= Application errors: ================== Error: (07/25/2015 12:38:18 AM) (Source: Application Hang) (EventID: 1002) (User: ) Description: The program Integrator.exe version 15.0.1001.373 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel. Process ID: 1d70 Start Time: 01d0c6ac86759ecc Termination Time: 6 Application Path: E:\AVG TuneUP\Integrator.exe Report Id: 186b84cf-32a0-11e5-825e-00c2c66f1aa7 Faulting package full name: Faulting package-relative application ID: Error: (07/25/2015 12:31:16 AM) (Source: Application Hang) (EventID: 1002) (User: ) Description: The program SeaToolsforWindowsSetup.exe version 0.0.0.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel. Process ID: 11d4 Start Time: 01d0c6abbac94277 Termination Time: 4294967295 Application Path: C:\Users\Y510p\Downloads\SeaToolsforWindowsSetup.exe Report Id: 219a8a23-329f-11e5-825e-00c2c66f1aa7 Faulting package full name: Faulting package-relative application ID: Error: (07/25/2015 12:29:31 AM) (Source: Application Hang) (EventID: 1002) (User: ) Description: The program SeaToolsforWindowsSetup.exe version 0.0.0.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel. Process ID: 1dd8 Start Time: 01d0c6aa1b1c0289 Termination Time: 4294967295 Application Path: C:\Users\Y510p\Downloads\SeaToolsforWindowsSetup.exe Report Id: e332f57e-329e-11e5-825e-00c2c66f1aa7 Faulting package full name: Faulting package-relative application ID: Error: (07/23/2015 11:04:38 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: AnomalyWarzoneEarth.exe, version: 0.0.0.0, time stamp: 0x4ed893c2 Faulting module name: AnomalyWarzoneEarth.exe, version: 0.0.0.0, time stamp: 0x4ed893c2 Exception code: 0xc0000005 Fault offset: 0x00019b4d Faulting process id: 0x1e2c Faulting application start time: 0xAnomalyWarzoneEarth.exe0 Faulting application path: AnomalyWarzoneEarth.exe1 Faulting module path: AnomalyWarzoneEarth.exe2 Report Id: AnomalyWarzoneEarth.exe3 Faulting package full name: AnomalyWarzoneEarth.exe4 Faulting package-relative application ID: AnomalyWarzoneEarth.exe5 Error: (07/23/2015 09:44:22 PM) (Source: Microsoft-Windows-WMI) (EventID: 24) (User: NT AUTHORITY) Description: Event provider ProtectionManagement attempted to register query "select * from MSFT_MpEvent" whose target class "MSFT_MpEvent" in //./root/microsoft/protectionManagement namespace does not exist. The query will be ignored. Error: (07/23/2015 09:44:22 PM) (Source: Microsoft-Windows-WMI) (EventID: 24) (User: NT AUTHORITY) Description: Event provider attempted to register query "select * from MSFT_MpEvent" whose target class "MSFT_MpEvent" in //./root/microsoft/protectionManagement namespace does not exist. The query will be ignored. Error: (07/23/2015 09:43:34 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: ZeroConfigService.exe, version: 16.5.0.0, time stamp: 0x52179ea0 Faulting module name: MurocApi.dll, version: 16.5.0.0, time stamp: 0x52179d03 Exception code: 0xc0000005 Fault offset: 0x000000000002bcd8 Faulting process id: 0x864 Faulting application start time: 0xZeroConfigService.exe0 Faulting application path: ZeroConfigService.exe1 Faulting module path: ZeroConfigService.exe2 Report Id: ZeroConfigService.exe3 Faulting package full name: ZeroConfigService.exe4 Faulting package-relative application ID: ZeroConfigService.exe5 Error: (07/23/2015 05:31:18 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: Fulcrum.exe, version: 1.0.0.0, time stamp: 0x546e6b9c Faulting module name: clr.dll, version: 4.0.30319.34014, time stamp: 0x52e0b784 Exception code: 0xc00000fd Fault offset: 0x000578d9 Faulting process id: 0x1eac Faulting application start time: 0xFulcrum.exe0 Faulting application path: Fulcrum.exe1 Faulting module path: Fulcrum.exe2 Report Id: Fulcrum.exe3 Faulting package full name: Fulcrum.exe4 Faulting package-relative application ID: Fulcrum.exe5 Error: (07/23/2015 05:30:48 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: Fulcrum.exe, version: 1.0.0.0, time stamp: 0x546e6b9c Faulting module name: KERNEL32.dll, version: 6.3.9600.17056, time stamp: 0x532a2e6c Exception code: 0xc00000fd Fault offset: 0x00010818 Faulting process id: 0xe78 Faulting application start time: 0xFulcrum.exe0 Faulting application path: Fulcrum.exe1 Faulting module path: Fulcrum.exe2 Report Id: Fulcrum.exe3 Faulting package full name: Fulcrum.exe4 Faulting package-relative application ID: Fulcrum.exe5 Error: (07/23/2015 05:30:28 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: Fulcrum.exe, version: 1.0.0.0, time stamp: 0x546e6b9c Faulting module name: clr.dll, version: 4.0.30319.34014, time stamp: 0x52e0b784 Exception code: 0xc00000fd Fault offset: 0x000578d9 Faulting process id: 0xd0c Faulting application start time: 0xFulcrum.exe0 Faulting application path: Fulcrum.exe1 Faulting module path: Fulcrum.exe2 Report Id: Fulcrum.exe3 Faulting package full name: Fulcrum.exe4 Faulting package-relative application ID: Fulcrum.exe5 System errors: ============= Error: (07/25/2015 12:47:12 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The Application Experience service failed to start due to the following error: %%1053 Error: (07/25/2015 12:46:57 AM) (Source: DCOM) (EventID: 10029) (User: lenovo) Description: {9B1F122C-2982-4E91-AA8B-E071D54F2A4D}wuauserv Error: (07/25/2015 12:45:29 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The Multimedia Class Scheduler service failed to start due to the following error: %%1053 Error: (07/25/2015 12:45:29 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The Multimedia Class Scheduler service failed to start due to the following error: %%1053 Error: (07/25/2015 12:45:29 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The Multimedia Class Scheduler service failed to start due to the following error: %%1053 Error: (07/25/2015 12:45:29 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The Multimedia Class Scheduler service failed to start due to the following error: %%1053 Error: (07/25/2015 12:45:29 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The Multimedia Class Scheduler service failed to start due to the following error: %%1053 Error: (07/25/2015 12:45:29 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The Multimedia Class Scheduler service failed to start due to the following error: %%1053 Error: (07/25/2015 12:45:29 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The Multimedia Class Scheduler service failed to start due to the following error: %%1053 Error: (07/25/2015 12:45:29 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The Multimedia Class Scheduler service failed to start due to the following error: %%1053 Microsoft Office: ========================= Error: (07/25/2015 12:38:18 AM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Integrator.exe15.0.1001.3731d7001d0c6ac86759ecc6E:\AVG TuneUP\Integrator.exe186b84cf-32a0-11e5-825e-00c2c66f1aa7 Error: (07/25/2015 12:31:16 AM) (Source: Application Hang) (EventID: 1002) (User: ) Description: SeaToolsforWindowsSetup.exe0.0.0.011d401d0c6abbac942774294967295C:\Users\Y510p\Downloads\SeaToolsforWindowsSetup.exe219a8a23-329f-11e5-825e-00c2c66f1aa7 Error: (07/25/2015 12:29:31 AM) (Source: Application Hang) (EventID: 1002) (User: ) Description: SeaToolsforWindowsSetup.exe0.0.0.01dd801d0c6aa1b1c02894294967295C:\Users\Y510p\Downloads\SeaToolsforWindowsSetup.exee332f57e-329e-11e5-825e-00c2c66f1aa7 Error: (07/23/2015 11:04:38 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: AnomalyWarzoneEarth.exe0.0.0.04ed893c2AnomalyWarzoneEarth.exe0.0.0.04ed893c2c000000500019b4d1e2c01d0c5d5e0cbdb5fE:\Steam\steamapps\common\Anomaly Warzone Earth\AnomalyWarzoneEarth.exeE:\Steam\steamapps\common\Anomaly Warzone Earth\AnomalyWarzoneEarth.exedd7be333-31c9-11e5-825d-00c2c66f1aa7 Error: (07/23/2015 09:44:22 PM) (Source: Microsoft-Windows-WMI) (EventID: 24) (User: NT AUTHORITY) Description: ProtectionManagementselect * from MSFT_MpEventMSFT_MpEvent//./root/microsoft/protectionManagement Error: (07/23/2015 09:44:22 PM) (Source: Microsoft-Windows-WMI) (EventID: 24) (User: NT AUTHORITY) Description: select * from MSFT_MpEventMSFT_MpEvent//./root/microsoft/protectionManagement Error: (07/23/2015 09:43:34 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: ZeroConfigService.exe16.5.0.052179ea0MurocApi.dll16.5.0.052179d03c0000005000000000002bcd886401d0c5cb412ddd2aC:\Program Files\Intel\WiFi\bin\ZeroConfigService.exeC:\Program Files\Intel\WiFi\bin\MurocApi.dll8a4cb59c-31be-11e5-825d-00c2c66f1aa7 Error: (07/23/2015 05:31:18 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Fulcrum.exe1.0.0.0546e6b9cclr.dll4.0.30319.3401452e0b784c00000fd000578d91eac01d0c5a80db1eec8C:\Users\Y510p\Desktop\Fulcrum 4.19 cracked VIP\Fulcrum.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll4c92c722-319b-11e5-825c-00c2c66f1aa7 Error: (07/23/2015 05:30:48 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Fulcrum.exe1.0.0.0546e6b9cKERNEL32.dll6.3.9600.17056532a2e6cc00000fd00010818e7801d0c5a7fb702583C:\Users\Y510p\Desktop\Fulcrum 4.19 cracked VIP\Fulcrum.exeC:\Windows\SYSTEM32\KERNEL32.dll3a4d81f5-319b-11e5-825c-00c2c66f1aa7 Error: (07/23/2015 05:30:28 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Fulcrum.exe1.0.0.0546e6b9cclr.dll4.0.30319.3401452e0b784c00000fd000578d9d0c01d0c5a7ec00e993C:\Users\Y510p\Desktop\Fulcrum 4.19 cracked VIP\Fulcrum.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll2e77422d-319b-11e5-825c-00c2c66f1aa7 CodeIntegrity Errors: =================================== Date: 2015-07-23 19:35:42.444 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system. Date: 2015-07-23 19:34:39.979 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system. Date: 2015-07-23 19:11:39.614 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system. Date: 2015-07-23 18:54:44.333 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system. Date: 2015-07-23 18:54:27.248 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system. Date: 2015-07-21 21:06:53.012 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system. Date: 2015-07-21 12:56:12.841 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system. Date: 2015-07-20 17:27:02.585 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system. Date: 2015-07-20 17:27:01.369 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system. Date: 2015-07-20 17:26:53.140 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system. ==================== Memory info =========================== Processor: Intel® Core i7-4700MQ CPU @ 2.40GHz Percentage of memory in use: 17% Total physical RAM: 16334.36 MB Available physical RAM: 13461.63 MB Total Virtual: 19278.36 MB Available Virtual: 16048.23 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:266.47 GB) (Free:202.93 GB) NTFS ==>[drive with boot components (obtained from BCD)] Drive e: () (Fixed) (Total:664.06 GB) (Free:510.57 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: D9FA2484) Partition 1: (Active) - (Size=266.5 GB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=664.1 GB) - (Type=07 NTFS) ==================== End of log ============================
  5. Здравейте колеги, Първо честит празник. От доста време не съм писал във форума.Проблемът е следвия,след няколко часа работа на копмютъра ,определени програми не се стартират- Daemon tools например,оправя се след рестарт.Отделно съм забелязал че рамта от начало е на около 30 процента 8GB /2x4GB/ после застава на 70+ без да има почти нищо стартирано,което според мен не е нормално.Мислил съм за преинсталация ,обаче работя на CAD software -и и съответно настройките им на ново ще ми отнемат поне няколко дни.Лаптопът е Dell Inspirion n7010.Едно време правих врътката и Hitjackthis логовете и нещата заспиваха ,та ако може малко помощ ще съм благодарен.Ms security essentias e anitvir-a почистил съм с CCleaner и съм дефрагментирал дисковете ,ето и лог Logfile of Trend Micro HijackThis v2.0.5 Scan saved at 17:14:07 ч., on 24.5.2015 г. Platform: Windows 7 SP1 (WinNT 6.00.3505) MSIE: Internet Explorer v11.0 (11.00.9600.17801) FIREFOX: 36.0.1 (x86 bg) Boot mode: Normal Running processes: C:\PROGRA~2\DUMETE~1\DUMeter.exe C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoUpdateCheck.exe C:\Program Files (x86)\Skype\Phone\Skype.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Users\Andrey\AppData\Roaming\uTorrent\uTorrent.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Users\Andrey\Desktop\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://us.yahoo.com?fr=fp-comodo R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = F2 - REG:system.ini: UserInit=userinit.exe, O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll O2 - BHO: PrivDogExtension - {FB16E5C3-A9E2-47A2-8EFC-319E775E62CC} - C:\Program Files (x86)\AdTrustMedia\PrivDog\2.1.0.22\trustedads.dll O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe O4 - HKCU\..\Run: [DU Meter] "C:\Program Files (x86)\DU Meter\DUMeter.exe" /autostart O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [uTorrent] "C:\Users\Andrey\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE') O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Network Server.lnk = C:\Program Files (x86)\WIBUKEY\Server\WkSvMgr.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: PrivDog - {2F5C139F-79BD-4C84-A95A-E7140525BC55} - C:\Program Files (x86)\AdTrustMedia\PrivDog\2.1.0.22\trustedads.dll O9 - Extra button: Skype Click to Call settings - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics O17 - HKLM\System\CCS\Services\Tcpip\..\{088CC127-08D2-4CDC-BF13-EF0E71A4882D}: NameServer = 8.8.8.8 O17 - HKLM\System\CCS\Services\Tcpip\..\{2C9938A7-57C8-4AC8-AB77-94B11448B3F3}: NameServer = 8.8.8.8 O17 - HKLM\System\CCS\Services\Tcpip\..\{6A57712F-3C4A-429A-826B-1C52253B8FAF}: NameServer = 8.8.8.8 O17 - HKLM\System\CCS\Services\Tcpip\..\{BA538449-59A1-4259-91F0-2A5798F28C3F}: NameServer = 156.154.70.22,156.154.71.22 O17 - HKLM\System\CS1\Services\Tcpip\..\{088CC127-08D2-4CDC-BF13-EF0E71A4882D}: NameServer = 8.8.8.8 O17 - HKLM\System\CS2\Services\Tcpip\..\{088CC127-08D2-4CDC-BF13-EF0E71A4882D}: NameServer = 8.8.8.8 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL O18 - Protocol: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O20 - AppInit_DLLs: c:\windows\syswow64\nvinit.dll, C:\Windows\SysWOW64\nvinit.dll O21 - SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysWOW64\CbFsMntNtf3.dll O22 - SharedTaskScheduler: Virtual Storage Mount Notification - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysWOW64\CbFsMntNtf3.dll O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing) O23 - Service: Autodesk Content Service - Autodesk, Inc. - C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe O23 - Service: BitComet Disk Boost Service (BITCOMET_HELPER_SERVICE) - www.BitComet.com - C:\Program Files\BitComet\tools\BitCometService.exe O23 - Service: Bluetooth Device Monitor - Intel Corporation - C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe O23 - Service: Bluetooth OBEX Service - Intel Corporation - C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe O23 - Service: COMODO livePCsupport Service (CLPSLS) - COMODO - C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLS.exe O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe O23 - Service: COMODO Virtual Service Manager (cmdvirth) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe O23 - Service: DU Meter Service (DUMeterSvc) - Hagel Technologies Ltd. - C:\Program Files (x86)\DU Meter\DUMeterSvc.exe O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing) O23 - Service: FlexNet Licensing Service 64 - Flexera Software LLC - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe O23 - Service: NVIDIA GeForce Experience Service (GfExperienceService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe O23 - Service: Услуга на Google Актуализация (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe O23 - Service: Услуга на Google Актуализация (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing) O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing) O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: NVIDIA Network Service (NvNetworkService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe O23 - Service: NVIDIA Streamer Service (NvStreamSvc) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing) O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing) O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: SolidConverterPDFReadSpool (SCPDFReadSpool) - Solid Documents, LLC - C:\Program Files (x86)\SolidDocuments\Solid Converter PDF\SCPDF\SolidConverterPDFServicex64.exe O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing) O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing) O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing) O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe O23 - Service: TeamViewer 10 (TeamViewer) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing) O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing) O23 - Service: VRLService - Unknown owner - C:\PROGRA~3\ASGVIS\DONGLE~1\STARTV~1.EXE O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing) O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing) O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing) O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing) O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing) -- End of file - 13208 bytes
  6. Здравейте, след сваляне на portable програма (Illustrator Portable) и опит за стартиране се скри втория ми твърд диск. Не се показва в Computer Management -->Disk Management - съвсем изчезна. Предполагам, че е заради свалената програма, тъй като изчезна веднага след кликването. Ето лога от сканирането с Farbar Recovery Scan Tool: Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 24-05-2015 Ran by User (administrator) on PCXX on 24-05-2015 14:29:08 Running from C:\Users\User\Desktop Loaded Profiles: User (Available Profiles: User) Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States) Internet Explorer Version 11 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe () C:\Windows\System32\nvwmi64.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe (Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\WTabletServiceCon.exe (Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\WTabletServicePro.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe () C:\Windows\System32\nvwmi64.exe (Autodesk Inc.) C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgrSvc.exe (Autodesk, Inc.) C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe () C:\Windows\vsnpstd3.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe (Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe (Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe (Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe (Akamai Technologies, Inc.) C:\Users\User\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.) C:\Users\User\AppData\Local\Akamai\netsession_win.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe (MyCity) C:\Program Files (x86)\MCShield\MCShieldRTM.exe (BitTorrent Inc.) C:\Users\User\AppData\Roaming\uTorrent\uTorrent.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Skillbrains) C:\Program Files (x86)\Skillbrains\lightshot\5.2.1.1\Lightshot.exe (Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TabletUser.exe (Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe (Wacom Technology) C:\Program Files\Tablet\Pen\WacomHost.exe (Wacom Technology) C:\Program Files\Tablet\Wacom\WacomHost.exe (Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe (Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_Tablet.exe (Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TouchUser.exe (Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_188.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_188.exe (Microsoft Corporation) C:\Windows\System32\vds.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6548112 2012-06-12] (Realtek Semiconductor) HKLM\...\Run: [snpstd3] => C:\Windows\vsnpstd3.exe [827392 2006-09-19] () HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1337000 2015-04-30] (Microsoft Corporation) HKLM\...\Run: [bCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation) HKLM\...\Run: [nwiz] => C:\Program Files\NVIDIA Corporation\nview\nwiz.exe [2728736 2014-08-04] () HKLM-x32\...\Run: [uSB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648 2012-05-20] (Intel Corporation) HKLM-x32\...\Run: [iAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation) HKLM-x32\...\Run: [Lightshot] => C:\Program Files (x86)\Skillbrains\lightshot\Lightshot.exe [226560 2014-11-18] () HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated) HKU\S-1-5-21-1676110180-4283091072-1689541519-1000\...\Run: [Akamai NetSession Interface] => C:\Users\User\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.) HKU\S-1-5-21-1676110180-4283091072-1689541519-1000\...\Run: [MCShield Monitor] => C:\Program Files (x86)\MCShield\mcshieldrtm.exe [650816 2014-04-11] (MyCity) HKU\S-1-5-21-1676110180-4283091072-1689541519-1000\...\Run: [uTorrent] => C:\Users\User\AppData\Roaming\uTorrent\uTorrent.exe [1694560 2015-05-12] (BitTorrent Inc.) HKU\S-1-5-21-1676110180-4283091072-1689541519-1000\...\Run: [skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [31282816 2015-04-17] (Skype Technologies S.A.) HKU\S-1-5-21-1676110180-4283091072-1689541519-1000\...\Policies\Explorer: [] HKU\S-1-5-21-1676110180-4283091072-1689541519-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\PhotoScreensaver.scr [477696 2010-11-21] (Microsoft Corporation) ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll [2012-02-06] (Autodesk, Inc.) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\S-1-5-21-1676110180-4283091072-1689541519-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome HKU\S-1-5-21-1676110180-4283091072-1689541519-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch SearchScopes: HKLM -> DefaultScope value is missing SearchScopes: HKLM-x32 -> DefaultScope value is missing BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation) BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation) BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-02-08] (Oracle Corporation) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation) BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-02-08] (Oracle Corporation) DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.94.1 85.187.216.3 FireFox: ======== FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\s03x6q6l.default-1368262168611 FF Homepage: hxxp://www.google.bg/ FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-05-20] () FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin: @wacom.com/wtPlugin,version=2.1.0.3 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2012-12-25] (Wacom) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-05-20] () FF Plugin-x32: @graphisoft.com/GDL Web Plug-in -> C:\Program Files (x86)\GRAPHISOFT\GDLWebControl\npGDLMozilla.dll [2012-06-13] (Graphisoft SE) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-02-08] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-02-08] (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-08-04] (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-08-04] (NVIDIA Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-17] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-17] (Google Inc.) FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.3 -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2012-12-25] (Wacom) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-1676110180-4283091072-1689541519-1000: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2012-12-25] (Wacom) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-05-01] (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2015-04-08] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2015-04-08] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2015-04-08] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2015-04-08] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2015-04-08] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll [2012-06-28] (Nullsoft, Inc.) FF Extension: Adblock Plus Pop-up Addon - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\s03x6q6l.default-1368262168611\Extensions\[email protected] [2014-04-23] FF Extension: Pin It Button - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\s03x6q6l.default-1368262168611\Extensions\[email protected] [2015-04-21] FF Extension: Adblock Plus - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\s03x6q6l.default-1368262168611\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-05-11] FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA} [2015-05-18] Chrome: ======= CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Docs) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-06-03] CHR Extension: (Google Drive) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-06-03] CHR Extension: (YouTube) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-06-03] CHR Extension: (Adblock Plus) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-04-23] CHR Extension: (Google Search) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-06-03] CHR Extension: (Bookmark Manager) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-26] CHR Extension: (Google Wallet) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-21] CHR Extension: (Gmail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-06-03] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 AdAppMgrSvc; C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgrSvc.exe [597896 2014-09-04] (Autodesk Inc.) R2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [19232 2012-01-31] (Autodesk, Inc.) R2 DiagTrack; C:\Windows\system32\diagtrack.dll [1254400 2015-04-27] (Microsoft Corporation) S3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [651720 2015-05-12] (Macrovision Europe Ltd.) [] R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [46904 2013-12-17] (Hewlett-Packard Company) R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation) R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2015-04-30] (Microsoft Corporation) R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [366544 2015-04-30] (Microsoft Corporation) R2 NitroDriverReadSpool9; C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe [230920 2013-11-27] (Nitro PDF Software) R2 NVWMI; C:\Windows\system32\nvwmi64.exe [2694432 2014-08-04] () R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5448976 2015-04-17] (TeamViewer GmbH) S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) R2 WTabletServiceCon; C:\Program Files\Tablet\Pen\WTabletServiceCon.exe [627992 2014-01-13] (Wacom Technology, Corp.) R2 WTabletServicePro; C:\Program Files\Tablet\Wacom\WTabletServicePro.exe [621336 2013-12-04] (Wacom Technology, Corp.) S2 Crypkey License; crypserv.exe [X] S2 mi-raysat_3dsmax2013_64; "D:\Programs\Autodesk 3ds Max 2013\Real\3ds Max 2013\NVIDIA\raysat_3dsmax2013_64server.exe" [X] S3 mi-raysat_3dsmax2015_64; "D:\Programs\3ds Max 2015\NVIDIA\Satellite\raysat_3dsmax2015_64server.exe" [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) S2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [53816 2009-10-12] (Samsung Electronics Co., Ltd.) R3 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-01-29] (DT Soft Ltd) R3 ISCT; C:\Windows\System32\DRIVERS\ISCTD64.sys [46568 2013-01-19] () R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [280376 2015-03-04] (Microsoft Corporation) R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124568 2015-03-04] (Microsoft Corporation) S3 SNPSTD3; C:\Windows\System32\DRIVERS\snpstd3.sys [10550272 2007-03-27] (Sonix Co. Ltd.) R2 WIBUKEY; C:\Windows\System32\DRIVERS\WibuKey64.sys [106760 2014-10-29] (WIBU-SYSTEMS AG) S3 catchme; \??\C:\ComboFix\catchme.sys [X] S1 NetworkX; \SystemRoot\system32\ckldrv.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-05-24 14:29 - 2015-05-24 14:29 - 00018649 _____ () C:\Users\User\Desktop\FRST.txt 2015-05-24 14:29 - 2015-05-24 14:29 - 00000000 ____D () C:\FRST 2015-05-24 14:28 - 2015-05-24 14:28 - 02108416 _____ (Farbar) C:\Users\User\Desktop\FRST64.exe 2015-05-20 11:37 - 2015-05-24 14:09 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-05-20 11:37 - 2015-05-20 12:09 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2015-05-18 13:43 - 2015-05-18 13:43 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2015-05-13 23:45 - 2015-05-01 16:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll 2015-05-13 23:45 - 2015-05-01 16:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll 2015-05-13 11:46 - 2015-05-05 04:29 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2015-05-13 11:46 - 2015-05-05 04:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2015-05-13 11:46 - 2015-04-22 05:28 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2015-05-13 11:46 - 2015-04-22 04:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2015-05-13 11:46 - 2015-04-21 20:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-05-13 11:46 - 2015-04-21 20:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2015-05-13 11:46 - 2015-04-21 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2015-05-13 11:46 - 2015-04-21 19:51 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2015-05-13 11:46 - 2015-04-21 19:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-05-13 11:46 - 2015-04-21 19:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2015-05-13 11:46 - 2015-04-21 19:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2015-05-13 11:46 - 2015-04-21 19:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-05-13 11:46 - 2015-04-21 19:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2015-05-13 11:46 - 2015-04-21 19:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2015-05-13 11:46 - 2015-04-21 19:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2015-05-13 11:46 - 2015-04-21 19:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2015-05-13 11:46 - 2015-04-21 19:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2015-05-13 11:46 - 2015-04-21 19:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2015-05-13 11:46 - 2015-04-21 19:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2015-05-13 11:46 - 2015-04-21 19:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2015-05-13 11:46 - 2015-04-21 19:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2015-05-13 11:46 - 2015-04-21 19:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2015-05-13 11:46 - 2015-04-21 19:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2015-05-13 11:46 - 2015-04-21 19:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2015-05-13 11:46 - 2015-04-21 19:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2015-05-13 11:46 - 2015-04-21 19:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2015-05-13 11:46 - 2015-04-21 19:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2015-05-13 11:46 - 2015-04-21 19:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2015-05-13 11:46 - 2015-04-21 19:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2015-05-13 11:46 - 2015-04-21 19:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec 2015-05-13 11:46 - 2015-04-21 19:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2015-05-13 11:46 - 2015-04-21 19:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-05-13 11:46 - 2015-04-21 19:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2015-05-13 11:46 - 2015-04-21 19:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2015-05-13 11:46 - 2015-04-21 19:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2015-05-13 11:46 - 2015-04-21 19:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2015-05-13 11:46 - 2015-04-21 19:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2015-05-13 11:46 - 2015-04-21 19:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2015-05-13 11:46 - 2015-04-21 18:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2015-05-13 11:46 - 2015-04-21 18:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2015-05-13 11:46 - 2015-04-21 18:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2015-05-13 11:46 - 2015-04-21 18:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-05-13 11:46 - 2015-04-21 18:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2015-05-13 11:46 - 2015-04-21 18:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2015-05-13 11:46 - 2015-04-21 18:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2015-05-13 11:46 - 2015-04-21 18:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-05-13 11:46 - 2015-04-21 18:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2015-05-13 11:46 - 2015-04-21 18:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-05-13 11:46 - 2015-04-21 18:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2015-05-13 11:46 - 2015-04-21 18:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2015-05-13 11:46 - 2015-04-21 18:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2015-05-13 11:46 - 2015-04-21 18:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2015-05-13 11:46 - 2015-04-21 18:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-05-13 11:46 - 2015-04-21 18:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2015-05-13 11:46 - 2015-04-21 18:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2015-05-13 11:46 - 2015-04-21 18:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2015-05-13 11:46 - 2015-04-21 18:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2015-05-13 11:46 - 2015-04-21 18:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-05-13 11:46 - 2015-04-21 18:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2015-05-13 11:46 - 2015-04-21 18:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2015-05-13 11:46 - 2015-04-21 17:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2015-05-13 11:46 - 2015-04-21 17:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2015-05-13 11:46 - 2015-04-18 06:10 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll 2015-05-13 11:46 - 2015-04-18 05:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll 2015-05-13 11:45 - 2015-04-27 22:28 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-05-13 11:45 - 2015-04-27 22:28 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2015-05-13 11:45 - 2015-04-27 22:28 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2015-05-13 11:45 - 2015-04-27 22:26 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2015-05-13 11:45 - 2015-04-27 22:23 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2015-05-13 11:45 - 2015-04-27 22:23 - 01254400 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll 2015-05-13 11:45 - 2015-04-27 22:23 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll 2015-05-13 11:45 - 2015-04-27 22:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll 2015-05-13 11:45 - 2015-04-27 22:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll 2015-05-13 11:45 - 2015-04-27 22:23 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2015-05-13 11:45 - 2015-04-27 22:23 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll 2015-05-13 11:45 - 2015-04-27 22:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll 2015-05-13 11:45 - 2015-04-27 22:23 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll 2015-05-13 11:45 - 2015-04-27 22:23 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2015-05-13 11:45 - 2015-04-27 22:23 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2015-05-13 11:45 - 2015-04-27 22:23 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll 2015-05-13 11:45 - 2015-04-27 22:23 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll 2015-05-13 11:45 - 2015-04-27 22:23 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2015-05-13 11:45 - 2015-04-27 22:23 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2015-05-13 11:45 - 2015-04-27 22:23 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll 2015-05-13 11:45 - 2015-04-27 22:23 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2015-05-13 11:45 - 2015-04-27 22:23 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll 2015-05-13 11:45 - 2015-04-27 22:23 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll 2015-05-13 11:45 - 2015-04-27 22:23 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2015-05-13 11:45 - 2015-04-27 22:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2015-05-13 11:45 - 2015-04-27 22:23 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2015-05-13 11:45 - 2015-04-27 22:23 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll 2015-05-13 11:45 - 2015-04-27 22:23 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll 2015-05-13 11:45 - 2015-04-27 22:22 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe 2015-05-13 11:45 - 2015-04-27 22:22 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe 2015-05-13 11:45 - 2015-04-27 22:22 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe 2015-05-13 11:45 - 2015-04-27 22:22 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe 2015-05-13 11:45 - 2015-04-27 22:22 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe 2015-05-13 11:45 - 2015-04-27 22:22 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe 2015-05-13 11:45 - 2015-04-27 22:22 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe 2015-05-13 11:45 - 2015-04-27 22:22 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2015-05-13 11:45 - 2015-04-27 22:22 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe 2015-05-13 11:45 - 2015-04-27 22:21 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe 2015-05-13 11:45 - 2015-04-27 22:18 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll 2015-05-13 11:45 - 2015-04-27 22:18 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll 2015-05-13 11:45 - 2015-04-27 22:16 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll 2015-05-13 11:45 - 2015-04-27 22:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll 2015-05-13 11:45 - 2015-04-27 22:16 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 22:16 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 22:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 22:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 22:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 22:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 22:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 22:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 22:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 22:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 22:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 22:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 22:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 22:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 22:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 22:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 22:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 22:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 22:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 22:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 22:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 22:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 22:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 22:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 22:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 22:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 22:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 22:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 22:11 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2015-05-13 11:45 - 2015-04-27 22:11 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2015-05-13 11:45 - 2015-04-27 22:08 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll 2015-05-13 11:45 - 2015-04-27 22:05 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll 2015-05-13 11:45 - 2015-04-27 22:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2015-05-13 11:45 - 2015-04-27 22:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2015-05-13 11:45 - 2015-04-27 22:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2015-05-13 11:45 - 2015-04-27 22:05 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll 2015-05-13 11:45 - 2015-04-27 22:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2015-05-13 11:45 - 2015-04-27 22:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll 2015-05-13 11:45 - 2015-04-27 22:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2015-05-13 11:45 - 2015-04-27 22:05 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll 2015-05-13 11:45 - 2015-04-27 22:04 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll 2015-05-13 11:45 - 2015-04-27 22:04 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2015-05-13 11:45 - 2015-04-27 22:04 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe 2015-05-13 11:45 - 2015-04-27 22:04 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe 2015-05-13 11:45 - 2015-04-27 22:04 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe 2015-05-13 11:45 - 2015-04-27 22:04 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe 2015-05-13 11:45 - 2015-04-27 22:04 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe 2015-05-13 11:45 - 2015-04-27 22:04 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2015-05-13 11:45 - 2015-04-27 22:03 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll 2015-05-13 11:45 - 2015-04-27 22:03 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll 2015-05-13 11:45 - 2015-04-27 22:03 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2015-05-13 11:45 - 2015-04-27 22:03 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe 2015-05-13 11:45 - 2015-04-27 22:03 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe 2015-05-13 11:45 - 2015-04-27 22:03 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll 2015-05-13 11:45 - 2015-04-27 22:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll 2015-05-13 11:45 - 2015-04-27 22:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll 2015-05-13 11:45 - 2015-04-27 21:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll 2015-05-13 11:45 - 2015-04-27 21:59 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll 2015-05-13 11:45 - 2015-04-27 21:59 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 21:59 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 21:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 21:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 21:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 21:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 21:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 21:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 21:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 21:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 21:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 21:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 21:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 21:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 21:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 21:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 21:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 21:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 21:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 21:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 21:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 21:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 21:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 21:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 21:06 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll 2015-05-13 11:45 - 2015-04-27 20:57 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe 2015-05-13 11:45 - 2015-04-27 20:57 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe 2015-05-13 11:45 - 2015-04-27 20:55 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 20:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 20:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll 2015-05-13 11:45 - 2015-04-27 20:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll 2015-05-13 11:45 - 2015-04-20 06:17 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll 2015-05-13 11:45 - 2015-04-20 06:17 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll 2015-05-13 11:45 - 2015-04-20 05:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll 2015-05-13 11:45 - 2015-04-20 05:11 - 03204608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2015-05-13 11:45 - 2015-04-13 06:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe 2015-05-13 11:44 - 2015-04-08 06:29 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll 2015-05-13 11:44 - 2015-04-08 06:29 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll 2015-05-13 11:44 - 2015-04-08 06:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll 2015-05-13 11:44 - 2015-03-04 07:41 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll 2015-05-13 11:44 - 2015-03-04 07:41 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll 2015-05-13 11:44 - 2015-03-04 07:41 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe 2015-05-13 11:44 - 2015-03-04 07:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll 2015-05-13 11:44 - 2015-03-04 07:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll 2015-05-13 11:44 - 2015-03-04 07:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll 2015-05-13 11:44 - 2015-03-04 07:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe 2015-05-13 11:44 - 2015-02-18 10:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe 2015-05-13 11:44 - 2015-02-18 10:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe 2015-05-13 11:44 - 2015-01-29 06:19 - 02543104 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll 2015-05-13 11:44 - 2015-01-29 06:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll 2015-05-09 00:15 - 2015-05-09 00:15 - 00000000 ____D () C:\Users\User\AppData\Roaming\DxO Labs 2015-05-09 00:02 - 2015-05-13 11:42 - 00000000 ____D () C:\ProgramData\DxO Labs 2015-05-09 00:02 - 2015-05-09 00:15 - 00000000 ____D () C:\Users\User\AppData\Local\DxO_Labs 2015-04-30 20:33 - 2015-04-30 20:33 - 00000000 ____D () C:\Users\User\Documents\Inventor Server x64 Direct Connect 2015-04-30 20:32 - 2015-04-30 20:32 - 00001866 _____ () C:\Users\Public\Desktop\Autodesk 3ds Max 2013 64-bit.lnk ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-05-24 14:27 - 2013-01-25 14:25 - 00000000 ____D () C:\Users\User\AppData\Roaming\uTorrent 2015-05-24 14:18 - 2013-01-25 14:31 - 00000000 ____D () C:\Users\User\AppData\Roaming\Skype 2015-05-24 14:14 - 2009-07-14 07:45 - 00032208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-05-24 14:14 - 2009-07-14 07:45 - 00032208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-05-24 14:10 - 2013-01-22 17:27 - 01808061 _____ () C:\Windows\WindowsUpdate.log 2015-05-24 14:07 - 2013-11-23 16:13 - 00000000 ____D () C:\ProgramData\MCShield 2015-05-24 14:07 - 2013-06-03 00:47 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-05-24 14:06 - 2013-01-22 17:56 - 00000000 ____D () C:\ProgramData\NVIDIA 2015-05-24 14:06 - 2009-07-14 08:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-05-24 14:06 - 2009-07-14 07:51 - 00126312 _____ () C:\Windows\setupact.log 2015-05-24 13:36 - 2013-06-03 00:47 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-05-24 13:24 - 2014-12-10 21:20 - 00000386 _____ () C:\Windows\Tasks\update-S-1-5-21-1676110180-4283091072-1689541519-1000.job 2015-05-24 13:06 - 2014-12-10 21:20 - 00000386 _____ () C:\Windows\Tasks\update-sys.job 2015-05-24 11:37 - 2014-10-29 17:46 - 00000000 ____D () C:\Users\User\AppData\Local\Akamai 2015-05-23 11:10 - 2014-04-03 18:51 - 00001557 _____ () C:\Users\User\Documents\plot.log 2015-05-22 22:55 - 2014-03-15 14:16 - 00000000 ____D () C:\Users\User\Downloads\kuhi 2015-05-22 21:25 - 2009-07-14 06:20 - 00000000 ____D () C:\Windows\system32\NDF 2015-05-22 17:00 - 2013-01-25 17:05 - 00000000 ____D () C:\Users\User\Graphisoft 2015-05-22 17:00 - 2013-01-25 17:05 - 00000000 ____D () C:\Users\User\Documents\BIMx 2015-05-21 01:27 - 2015-04-05 02:11 - 00000000 ___SD () C:\Windows\SysWOW64\GWX 2015-05-21 01:27 - 2015-04-05 02:11 - 00000000 ___SD () C:\Windows\system32\GWX 2015-05-20 16:37 - 2013-06-03 00:48 - 00002181 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2015-05-20 12:09 - 2013-11-20 18:10 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2015-05-20 12:09 - 2013-01-22 18:50 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2015-05-20 11:37 - 2014-08-31 11:01 - 00000000 ____D () C:\Users\User\AppData\Local\Adobe 2015-05-20 11:35 - 2013-01-25 13:44 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2015-05-17 21:31 - 2013-06-03 00:47 - 00003894 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2015-05-17 21:31 - 2013-06-03 00:47 - 00003642 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2015-05-16 10:09 - 2013-07-16 23:32 - 00000000 ____D () C:\Windows\system32\MRT 2015-05-16 10:06 - 2013-01-22 17:58 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-05-14 10:41 - 2009-07-14 06:20 - 00000000 ____D () C:\Windows\rescache 2015-05-14 09:35 - 2009-07-14 07:45 - 05109392 _____ () C:\Windows\system32\FNTCACHE.DAT 2015-05-14 09:34 - 2010-11-21 10:17 - 00000000 ____D () C:\Program Files\Windows Journal 2015-05-14 09:34 - 2009-07-14 06:20 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers 2015-05-13 23:49 - 2013-01-25 21:04 - 00000000 ____D () C:\ProgramData\Microsoft Help 2015-05-13 23:47 - 2013-01-25 13:53 - 00002117 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk 2015-05-13 23:47 - 2013-01-25 13:53 - 00001945 _____ () C:\Windows\epplauncher.mif 2015-05-13 23:47 - 2013-01-25 13:53 - 00000000 ____D () C:\Program Files\Microsoft Security Client 2015-05-13 23:47 - 2013-01-25 13:53 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client 2015-05-13 23:45 - 2014-04-22 14:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2015-05-13 23:45 - 2014-04-22 14:00 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2015-05-13 23:45 - 2014-04-22 14:00 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2015-05-12 22:03 - 2015-02-19 17:56 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2015-05-12 00:08 - 2013-02-07 21:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Autodesk 2015-05-12 00:08 - 2013-02-07 21:58 - 00000000 ____D () C:\Program Files (x86)\Autodesk 2015-05-12 00:08 - 2013-01-22 17:35 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2015-05-11 17:41 - 2013-11-27 01:35 - 00000000 ____D () C:\Users\User\AppData\Roaming\Abvent_Artlantis5 2015-05-05 21:02 - 2013-05-26 15:34 - 00000000 ____D () C:\Users\User\Documents\3dsMax 2015-04-30 20:33 - 2013-02-07 21:59 - 00000000 ____D () C:\Program Files\Common Files\Autodesk Shared 2015-04-30 20:33 - 2013-02-07 21:56 - 00000000 ____D () C:\ProgramData\Autodesk 2015-04-30 20:32 - 2013-02-07 21:59 - 00000000 ____D () C:\Program Files\Autodesk 2015-04-30 20:31 - 2009-07-14 05:34 - 00017796 _____ () C:\Windows\system32\Drivers\etc\services 2015-04-30 20:30 - 2013-01-29 16:40 - 00029514 _____ () C:\Windows\DirectX.log 2015-04-30 17:10 - 2013-01-25 14:09 - 00000000 ____D () C:\ProgramData\Skype 2015-04-28 21:47 - 2013-01-29 00:01 - 00010728 _____ () C:\Users\User\AppData\Roaming\SmarThruOptions.xml 2015-04-24 15:17 - 2015-02-16 17:18 - 00000971 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk 2015-04-24 15:17 - 2015-02-16 17:18 - 00000959 _____ () C:\Users\Public\Desktop\TeamViewer 10.lnk 2015-04-24 15:17 - 2014-01-17 15:58 - 00000000 ____D () C:\Program Files (x86)\TeamViewer ==================== Files in the root of some directories ======= 2013-01-29 00:01 - 2015-04-28 21:47 - 0010728 _____ () C:\Users\User\AppData\Roaming\SmarThruOptions.xml 2013-12-04 20:27 - 2013-12-04 20:27 - 0001017 _____ () C:\Users\User\AppData\Local\recently-used.xbel 2013-01-31 22:40 - 2013-01-31 22:40 - 0007605 _____ () C:\Users\User\AppData\Local\Resmon.ResmonCfg 2014-12-10 21:20 - 2014-12-10 21:20 - 0000003 _____ () C:\Users\User\AppData\Local\updater.log 2014-12-10 21:20 - 2015-04-23 01:44 - 0000424 _____ () C:\Users\User\AppData\Local\UserProducts.xml Some files in TEMP: ==================== C:\Users\User\AppData\Local\Temp\AcDeltree.exe C:\Users\User\AppData\Local\Temp\nvSCPAPI.dll C:\Users\User\AppData\Local\Temp\nvStInst.exe C:\Users\User\AppData\Local\Temp\SkypeSetup.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-05-24 12:37 ==================== End of log ============================ Addition.txt
  7. Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-04-2015 01 Ran by Alex (administrator) on ALEX-PC on 18-04-2015 20:11:17 Running from C:\Users\Alex\Downloads Loaded Profiles: Alex (Available profiles: Alex) Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States) Internet Explorer Version 11 (Default browser: Chrome) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe (Musiclab LLC) C:\Program Files (x86)\Music App\Datamngr\DatamngrCoordinator.exe () C:\Program Files (x86)\HD-V1.9\510acaa5-1572-4a90-a2e3-bc2e22a40657-11.exe (FileProperties_CompanyName) C:\Program Files (x86)\fun coupons\fun_coupons_notification_service.exe (InfoHD-V1.8) C:\Program Files (x86)\HD-V1.9\510acaa5-1572-4a90-a2e3-bc2e22a40657-10.exe (InfoHD-V1.8) C:\Program Files (x86)\HD-V1.9\HD-V1.9-nova.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler64.exe () C:\Windows\Temp\dgen.exe (BitTorrent Inc.) C:\Users\Alex\AppData\Roaming\uTorrent\uTorrent.exe (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Farbar) C:\Users\Alex\Downloads\FRST64 (2).exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation) HKLM\...\Run: [HotKeysCmds] => C:\Windows\system32\hkcmd.exe HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [558496 2014-02-27] (Adobe Systems Incorporated) HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-08-06] (AVAST Software) HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [335232 2015-03-07] (Oracle Corporation) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-4065903734-2765197403-3730775554-1000\...\Run: [uTorrent] => C:\Users\Alex\AppData\Roaming\uTorrent\uTorrent.exe [1442384 2015-03-26] (BitTorrent Inc.) HKU\S-1-5-21-4065903734-2765197403-3730775554-1000\...\Run: [skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [31346784 2015-02-26] (Skype Technologies S.A.) HKU\S-1-5-21-4065903734-2765197403-3730775554-1000\...\RunOnce: [Application Restart #2] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [812872 2015-04-14] (Google Inc.) HKU\S-1-5-21-4065903734-2765197403-3730775554-1000\...\MountPoints2: H - H:\setup.exe HKU\S-1-5-21-4065903734-2765197403-3730775554-1000\...\MountPoints2: {32120b6d-d8ab-11e4-8934-001a80fbc046} - H:\setup.exe HKU\S-1-5-18\...\RunOnce: [sPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2013-03-21] (Microsoft Corporation) IFEO\bitguard.exe: [Debugger] tasklist.exe IFEO\bprotect.exe: [Debugger] tasklist.exe IFEO\bpsvc.exe: [Debugger] tasklist.exe IFEO\browserdefender.exe: [Debugger] tasklist.exe IFEO\browserprotect.exe: [Debugger] tasklist.exe IFEO\browsersafeguard.exe: [Debugger] tasklist.exe IFEO\dprotectsvc.exe: [Debugger] tasklist.exe IFEO\jumpflip: [Debugger] tasklist.exe IFEO\protectedsearch.exe: [Debugger] tasklist.exe IFEO\searchinstaller.exe: [Debugger] tasklist.exe IFEO\searchprotection.exe: [Debugger] tasklist.exe IFEO\searchprotector.exe: [Debugger] tasklist.exe IFEO\searchsettings.exe: [Debugger] tasklist.exe IFEO\searchsettings64.exe: [Debugger] tasklist.exe IFEO\snapdo.exe: [Debugger] tasklist.exe IFEO\stinst32.exe: [Debugger] tasklist.exe IFEO\stinst64.exe: [Debugger] tasklist.exe IFEO\umbrella.exe: [Debugger] tasklist.exe IFEO\utiljumpflip.exe: [Debugger] tasklist.exe IFEO\volaro: [Debugger] tasklist.exe IFEO\vonteera: [Debugger] tasklist.exe IFEO\websteroids.exe: [Debugger] tasklist.exe IFEO\websteroidsservice.exe: [Debugger] tasklist.exe ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=56626&homepage=http://istart.webssearches.com/?type=hp&ts=1405320608&from=amt&uid=FUJITSUXMHY2250BH_K41LT852CBGHT852CBGHX HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=56626&homepage=http://istart.webssearches.com/?type=hp&ts=1405320608&from=amt&uid=FUJITSUXMHY2250BH_K41LT852CBGHT852CBGHX HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://istart.webssearches.com/web/?type=ds&ts=1405320608&from=amt&uid=FUJITSUXMHY2250BH_K41LT852CBGHT852CBGHX&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://istart.webssearches.com/web/?type=ds&ts=1405320608&from=amt&uid=FUJITSUXMHY2250BH_K41LT852CBGHT852CBGHX&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://istart.webssearches.com/?type=hp&ts=1405320608&from=amt&uid=FUJITSUXMHY2250BH_K41LT852CBGHT852CBGHX HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://istart.webssearches.com/?type=hp&ts=1405320608&from=amt&uid=FUJITSUXMHY2250BH_K41LT852CBGHT852CBGHX HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://istart.webssearches.com/web/?type=ds&ts=1405320608&from=amt&uid=FUJITSUXMHY2250BH_K41LT852CBGHT852CBGHX&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://istart.webssearches.com/web/?type=ds&ts=1405320608&from=amt&uid=FUJITSUXMHY2250BH_K41LT852CBGHT852CBGHX&q={searchTerms} HKU\S-1-5-21-4065903734-2765197403-3730775554-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=56626&homepage=http://www.search.ask.com/?o=APN10641A&gct=hp&d=2-876&v=a15946-124&t=4 HKU\S-1-5-21-4065903734-2765197403-3730775554-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://istart.webssearches.com/?type=hp&ts=1405320608&from=amt&uid=FUJITSUXMHY2250BH_K41LT852CBGHT852CBGHX SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=ds&ts=1405320608&from=amt&uid=FUJITSUXMHY2250BH_K41LT852CBGHT852CBGHX&q={searchTerms} SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=ds&ts=1405320608&from=amt&uid=FUJITSUXMHY2250BH_K41LT852CBGHT852CBGHX&q={searchTerms} SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2002} URL = http://dts.search.ask.com/sr?src=ieb&gct=ds&appid=876&systemid=2&v=a15946-124&apn_uid=0436673825314173&apn_dtid=IME002&o=APN10641&apn_ptnrs=AG2&q={searchTerms} SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=565&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=2820824023084532&q={searchTerms} SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=ds&ts=1405320608&from=amt&uid=FUJITSUXMHY2250BH_K41LT852CBGHT852CBGHX&q={searchTerms} SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=ds&ts=1405320608&from=amt&uid=FUJITSUXMHY2250BH_K41LT852CBGHT852CBGHX&q={searchTerms} SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2002} URL = http://dts.search.ask.com/sr?src=ieb&gct=ds&appid=876&systemid=2&v=a15946-124&apn_uid=0436673825314173&apn_dtid=IME002&o=APN10641&apn_ptnrs=AG2&q={searchTerms} SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=565&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=2820824023084532&q={searchTerms} SearchScopes: HKLM-x32 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3220468 SearchScopes: HKLM-x32 -> {EEE6C360-6118-11DC-9C72-001320C79847} URL = http://search.sweetim.com/search.asp?src=6&q={searchTerms}&crg=3.1010000.10002&barid={BB450165-544F-11E2-87CC-001A80FBC046} SearchScopes: HKU\.DEFAULT -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = SearchScopes: HKU\.DEFAULT -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = SearchScopes: HKU\.DEFAULT -> {B7AD362F-B85B-4BAC-BE2E-12A966292820} URL = http://dts.search.ask.com/sr?src=ieb&gct=ds&appid=876&systemid=2&v=a15946-124&apn_uid=0436673825314173&apn_dtid=IME002&o=APN10641&apn_ptnrs=AG2&q={searchTerms} SearchScopes: HKU\S-1-5-21-4065903734-2765197403-3730775554-1000 -> DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2002} URL = http://dts.search.ask.com/sr?src=ieb&gct=ds&appid=876&systemid=2&v=a15946-124&apn_uid=0436673825314173&apn_dtid=IME002&o=APN10641&apn_ptnrs=AG2&q={searchTerms} SearchScopes: HKU\S-1-5-21-4065903734-2765197403-3730775554-1000 -> BD314A96F4464D5BBBB58F41556B9225 URL = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=876&systemid=2&apn_uid=0436673825314173&apn_dtid=IME002&o=APN10641&apn_ptnrs=AG2&q={searchTerms} SearchScopes: HKU\S-1-5-21-4065903734-2765197403-3730775554-1000 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://search.babylon.com/?q={searchTerms}&babsrc=SP_ss_din2g&mntrId=A402001A80FBC046&affID=120695&tt=180613_ndt4&tsp=4920 SearchScopes: HKU\S-1-5-21-4065903734-2765197403-3730775554-1000 -> {308B8CC4-DF12-404F-BFF2-667F131E9427} URL = http://search.creativetoolbars.com/results?src=tb&id=smartbar&g=&q={searchTerms} SearchScopes: HKU\S-1-5-21-4065903734-2765197403-3730775554-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=ds&ts=1405320608&from=amt&uid=FUJITSUXMHY2250BH_K41LT852CBGHT852CBGHX&q={searchTerms} SearchScopes: HKU\S-1-5-21-4065903734-2765197403-3730775554-1000 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2002} URL = http://dts.search.ask.com/sr?src=ieb&gct=ds&appid=876&systemid=2&v=a15946-124&apn_uid=0436673825314173&apn_dtid=IME002&o=APN10641&apn_ptnrs=AG2&q={searchTerms} SearchScopes: HKU\S-1-5-21-4065903734-2765197403-3730775554-1000 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=565&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=2820824023084532&q={searchTerms} SearchScopes: HKU\S-1-5-21-4065903734-2765197403-3730775554-1000 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3220468 SearchScopes: HKU\S-1-5-21-4065903734-2765197403-3730775554-1000 -> {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = http://mystart.incredibar.com/mb203?a=6R8SCQLDaA&search={searchTerms}&i=26 SearchScopes: HKU\S-1-5-21-4065903734-2765197403-3730775554-1000 -> {E92A44AC-7DBE-4F6D-BAF6-EA7482862EB4} URL = http://search.softonic.com/INF00176/tb_v1?q={searchTerms}&SearchSource=4&cc=&r=597 SearchScopes: HKU\S-1-5-21-4065903734-2765197403-3730775554-1000 -> {EEE6C360-6118-11DC-9C72-001320C79847} URL = http://search.sweetim.com/search.asp?src=6&q={searchTerms}&crg=3.1010000.10002&barid={BB450165-544F-11E2-87CC-001A80FBC046} BHO: HD-V1.9 -> {11111111-1111-1111-1111-110511951168} -> C:\Program Files (x86)\HD-V1.9\HD-V1.9-bho64.dll [2014-07-14] (InfoHD-V1.8) BHO: sUrrf and ekkeEp -> {15A8D9EE-0518-B55A-468A-99A23B24246A} -> C:\Program Files (x86)\sUrrf and ekkeEp\Pwefk.x64.dll [2013-12-12] () BHO: YoutubeAdblocker -> {3D9C2B81-8FC7-2BDD-94EC-85AEAA784F34} -> C:\Program Files (x86)\YoutubeAdblocker\WM2AuO.x64.dll [2012-12-12] () BHO: SearchNewTab -> {5F5896CE-BCF3-4DE7-0D4E-21AF79E25EA5} -> C:\Program Files (x86)\SearchNewTab\YD_UZ9.x64.dll No File BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2014-08-06] (AVAST Software) BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation) BHO-x32: hosts -> {11111111-1111-1111-1111-110311531182} -> C:\Program Files (x86)\hosts\hosts-bho.dll [2013-07-30] (Alex) BHO-x32: HD-V1.9 -> {11111111-1111-1111-1111-110511951168} -> C:\Program Files (x86)\HD-V1.9\HD-V1.9-bho.dll [2014-07-14] (InfoHD-V1.8) BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll [2015-03-17] (Oracle Corporation) BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2014-08-06] (AVAST Software) BHO-x32: Rich Media Downloader -> {A7DF592F-6E2A-45C4-9A87-4BD217D714ED} -> C:\Users\Alex\AppData\Local\Rich Media Player\BrowserExtensions\IE\RichMediaDownloader.dll [2013-07-03] (Radiocom CJSC) BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation) BHO-x32: No Name -> {C1ED9DA0-AFD0-4b90-AC6A-D3874F591014} -> No File BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-17] (Oracle Corporation) BHO-x32: Rich Media Player -> {FEB703F7-E7B2-4AB0-9566-87658AC70095} -> C:\Users\Alex\AppData\Local\Rich Media Player\BrowserExtensions\IE\PluginRichmediaplayer.dll [2013-03-12] () Toolbar: HKLM - avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File Toolbar: HKLM-x32 - No Name - {f34c9277-6577-4dff-b2d7-7d58092f272f} - No File Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies) Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation) Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation) Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\17.1.3\ViProtocol.dll [2013-11-21] (AVG Secure Search) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://istart.webssearches.com/?type=sc&ts=1405320608&from=amt&uid=FUJITSUXMHY2250BH_K41LT852CBGHT852CBGHX FireFox: ======== FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_64.dll [2014-02-08] () FF Plugin: @java.com/DTPlugin,version=10.21.2 -> C:\Windows\system32\npDeployJava1.dll [2013-05-12] (Oracle Corporation) FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation) FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2014-04-29] (Adobe Systems) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_64.dll [2014-02-08] () FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1204144.dll [2013-09-05] (Adobe Systems, Inc.) FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\17.1.3\\npsitesafety.dll [2013-11-21] (AVG Technologies) FF Plugin-x32: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-17] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-17] (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation) FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File FF Plugin-x32: @richmediaplayer.com/nppluginrichmediaplayer -> C:\Program Files (x86)\Mozilla Firefox\plugins\nppluginrichmediaplayer.dll No File FF Plugin-x32: @staging.google.com/globalUpdate Update;version=10 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll [2014-07-14] (globalUpdate) FF Plugin-x32: @staging.google.com/globalUpdate Update;version=4 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll [2014-07-14] (globalUpdate) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.) FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2014-04-29] (Adobe Systems) FF Plugin HKU\S-1-5-21-4065903734-2765197403-3730775554-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Alex\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2013-05-07] (Unity Technologies ApS) FF HKLM\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\IB Updater\Firefox FF HKLM\...\Firefox\Extensions: [{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}] - C:\Program Files\IB Updater\Firefox FF HKLM-x32\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\IB Updater\Firefox FF HKLM-x32\...\Firefox\Extensions: [{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}] - C:\Program Files\IB Updater\Firefox FF HKLM-x32\...\Firefox\Extensions: [{3DF4B26D-DB19-45DF-962A-6719D071245B}] - C:\Users\Alex\AppData\Local\Rich Media Player\BrowserExtensions\Firefox\{3DF4B26D-DB19-45DF-962A-6719D071245B} FF Extension: Rich Media Player extension - C:\Users\Alex\AppData\Local\Rich Media Player\BrowserExtensions\Firefox\{3DF4B26D-DB19-45DF-962A-6719D071245B} [2013-09-09] FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Users\Alex\AppData\Roaming\okitspace\Firefox FF Extension: OKitSpace - C:\Users\Alex\AppData\Roaming\okitspace\Firefox [2013-10-04] FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2012-12-23] Chrome: ======= CHR Profile: C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Download Video) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\doagiokpgboiomffjfhaiimafndmmpni [2013-10-03] CHR Extension: (eiimnmioipafcokbfikbljfdeojpcgbh) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\eiimnmioipafcokbfikbljfdeojpcgbh [2015-04-05] CHR Extension: (uTorrentControl_v2) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejpbbhjlbipncjklfjjaedaieimbmdda [2014-02-08] CHR Extension: (Free Smileys & Emoticons) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjbbjfdilbioabojmcplalojlmdngbjl [2015-04-03] CHR Extension: (Avast Online Security) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-04-03] CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-04-03] CHR Extension: (Skype Click to Call) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-02-08] CHR Extension: (GreyGray) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\nhogbcndagiknbfomjgdeghehkljalhi [2014-02-08] CHR Extension: (Google Wallet) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-03] CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\IB Updater\source.crx [Not Found] CHR HKU\S-1-5-21-4065903734-2765197403-3730775554-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [ejpbbhjlbipncjklfjjaedaieimbmdda] - C:\Users\Alex\AppData\Local\CRE\ejpbbhjlbipncjklfjjaedaieimbmdda.crx [2012-11-19] CHR HKLM-x32\...\Chrome\Extension: [ddkpepdilbfaccbiljmaflabkcbgjfin] - C:\Program Files (x86)\Search Results Toolbar\Datamngr\chromeExtension.crx [Not Found] CHR HKLM-x32\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\IB Updater\source.crx [Not Found] CHR HKLM-x32\...\Chrome\Extension: [doagiokpgboiomffjfhaiimafndmmpni] - C:\Users\Alex\AppData\Local\Rich Media Player\BrowserExtensions\Chrome\richmediadownloader.crx [2013-07-23] CHR HKLM-x32\...\Chrome\Extension: [ejpbbhjlbipncjklfjjaedaieimbmdda] - C:\Users\Alex\AppData\Local\CRE\ejpbbhjlbipncjklfjjaedaieimbmdda.crx [2012-11-19] CHR HKLM-x32\...\Chrome\Extension: [fjbbjfdilbioabojmcplalojlmdngbjl] - C:\Users\Alex\AppData\Roaming\OpenCandy\AA1258FB8CB1480DBFC4F71273ED1A61\smileyswelovetoolbar.crx [2013-01-05] CHR HKLM-x32\...\Chrome\Extension: [fkcdbkhjcaljlfolhllfneigeepmjfim] - C:\Users\Alex\AppData\Local\Rich Media Player\BrowserExtensions\Chrome\playerextension.crx [2013-02-28] CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-08-06] CHR HKLM-x32\...\Chrome\Extension: [jbolfgndggfhhpbnkgnpjkfhinclbigj] - No Path Or update_url value CHR HKLM-x32\...\Chrome\Extension: [jcdgjdiieiljkfkdcloehkohchhpekkn] - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\External Extensions\{EEE6C373-6118-11DC-9C72-001320C79847}\SweetFB.crx [Not Found] CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14] CHR HKLM-x32\...\Chrome\Extension: [nhogbcndagiknbfomjgdeghehkljalhi] - C:\Program Files (x86)\GreyGray\nhogbcndagiknbfomjgdeghehkljalhi.crx [2013-12-07] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-08-06] (AVAST Software) R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation) R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation) R2 DatamngrCoordinator; C:\Program Files (x86)\Music App\Datamngr\DatamngrCoordinator.exe [3204128 2015-03-23] (Musiclab LLC) S2 globalUpdate; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [68608 2014-07-14] (globalUpdate) [File not signed] <==== ATTENTION S3 globalUpdatem; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [68608 2014-07-14] (globalUpdate) [File not signed] <==== ATTENTION S2 ProtectMonitor; C:\Program Files\PCDApp\StartHelp.exe [65846 2014-06-28] () [File not signed] <==== ATTENTION S4 SrvUpdater; C:\Program Files (x86)\SoftwareUpdater\UpdaterService.exe [29696 2013-11-05] () [File not signed] S4 vToolbarUpdater17.1.3; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\17.1.3\ToolbarUpdater.exe [1643696 2013-11-21] (AVG Secure Search) R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) S2 MBAMScheduler; "C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe" [X] S2 MBAMService; "C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe" [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-08-06] () R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-08-06] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-08-06] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-08-06] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-11-21] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-08-06] (AVAST Software) S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-08-06] (AVAST Software) R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2014-01-22] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-08-06] () R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [46368 2013-11-21] (AVG Technologies) S3 Bthcpk; No ImagePath S3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [30352 2015-04-01] (Disc Soft Ltd) R1 F06DEFF2-5B9C-490D-910F-35D3A91196222; C:\Program Files (x86)\Music App\Datamngr\x64\setmgrc3.cfg [45976 2015-03-23] (Musiclab LLC) S2 SSPORT; C:\Windows\SysWOW64\Drivers\SSPORT.sys [11576 2009-09-10] (Samsung Electronics) R3 ti21sony; C:\Windows\System32\drivers\ti21sony.sys [854528 2010-04-29] (Texas Instruments) S2 DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [X] S3 FairplayKD; \??\C:\ProgramData\MTA San Andreas All\1.3\temp\FairplayKD.sys [X] S3 MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [X] S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X] S3 MBAMWebAccessControl; \??\C:\Windows\system32\drivers\mwac.sys [X] S3 WinRing0_1_2_0; \??\C:\Program Files (x86)\Razer\Razer Game Booster\Driver\WinRing0x64.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-04-18 20:11 - 2015-04-18 20:11 - 00028286 _____ () C:\Users\Alex\Downloads\FRST.txt 2015-04-18 20:11 - 2015-04-18 20:11 - 00000000 ___DC () C:\FRST 2015-04-18 20:10 - 2015-04-18 20:10 - 02098176 _____ (Farbar) C:\Users\Alex\Downloads\FRST64 (2).exe 2015-04-18 20:09 - 2015-04-18 20:09 - 02084395 _____ () C:\Users\Alex\Downloads\FRST64 (1).exe 2015-04-18 20:09 - 2015-04-18 20:09 - 01137664 _____ (Farbar) C:\Users\Alex\Downloads\FRST.exe 2015-04-18 20:06 - 2015-04-18 20:06 - 02095595 _____ (Farbar) C:\Users\Alex\Downloads\FRST64.exe 2015-04-18 09:10 - 2015-04-18 09:10 - 00003424 ____C () C:\bootsqm.dat 2015-04-17 21:49 - 2015-04-18 19:48 - 00001120 _____ () C:\Windows\setupact.log 2015-04-17 21:49 - 2015-04-17 21:49 - 00000000 _____ () C:\Windows\setuperr.log 2015-04-15 17:33 - 2015-03-25 06:24 - 03298816 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll 2015-04-15 17:33 - 2015-03-25 06:24 - 02553856 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll 2015-04-15 17:33 - 2015-03-25 06:24 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll 2015-04-15 17:33 - 2015-03-25 06:24 - 00191488 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll 2015-04-15 17:33 - 2015-03-25 06:24 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll 2015-04-15 17:33 - 2015-03-25 06:24 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll 2015-04-15 17:33 - 2015-03-25 06:24 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll 2015-04-15 17:33 - 2015-03-25 06:24 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll 2015-04-15 17:33 - 2015-03-25 06:23 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe 2015-04-15 17:33 - 2015-03-25 06:23 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe 2015-04-15 17:33 - 2015-03-25 06:23 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll 2015-04-15 17:33 - 2015-03-25 06:00 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll 2015-04-15 17:33 - 2015-03-25 06:00 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll 2015-04-15 17:33 - 2015-03-25 06:00 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll 2015-04-15 17:33 - 2015-03-25 06:00 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe 2015-04-15 17:33 - 2015-03-25 06:00 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll 2015-04-15 17:33 - 2015-03-17 08:22 - 05557696 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-04-15 17:33 - 2015-03-17 08:22 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2015-04-15 17:33 - 2015-03-17 08:22 - 00095672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2015-04-15 17:33 - 2015-03-17 08:19 - 01727904 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2015-04-15 17:33 - 2015-03-17 08:17 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll 2015-04-15 17:33 - 2015-03-17 08:17 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll 2015-04-15 17:33 - 2015-03-17 08:17 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll 2015-04-15 17:33 - 2015-03-17 08:16 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2015-04-15 17:33 - 2015-03-17 08:16 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll 2015-04-15 17:33 - 2015-03-17 08:16 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2015-04-15 17:33 - 2015-03-17 08:16 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll 2015-04-15 17:33 - 2015-03-17 08:16 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll 2015-04-15 17:33 - 2015-03-17 08:16 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2015-04-15 17:33 - 2015-03-17 08:16 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2015-04-15 17:33 - 2015-03-17 08:16 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2015-04-15 17:33 - 2015-03-17 08:16 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe 2015-04-15 17:33 - 2015-03-17 08:16 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll 2015-04-15 17:33 - 2015-03-17 08:16 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2015-04-15 17:33 - 2015-03-17 08:16 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2015-04-15 17:33 - 2015-03-17 08:16 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe 2015-04-15 17:33 - 2015-03-17 08:16 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2015-04-15 17:33 - 2015-03-17 08:16 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll 2015-04-15 17:33 - 2015-03-17 08:16 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll 2015-04-15 17:33 - 2015-03-17 08:16 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2015-04-15 17:33 - 2015-03-17 08:16 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2015-04-15 17:33 - 2015-03-17 08:16 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2015-04-15 17:33 - 2015-03-17 08:16 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll 2015-04-15 17:33 - 2015-03-17 08:15 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe 2015-04-15 17:33 - 2015-03-17 08:15 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe 2015-04-15 17:33 - 2015-03-17 08:15 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2015-04-15 17:33 - 2015-03-17 08:11 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll 2015-04-15 17:33 - 2015-03-17 08:11 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 08:11 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 08:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 08:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 08:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 08:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 08:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 08:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 08:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 08:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 08:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 08:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 08:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 08:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 08:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 08:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 08:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 08:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 08:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 08:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 08:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 08:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 08:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 08:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 08:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 08:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 08:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 08:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 08:01 - 03976632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2015-04-15 17:33 - 2015-03-17 08:01 - 03920824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2015-04-15 17:33 - 2015-03-17 07:59 - 01309696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll 2015-04-15 17:33 - 2015-03-17 07:57 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2015-04-15 17:33 - 2015-03-17 07:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2015-04-15 17:33 - 2015-03-17 07:57 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2015-04-15 17:33 - 2015-03-17 07:57 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2015-04-15 17:33 - 2015-03-17 07:57 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2015-04-15 17:33 - 2015-03-17 07:57 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2015-04-15 17:33 - 2015-03-17 07:57 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll 2015-04-15 17:33 - 2015-03-17 07:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2015-04-15 17:33 - 2015-03-17 07:57 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll 2015-04-15 17:33 - 2015-03-17 07:56 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll 2015-04-15 17:33 - 2015-03-17 07:56 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll 2015-04-15 17:33 - 2015-03-17 07:56 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2015-04-15 17:33 - 2015-03-17 07:56 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe 2015-04-15 17:33 - 2015-03-17 07:56 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe 2015-04-15 17:33 - 2015-03-17 07:56 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2015-04-15 17:33 - 2015-03-17 07:56 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll 2015-04-15 17:33 - 2015-03-17 07:50 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll 2015-04-15 17:33 - 2015-03-17 07:50 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 07:50 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 07:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 07:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 07:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 07:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 07:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 07:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 07:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 07:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 07:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 07:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 07:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 07:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 07:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 07:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 07:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 07:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 07:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 07:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 07:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 07:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 07:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 07:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 06:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe 2015-04-15 17:33 - 2015-03-17 06:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe 2015-04-15 17:33 - 2015-03-17 06:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 06:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 06:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll 2015-04-15 17:33 - 2015-03-17 06:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll 2015-04-15 17:33 - 2015-03-10 06:25 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll 2015-04-15 17:33 - 2015-03-10 06:21 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll 2015-04-15 17:33 - 2015-03-10 06:08 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll 2015-04-15 17:33 - 2015-03-10 06:05 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll 2015-04-15 17:33 - 2015-03-05 08:12 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2015-04-15 17:33 - 2015-03-05 07:05 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2015-04-15 17:32 - 2015-04-02 02:49 - 00342704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2015-04-15 17:32 - 2015-03-17 08:13 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll 2015-04-15 17:32 - 2015-03-17 08:13 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll 2015-04-15 17:32 - 2015-03-17 08:11 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll 2015-04-15 17:32 - 2015-03-17 07:53 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll 2015-04-15 17:32 - 2015-03-17 07:53 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll 2015-04-15 17:32 - 2015-03-17 07:50 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll 2015-04-15 17:32 - 2015-03-13 07:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2015-04-15 17:32 - 2015-03-13 07:08 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2015-04-15 17:32 - 2015-03-13 06:59 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2015-04-15 17:32 - 2015-03-13 06:54 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2015-04-15 17:32 - 2015-03-13 06:27 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2015-04-15 17:32 - 2015-03-13 06:26 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2015-04-15 17:32 - 2015-03-13 06:20 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2015-04-15 17:32 - 2015-03-13 06:08 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2015-04-15 17:32 - 2015-03-13 06:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2015-04-15 17:32 - 2015-03-13 05:56 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2015-04-15 17:32 - 2015-03-13 05:16 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2015-04-15 17:32 - 2015-02-25 06:18 - 00754688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys 2015-04-15 17:31 - 2015-04-02 03:17 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2015-04-15 17:31 - 2015-03-13 07:32 - 24980480 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-04-15 17:31 - 2015-03-13 07:25 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2015-04-15 17:31 - 2015-03-13 07:09 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2015-04-15 17:31 - 2015-03-13 07:08 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-04-15 17:31 - 2015-03-13 07:08 - 00417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2015-04-15 17:31 - 2015-03-13 07:07 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-04-15 17:31 - 2015-03-13 07:06 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2015-04-15 17:31 - 2015-03-13 07:00 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2015-04-15 17:31 - 2015-03-13 06:55 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2015-04-15 17:31 - 2015-03-13 06:54 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2015-04-15 17:31 - 2015-03-13 06:53 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2015-04-15 17:31 - 2015-03-13 06:50 - 06025216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2015-04-15 17:31 - 2015-03-13 06:44 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2015-04-15 17:31 - 2015-03-13 06:42 - 19695616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2015-04-15 17:31 - 2015-03-13 06:42 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2015-04-15 17:31 - 2015-03-13 06:40 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2015-04-15 17:31 - 2015-03-13 06:32 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2015-04-15 17:31 - 2015-03-13 06:28 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2015-04-15 17:31 - 2015-03-13 06:28 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2015-04-15 17:31 - 2015-03-13 06:27 - 00340992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec 2015-04-15 17:31 - 2015-03-13 06:27 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2015-04-15 17:31 - 2015-03-13 06:26 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-04-15 17:31 - 2015-03-13 06:23 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2015-04-15 17:31 - 2015-03-13 06:22 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2015-04-15 17:31 - 2015-03-13 06:20 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2015-04-15 17:31 - 2015-03-13 06:17 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2015-04-15 17:31 - 2015-03-13 06:16 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2015-04-15 17:31 - 2015-03-13 06:15 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2015-04-15 17:31 - 2015-03-13 06:07 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-04-15 17:31 - 2015-03-13 06:06 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2015-04-15 17:31 - 2015-03-13 06:05 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-04-15 17:31 - 2015-03-13 06:05 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2015-04-15 17:31 - 2015-03-13 06:00 - 14397440 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-04-15 17:31 - 2015-03-13 05:57 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2015-04-15 17:31 - 2015-03-13 05:54 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2015-04-15 17:31 - 2015-03-13 05:49 - 04305408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2015-04-15 17:31 - 2015-03-13 05:45 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-04-15 17:31 - 2015-03-13 05:44 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2015-04-15 17:31 - 2015-03-13 05:43 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2015-04-15 17:31 - 2015-03-13 05:42 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2015-04-15 17:31 - 2015-03-13 05:34 - 12825600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2015-04-15 17:31 - 2015-03-13 05:33 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-04-15 17:31 - 2015-03-13 05:22 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2015-04-15 17:31 - 2015-03-13 05:20 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2015-04-15 17:31 - 2015-03-13 05:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2015-04-15 17:30 - 2015-03-04 07:55 - 00367552 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys 2015-04-15 17:30 - 2015-03-04 07:41 - 00079360 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll 2015-04-15 17:30 - 2015-03-04 07:10 - 00058880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clfsw32.dll 2015-04-14 13:23 - 2014-03-10 00:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe 2015-04-14 13:23 - 2014-03-10 00:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll 2015-04-14 13:23 - 2014-03-10 00:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe 2015-04-14 13:23 - 2014-03-10 00:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll 2015-04-14 13:22 - 2014-07-01 01:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll 2015-04-14 13:22 - 2014-07-01 01:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll 2015-04-14 13:21 - 2014-06-06 09:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe 2015-04-14 13:21 - 2014-06-06 09:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe 2015-04-13 10:27 - 2015-02-20 07:41 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll 2015-04-13 10:27 - 2015-02-20 07:40 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll 2015-04-13 10:27 - 2015-02-20 07:40 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll 2015-04-13 10:27 - 2015-02-20 07:40 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll 2015-04-13 10:27 - 2015-02-20 07:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll 2015-04-13 10:27 - 2015-02-20 07:13 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll 2015-04-13 10:27 - 2015-02-20 07:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll 2015-04-13 10:27 - 2015-02-20 07:12 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll 2015-04-13 10:27 - 2015-02-20 06:29 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll 2015-04-13 10:27 - 2015-02-20 06:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll 2015-04-13 10:27 - 2014-12-11 20:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe 2015-04-13 10:27 - 2014-04-25 05:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll 2015-04-13 10:27 - 2014-04-25 05:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll 2015-04-13 10:26 - 2015-02-03 06:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll 2015-04-13 10:26 - 2015-02-03 06:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll 2015-04-13 10:26 - 2015-02-03 06:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll 2015-04-13 10:26 - 2015-02-03 06:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2015-04-13 10:26 - 2015-02-03 06:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll 2015-04-13 10:26 - 2015-02-03 06:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll 2015-04-13 10:26 - 2015-02-03 06:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll 2015-04-13 10:26 - 2015-02-03 06:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll 2015-04-13 10:26 - 2015-02-03 06:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll 2015-04-13 10:26 - 2015-02-03 06:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll 2015-04-13 10:26 - 2015-02-03 06:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll 2015-04-13 10:26 - 2015-02-03 06:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll 2015-04-13 10:26 - 2015-02-03 06:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll 2015-04-13 10:26 - 2015-02-03 06:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll 2015-04-13 10:26 - 2015-02-03 06:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll 2015-04-13 10:26 - 2015-02-03 06:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll 2015-04-13 10:26 - 2015-02-03 06:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll 2015-04-13 10:26 - 2015-02-03 06:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll 2015-04-13 10:26 - 2015-02-03 06:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll 2015-04-13 10:26 - 2015-02-03 06:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll 2015-04-13 10:26 - 2015-02-03 06:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll 2015-04-13 10:26 - 2015-02-03 06:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll 2015-04-13 10:26 - 2015-02-03 06:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll 2015-04-13 10:26 - 2015-02-03 06:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll 2015-04-13 10:26 - 2015-02-03 06:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx 2015-04-13 10:26 - 2015-02-03 06:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll 2015-04-13 10:26 - 2015-02-03 06:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL 2015-04-13 10:26 - 2015-02-03 06:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe 2015-04-13 10:26 - 2015-02-03 06:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe 2015-04-13 10:26 - 2015-02-03 06:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll 2015-04-13 10:25 - 2015-02-03 06:34 - 00693176 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi 2015-04-13 10:25 - 2015-02-03 06:34 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys 2015-04-13 10:25 - 2015-02-03 06:33 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi 2015-04-13 10:25 - 2015-02-03 06:31 - 14632960 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll 2015-04-13 10:25 - 2015-02-03 06:31 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll 2015-04-13 10:25 - 2015-02-03 06:31 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll 2015-04-13 10:25 - 2015-02-03 06:31 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll 2015-04-13 10:25 - 2015-02-03 06:31 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll 2015-04-13 10:25 - 2015-02-03 06:31 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll 2015-04-13 10:25 - 2015-02-03 06:31 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll 2015-04-13 10:25 - 2015-02-03 06:31 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll 2015-04-13 10:25 - 2015-02-03 06:31 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll 2015-04-13 10:25 - 2015-02-03 06:31 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll 2015-04-13 10:25 - 2015-02-03 06:31 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll 2015-04-13 10:25 - 2015-02-03 06:31 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll 2015-04-13 10:25 - 2015-02-03 06:31 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll 2015-04-13 10:25 - 2015-02-03 06:31 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll 2015-04-13 10:25 - 2015-02-03 06:31 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll 2015-04-13 10:25 - 2015-02-03 06:31 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll 2015-04-13 10:25 - 2015-02-03 06:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx 2015-04-13 10:25 - 2015-02-03 06:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll 2015-04-13 10:25 - 2015-02-03 06:30 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL 2015-04-13 10:25 - 2015-02-03 06:30 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2015-04-13 10:25 - 2015-02-03 06:30 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll 2015-04-13 10:25 - 2015-02-03 06:30 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll 2015-04-13 10:25 - 2015-02-03 06:30 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll 2015-04-13 10:25 - 2015-02-03 06:30 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll 2015-04-13 10:25 - 2015-02-03 06:30 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll 2015-04-13 10:25 - 2015-02-03 06:30 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll 2015-04-13 10:25 - 2015-02-03 06:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll 2015-04-13 10:25 - 2015-02-03 06:30 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll 2015-04-13 10:25 - 2015-02-03 06:30 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll 2015-04-13 10:25 - 2015-02-03 06:30 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll 2015-04-13 10:25 - 2015-02-03 06:30 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe 2015-04-13 10:25 - 2015-02-03 06:30 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll 2015-04-13 10:25 - 2015-02-03 06:30 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe 2015-04-13 10:25 - 2015-02-03 06:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll 2015-04-13 10:25 - 2015-02-03 06:30 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll 2015-04-13 10:25 - 2015-02-03 06:30 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe 2015-04-13 10:25 - 2015-02-03 06:30 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll 2015-04-13 10:25 - 2015-02-03 06:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe 2015-04-13 10:25 - 2015-02-03 06:30 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe 2015-04-13 10:25 - 2015-02-03 06:30 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe 2015-04-13 10:25 - 2015-02-03 06:30 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe 2015-04-13 10:25 - 2015-02-03 06:29 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll 2015-04-13 10:25 - 2015-02-03 06:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll 2015-04-13 10:25 - 2015-02-03 06:19 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys 2015-04-13 10:25 - 2015-02-03 05:32 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys 2015-04-13 10:25 - 2014-11-01 01:24 - 00619056 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe 2015-04-13 10:25 - 2014-06-28 03:21 - 00532176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe 2015-04-13 10:25 - 2014-06-28 03:21 - 00457400 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll 2015-04-13 10:24 - 2014-12-19 06:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll 2015-04-13 10:24 - 2014-06-19 01:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll 2015-04-13 10:24 - 2014-06-19 01:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll 2015-04-13 10:24 - 2014-06-19 01:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll 2015-04-13 10:24 - 2014-06-19 01:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll 2015-04-13 10:24 - 2014-06-19 01:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll 2015-04-13 10:24 - 2014-06-19 01:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll 2015-04-13 10:22 - 2014-04-05 05:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys 2015-04-13 10:22 - 2014-04-05 05:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS 2015-04-13 10:22 - 2014-01-29 05:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll 2015-04-13 10:22 - 2014-01-29 05:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll 2015-04-13 10:22 - 2013-11-26 14:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys 2015-04-13 10:22 - 2013-10-19 05:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll 2015-04-13 10:22 - 2013-10-19 04:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll 2015-04-13 10:21 - 2014-10-14 05:13 - 00683520 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll 2015-04-13 10:20 - 2014-12-06 07:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll 2015-04-13 10:20 - 2014-12-06 06:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll 2015-04-13 10:20 - 2014-12-06 06:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll 2015-04-13 10:20 - 2014-03-26 17:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll 2015-04-13 10:20 - 2014-03-26 17:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll 2015-04-13 10:20 - 2014-03-26 17:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll 2015-04-13 10:20 - 2014-03-26 17:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll 2015-04-13 10:19 - 2015-02-13 08:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2015-04-13 10:19 - 2015-02-13 08:22 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2015-04-13 10:19 - 2015-02-03 06:31 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll 2015-04-13 10:19 - 2015-02-03 06:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll 2015-04-13 10:19 - 2014-12-19 04:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys 2015-04-13 10:19 - 2014-06-18 05:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe 2015-04-13 10:19 - 2014-06-18 04:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe 2015-04-13 10:19 - 2014-06-06 13:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll 2015-04-13 10:19 - 2014-06-06 12:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll 2015-04-13 10:19 - 2014-05-30 09:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys 2015-04-13 10:19 - 2013-11-27 04:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys 2015-04-13 10:19 - 2013-11-27 04:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys 2015-04-13 10:19 - 2013-11-27 04:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys 2015-04-13 10:19 - 2013-11-27 04:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys 2015-04-13 10:19 - 2013-11-27 04:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys 2015-04-13 10:19 - 2013-11-27 04:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys 2015-04-13 10:19 - 2013-11-27 04:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys 2015-04-13 10:19 - 2013-10-04 05:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys 2015-04-13 10:19 - 2013-10-04 04:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys 2015-04-13 10:18 - 2014-06-03 13:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll 2015-04-13 10:18 - 2014-06-03 13:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll 2015-04-13 10:18 - 2014-06-03 13:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll 2015-04-13 10:18 - 2014-06-03 13:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe 2015-04-13 10:18 - 2014-06-03 12:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll 2015-04-13 10:18 - 2014-06-03 12:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll 2015-04-13 10:18 - 2014-06-03 12:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll 2015-04-13 10:17 - 2014-03-04 12:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll 2015-04-13 10:17 - 2014-03-04 12:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll 2015-04-13 10:17 - 2014-03-04 12:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll 2015-04-13 10:17 - 2014-03-04 12:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll 2015-04-13 10:17 - 2014-03-04 12:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll 2015-04-13 10:17 - 2014-03-04 12:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll 2015-04-13 10:17 - 2014-03-04 12:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll 2015-04-13 10:17 - 2014-03-04 12:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll 2015-04-13 10:17 - 2014-03-04 12:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll 2015-04-13 10:17 - 2014-03-04 12:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll 2015-04-13 10:17 - 2014-03-04 12:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll 2015-04-13 10:17 - 2014-03-04 12:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll 2015-04-13 10:17 - 2014-03-04 12:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll 2015-04-13 10:17 - 2014-03-04 12:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll 2015-04-13 10:16 - 2014-08-12 05:02 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL 2015-04-13 10:16 - 2014-08-12 04:36 - 00701440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IMJP10K.DLL 2015-04-13 10:16 - 2014-06-16 05:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys 2015-04-13 10:16 - 2013-12-25 02:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll 2015-04-13 10:16 - 2013-12-25 01:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll 2015-04-13 10:16 - 2013-11-26 11:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll 2015-04-13 10:16 - 2013-11-23 01:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll 2015-04-13 10:15 - 2015-01-31 02:56 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2015-04-13 10:15 - 2014-11-11 05:44 - 00186880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll 2015-04-13 10:14 - 2015-01-17 05:48 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll 2015-04-13 10:14 - 2015-01-17 05:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll 2015-04-13 10:14 - 2014-11-11 06:08 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll 2015-04-13 10:14 - 2014-09-04 08:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll 2015-04-13 10:14 - 2014-09-04 08:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll 2015-04-13 10:13 - 2015-02-03 06:31 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2015-04-13 10:13 - 2015-02-03 06:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2015-04-13 10:12 - 2014-10-25 04:57 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll 2015-04-13 10:12 - 2014-10-25 04:32 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll 2015-04-13 10:12 - 2014-07-17 04:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll 2015-04-13 10:12 - 2014-07-17 04:39 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll 2015-04-13 10:12 - 2014-07-17 04:39 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe 2015-04-13 10:12 - 2014-07-17 04:39 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll 2015-04-13 10:11 - 2014-07-17 05:07 - 03722240 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll 2015-04-13 10:11 - 2014-07-17 05:07 - 01118720 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe 2015-04-13 10:11 - 2014-07-17 05:07 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe 2015-04-13 10:11 - 2014-07-17 05:07 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll 2015-04-13 10:11 - 2014-07-17 05:07 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll 2015-04-13 10:11 - 2014-07-17 04:21 - 00212480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys 2015-04-13 10:11 - 2014-07-17 04:21 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys 2015-04-13 10:10 - 2015-02-26 06:25 - 03204096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2015-04-13 10:10 - 2014-12-08 06:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll 2015-04-13 10:10 - 2014-12-08 05:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll 2015-04-13 10:09 - 2013-10-12 05:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx 2015-04-13 10:09 - 2013-10-12 05:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll 2015-04-13 10:09 - 2013-10-12 05:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx 2015-04-13 10:09 - 2013-10-12 05:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll 2015-04-13 10:09 - 2013-10-12 04:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe 2015-04-13 10:09 - 2013-10-12 04:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe 2015-04-13 10:09 - 2013-10-12 04:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe 2015-04-13 10:09 - 2013-10-12 04:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe 2015-04-13 10:08 - 2014-10-18 05:05 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll 2015-04-13 10:08 - 2014-10-18 04:33 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll 2015-04-13 10:06 - 2015-02-04 06:16 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll 2015-04-13 10:06 - 2015-02-04 05:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll 2015-04-13 10:06 - 2014-07-14 05:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll 2015-04-13 10:06 - 2014-07-14 04:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll 2015-04-11 22:41 - 2015-04-12 20:48 - 00001303 ____C () C:\autoupdate.log 2015-04-11 19:19 - 2015-04-11 19:19 - 00003170 _____ () C:\Windows\System32\Tasks\Razer_Game_Booster_AutoUpdate 2015-04-11 19:17 - 2015-04-11 19:17 - 00000000 ____D () C:\Users\Alex\AppData\Local\Razer 2015-04-08 23:17 - 2015-04-12 00:29 - 00000000 ____D () C:\Users\Alex\Downloads\As Above So Below 2014 BRRip XviD AC3-GiANGi 2015-04-08 17:35 - 2015-04-08 17:35 - 00000000 ____D () C:\Users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Drakensang Online 2015-04-06 22:48 - 2015-04-06 22:48 - 00000000 ____D () C:\Users\Alex\AppData\Local\UsernameScraper 2015-04-06 13:23 - 2015-04-06 13:23 - 00000000 ____D () C:\Users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Minecraft 2015-04-05 19:17 - 2015-04-18 19:49 - 00000000 ____D () C:\ProgramData\Datamngr 2015-04-04 17:37 - 2008-12-24 23:43 - 00000583 _____ () C:\Users\Alex\Desktop\Shortcut to s3tdl.lnk 2015-04-01 23:04 - 2015-04-07 18:52 - 00000000 ____D () C:\Users\Alex\AppData\Local\Math Problem Solver 2015-04-01 23:04 - 2015-04-01 23:04 - 00003266 _____ () C:\Windows\System32\Tasks\Math Problem Solver CPU 2015-04-01 23:03 - 2015-04-01 23:03 - 00003326 _____ () C:\Windows\System32\Tasks\SidebarExecute 2015-04-01 23:02 - 2015-04-01 23:17 - 00030352 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtlitescsibus.sys 2015-04-01 23:00 - 2015-04-18 19:49 - 00000004 _____ () C:\Windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7 2015-04-01 22:00 - 2015-04-18 20:00 - 00001318 _____ () C:\Windows\Tasks\fun_coupons_notification_service.job 2015-04-01 22:00 - 2015-04-18 19:49 - 00000680 _____ () C:\Windows\Tasks\fun_coupons_updating_service.job 2015-04-01 22:00 - 2015-04-01 22:00 - 00004336 _____ () C:\Windows\System32\Tasks\fun_coupons_notification_service 2015-04-01 22:00 - 2015-04-01 22:00 - 00003700 _____ () C:\Windows\System32\Tasks\fun_coupons_updating_service 2015-04-01 22:00 - 2015-04-01 22:00 - 00000000 ____D () C:\Program Files (x86)\fun coupons 2015-03-31 18:16 - 2015-03-31 18:16 - 00000000 ____D () C:\Users\Alex\Desktop\runtime 2015-03-31 18:15 - 2015-03-31 18:16 - 00000000 ____D () C:\Users\Alex\Desktop\game 2015-03-31 17:57 - 2015-04-14 21:31 - 00000000 ____D () C:\Users\Alex\AppData\Roaming\.minecraft 2015-03-31 17:56 - 2015-03-31 17:56 - 01294088 _____ (Mojang) C:\Users\Alex\Desktop\Minecraft.exe 2015-03-29 23:06 - 2015-03-29 23:06 - 00000000 _____ () C:\Users\Alex\Desktop\LK.txt 2015-03-26 20:23 - 2015-03-26 20:23 - 00000000 ____D () C:\ProgramData\Package Cache 2015-03-26 20:19 - 2015-03-26 20:19 - 00001534 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Application Manager.lnk 2015-03-26 20:09 - 2015-03-28 22:01 - 00000000 ____D () C:\Program Files\Adobe 2015-03-26 19:04 - 2015-03-26 19:04 - 00000000 ____D () C:\ProgramData\Macrovision 2015-03-24 19:25 - 2015-03-24 19:25 - 05033196 _____ () C:\Users\Alex\AppData\Roaming\Nodus.exe 2015-03-24 18:59 - 2015-03-24 18:59 - 00000000 _____ () C:\Users\Alex\AppData\Local\{3399808B-047B-457A-8CF1-3174F9060776} 2015-03-20 14:29 - 2015-03-20 14:29 - 00000000 _____ () C:\Users\Alex\AppData\Local\{61C5ED79-C78C-482F-B096-7410397FC35F} ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-04-18 20:11 - 2012-12-23 19:20 - 00000000 ____D () C:\Users\Alex\AppData\Roaming\uTorrent 2015-04-18 20:11 - 2009-07-14 07:45 - 00015184 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-04-18 20:11 - 2009-07-14 07:45 - 00015184 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-04-18 19:55 - 2014-07-14 09:55 - 00001440 _____ () C:\Windows\Tasks\510acaa5-1572-4a90-a2e3-bc2e22a40657-7.job 2015-04-18 19:53 - 2014-03-11 19:31 - 01467913 _____ () C:\Windows\WindowsUpdate.log 2015-04-18 19:52 - 2012-12-23 21:03 - 00000000 ____D () C:\Users\Alex\AppData\Roaming\Skype 2015-04-18 19:51 - 2012-12-23 19:56 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update 2015-04-18 19:50 - 2014-07-14 09:56 - 00000000 ____D () C:\Program Files\PCDApp 2015-04-18 19:50 - 2014-07-14 09:55 - 00002760 _____ () C:\Windows\Tasks\510acaa5-1572-4a90-a2e3-bc2e22a40657-3.job 2015-04-18 19:49 - 2014-07-14 09:56 - 00001436 _____ () C:\Windows\Tasks\510acaa5-1572-4a90-a2e3-bc2e22a40657-5_user.job 2015-04-18 19:49 - 2014-07-14 09:56 - 00001416 _____ () C:\Windows\Tasks\510acaa5-1572-4a90-a2e3-bc2e22a40657-5.job 2015-04-18 19:49 - 2014-07-14 09:56 - 00001252 _____ () C:\Windows\Tasks\510acaa5-1572-4a90-a2e3-bc2e22a40657-10.job 2015-04-18 19:49 - 2014-07-14 09:55 - 00002166 _____ () C:\Windows\Tasks\510acaa5-1572-4a90-a2e3-bc2e22a40657-4.job 2015-04-18 19:49 - 2014-07-14 09:55 - 00001498 _____ () C:\Windows\Tasks\510acaa5-1572-4a90-a2e3-bc2e22a40657-6.job 2015-04-18 19:49 - 2014-07-14 09:55 - 00001498 _____ () C:\Windows\Tasks\510acaa5-1572-4a90-a2e3-bc2e22a40657-1.job 2015-04-18 19:49 - 2014-07-14 09:55 - 00000932 _____ () C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job 2015-04-18 19:49 - 2014-07-14 09:55 - 00000566 _____ () C:\Windows\Tasks\510acaa5-1572-4a90-a2e3-bc2e22a40657-11.job 2015-04-18 19:49 - 2014-07-14 09:49 - 00000356 _____ () C:\Windows\Tasks\AmiUpdXp.job 2015-04-18 19:49 - 2013-03-30 22:13 - 00000374 _____ () C:\Windows\Tasks\SmartPCFix Task.job 2015-04-18 19:49 - 2012-12-23 19:35 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-04-18 19:49 - 2009-07-14 08:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-04-18 19:31 - 2012-12-23 19:35 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-04-18 10:20 - 2014-10-19 12:15 - 00002239 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2015-04-18 10:15 - 2014-07-14 09:55 - 00000936 _____ () C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job 2015-04-17 21:47 - 2013-03-17 20:36 - 00000000 ____D () C:\Users\Alex\AppData\Local\CrashDumps 2015-04-14 20:28 - 2009-07-14 08:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD 2015-04-14 20:28 - 2009-07-14 07:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk 2015-04-14 20:21 - 2014-02-08 16:55 - 00267672 _____ () C:\Windows\system32\FNTCACHE.DAT 2015-04-14 20:18 - 2009-07-14 10:12 - 00000000 ____D () C:\Program Files\Windows Journal 2015-04-14 20:18 - 2009-07-14 06:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism 2015-04-14 20:18 - 2009-07-14 06:20 - 00000000 ____D () C:\Windows\system32\Dism 2015-04-14 20:17 - 2009-07-14 06:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2015-04-13 18:48 - 2009-07-14 06:20 - 00000000 ____D () C:\Windows\rescache 2015-04-13 18:37 - 2009-07-14 08:08 - 00032646 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2015-04-13 17:57 - 2012-12-23 21:02 - 00000000 ____D () C:\ProgramData\Skype 2015-04-12 21:07 - 2014-02-23 10:27 - 00035708 _____ () C:\Windows\PFRO.log 2015-04-12 20:06 - 2014-07-14 09:55 - 00000000 ____D () C:\Program Files (x86)\HD-V1.9 2015-04-10 18:10 - 2013-05-27 21:21 - 00000228 _____ () C:\Users\Alex\Desktop\New Text Document.txt 2015-04-08 17:35 - 2014-07-07 13:35 - 00001972 _____ () C:\Users\Alex\Desktop\Drakensang Online.lnk 2015-04-08 17:35 - 2014-02-17 22:12 - 00000000 ____D () C:\Program Files (x86)\Drakensang Online 2015-04-07 18:53 - 2014-11-23 14:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype 2015-04-07 18:53 - 2014-03-23 10:34 - 00002697 _____ () C:\Users\Public\Desktop\Skype.lnk 2015-04-01 23:22 - 2013-02-20 16:44 - 00000000 ____D () C:\Users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games 2015-04-01 23:18 - 2014-04-11 19:26 - 00000000 ____D () C:\Users\Alex\AppData\Roaming\DAEMON Tools Lite 2015-03-28 22:02 - 2013-06-11 20:53 - 00000000 ____D () C:\Program Files\Common Files\Adobe 2015-03-28 22:02 - 2012-12-24 10:28 - 00000000 ____D () C:\Program Files (x86)\Adobe 2015-03-26 20:46 - 2012-12-24 00:07 - 00000000 ____D () C:\Users\Alex\AppData\Roaming\Adobe 2015-03-26 20:45 - 2012-12-24 10:33 - 00000000 ____D () C:\Users\Alex\AppData\Local\Adobe 2015-03-26 19:06 - 2012-12-23 21:20 - 00000000 ____D () C:\ProgramData\Adobe ==================== Files in the root of some directories ======= 2013-12-12 18:56 - 2013-12-12 19:35 - 0002327 _____ () C:\Users\Alex\AppData\Roaming\LiveSupport.exe_log.txt 2015-03-24 19:25 - 2015-03-24 19:25 - 5033196 _____ () C:\Users\Alex\AppData\Roaming\Nodus.exe 2013-12-12 18:56 - 2013-12-12 19:35 - 0000092 _____ () C:\Users\Alex\AppData\Roaming\regsvr32.exe_log.txt 2013-02-26 17:51 - 2013-02-26 17:54 - 0033134 _____ () C:\Users\Alex\AppData\Roaming\UserTile.png 2015-03-24 18:59 - 2015-03-24 18:59 - 0000000 _____ () C:\Users\Alex\AppData\Local\{3399808B-047B-457A-8CF1-3174F9060776} 2014-05-10 17:14 - 2014-05-10 17:14 - 0000000 _____ () C:\Users\Alex\AppData\Local\{3CF7BF87-991D-47D9-93CE-821B2A458A42} 2015-03-20 14:29 - 2015-03-20 14:29 - 0000000 _____ () C:\Users\Alex\AppData\Local\{61C5ED79-C78C-482F-B096-7410397FC35F} ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2013-11-28 00:14 ==================== End Of Log ============================ И ако може да ми кажете как да къча Addition
  8. Днес ми се наложи да опитам да открия проблема в един компютър с Windows 7, но не намерих решение. Проблема се изразява в това: потребителски файлове, предимно такива, които са на десктопа и са били оригинално с разширения zip, rar, doc и pdf, са придобили нови разширения след първоначалното име на файла- разширението е NMIFHCN. Така получените файлове на практика са станали неизпозваеми, като премахването на това непонятно разширение и връщането на предполагаемото старо, не дава ефект- файла продължава да е неизползваем. Сканиране с Security Essentials и MBAM не дава наличие на зарази. Връщането със System Restore също не променя нещата. Какво може да е? За съжаление компютъра е служебен и сега нямам възможност да правя други сканирания, ако е нужно- евентуално би могло да стане утре. Просто искам засега да получа информация какво може да е довело до тези разширения на файловете, понеже в интернет не намирам информация за такова- NMIFHCN. Благодаря предварително.
  9. Здравейте! Реших да направя едно контролно сканиране за вируси понеже отдавна PC-то не е проверявано. Ето лога от FRST.txt Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-02-2015 Ran by USER (administrator) on USER-PC on 02-02-2015 12:14:28 Running from C:\Users\USER\Desktop Loaded Profiles: USER (Available profiles: USER) Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: English (United States) Internet Explorer Version 10 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe (IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe () D:\Install\Testing Tools\quietHDD\quietHDD.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Fork, Ltd.) C:\Windows\Prey\wpxsvc.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe (IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe (ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe (Joyent, Inc) C:\Windows\Prey\versions\1.3.6\bin\node.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe (Fork, Ltd.) C:\Windows\Prey\versions\1.3.6\node_modules\triggers\bin\lightevt.exe (HP) C:\Windows\System32\HPSIsvc.exe (Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [5595336 2014-10-01] (ESET) HKLM-x32\...\Run: [uSB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-03-27] (Intel Corporation) HKLM-x32\...\Run: [QLBController] => C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe [322432 2012-04-04] (Hewlett-Packard Company) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [btTray] => C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe [387832 2013-05-14] (IVT Corporation) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-2316775370-2964681540-2297035872-1000\...\Run: [skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30872672 2014-12-11] (Skype Technologies S.A.) HKU\S-1-5-21-2316775370-2964681540-2297035872-1000\...\MountPoints2: F - F:\SISetup.exe HKU\S-1-5-21-2316775370-2964681540-2297035872-1000\...\MountPoints2: {947222fa-a1c7-11e2-80e6-b4b52f788ef4} - F:\setup.exe AppInit_DLLs: C:\Windows\Jaksta\AC\x64\jaudcap.dll => C:\Windows\Jaksta\AC\x64\jaudcap.dll [311584 2014-05-16] (Jaksta Technologies Pty Ltd) Startup: C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\quietHDD.lnk ShortcutTarget: quietHDD.lnk -> D:\Install\Testing Tools\quietHDD\quietHDD.exe () ShellIconOverlayIdentifiers: [shareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft) ShellIconOverlayIdentifiers-x32: [ MailRuCloudIconOverlay0] -> {64A9418A-B6B1-4112-B75C-E61633C9A31F} => No File ShellIconOverlayIdentifiers-x32: [ MailRuCloudIconOverlay1] -> {6A2E142B-EA63-433A-AC05-5223CBD26E65} => No File ShellIconOverlayIdentifiers-x32: [ MailRuCloudIconOverlay2] -> {6AFCC535-2F12-4F50-9F0A-1CF856CFC95D} => No File ShellIconOverlayIdentifiers-x32: [shareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) ProxyServer: [s-1-5-21-2316775370-2964681540-2297035872-1000] => https=127.0.0.1:54745 HKU\S-1-5-21-2316775370-2964681540-2297035872-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bg/ HKU\S-1-5-21-2316775370-2964681540-2297035872-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp SearchScopes: HKU\S-1-5-21-2316775370-2964681540-2297035872-1000 -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft) BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft) Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft) Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft) Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 Tcpip\..\Interfaces\{3D41CC7B-1CA0-4A34-B378-EF83D183B83F}: [NameServer] 8.8.8.8,8.8.4.4 Tcpip\..\Interfaces\{42A1B73C-2FD5-4744-A1AC-DD4C68DBB756}: [NameServer] 8.8.8.8,8.8.4.4 FireFox: ======== FF ProfilePath: C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\mluugfdi.default FF NewTab: google.bg FF Homepage: hxxp://www.google.bg/ FF Keyword.URL: https://www.google.com/search?q= FF NetworkProxy: "backup.ftp", "127.0.0.1" FF NetworkProxy: "backup.ftp_port", 9050 FF NetworkProxy: "backup.socks", "127.0.0.1" FF NetworkProxy: "backup.socks_port", 9050 FF NetworkProxy: "backup.ssl", "127.0.0.1" FF NetworkProxy: "backup.ssl_port", 9050 FF NetworkProxy: "ftp", "127.0.0.1" FF NetworkProxy: "ftp_port", 9050 FF NetworkProxy: "no_proxies_on", "" FF NetworkProxy: "share_proxy_settings", true FF NetworkProxy: "socks", "127.0.0.1" FF NetworkProxy: "socks_port", 9050 FF NetworkProxy: "ssl", "127.0.0.1" FF NetworkProxy: "ssl_port", 9050 FF NetworkProxy: "type", 0 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll () FF Plugin: @java.com/DTPlugin,version=10.15.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll () FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=10.21.2 -> C:\Windows\SysWOW64\npDeployJava1.dll No File FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File FF user.js: detected! => C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\mluugfdi.default\user.js FF Extension: WOT - C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\mluugfdi.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-11-26] FF Extension: DownloadHelper - C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\mluugfdi.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-12-31] FF Extension: Classic Theme Restorer - C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\mluugfdi.default\Extensions\[email protected] [2014-06-06] FF Extension: Awesome screenshot: Capture and Annotate - C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\mluugfdi.default\Extensions\[email protected] [2014-09-19] FF Extension: Status-4-Evar - C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\mluugfdi.default\Extensions\[email protected] [2013-02-03] FF Extension: Downloads Window - C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\mluugfdi.default\Extensions\{a7213cf2-fa1e-4373-88ff-255d0abd3020}.xpi [2013-12-22] FF Extension: Download YouTube Videos as MP4 - C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\mluugfdi.default\Extensions\{b9bfaf1c-a63f-47cd-8b9a-29526ced9060}.xpi [2014-11-06] FF Extension: Adblock Plus - C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\mluugfdi.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-01-07] FF HKLM\...\Thunderbird\Extensions: [[email protected]] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird FF HKLM-x32\...\Thunderbird\Extensions: [[email protected]] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 BlueSoleilCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe [1630456 2013-06-07] (IVT Corporation) R3 BsHelpCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe [145656 2013-05-14] (IVT Corporation) R2 CronService; C:\Windows\Prey\wpxsvc.exe [611854 2015-01-25] (Fork, Ltd.) [File not signed] R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [1349576 2014-10-01] (ESET) R2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe [368512 2012-04-04] (Hewlett-Packard Company) S2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [165144 2012-03-28] (Intel Corporation) S4 NetMsmqActivator; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [139680 2012-07-08] (Microsoft Corporation) [File not signed] S4 NetPipeActivator; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [139680 2012-07-08] (Microsoft Corporation) [File not signed] S4 NetTcpActivator; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [139680 2012-07-08] (Microsoft Corporation) [File not signed] S4 NetTcpPortSharing; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [139680 2012-07-08] (Microsoft Corporation) [File not signed] S4 STacSV; C:\Program Files\IDT\WDM\stacsv64.exe [323072 2012-09-20] (IDT, Inc.) [File not signed] S4 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) U5 BlueletAudio; C:\Windows\System32\Drivers\BlueletAudio.sys [33968 2012-12-19] (IVT Corporation) R3 BtAudioBusSrv; C:\Windows\System32\Drivers\BtAudioBus.sys [23136 2012-06-15] (IVT Corporation) R0 BtHidBus; C:\Windows\System32\Drivers\BtHidBus.sys [24840 2009-01-07] (IVT Corporation.) S3 BthL2caScoIfSrv; C:\Windows\System32\Drivers\BtL2caScoIf.sys [54064 2013-04-26] (Ralink Corporation) S3 btnetBUs; C:\Windows\System32\Drivers\btnetBus.sys [35848 2008-12-07] () S3 btUrbFilterDrv; C:\Windows\System32\Drivers\IvtUrbBtFlt.sys [49584 2013-03-25] (Ralink Corporation) R3 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-09-19] (Disc Soft Ltd) R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [243440 2014-10-10] (ESET) U5 edevmon; C:\Windows\System32\Drivers\edevmon.sys [241368 2014-10-10] (ESET) R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [169280 2014-10-10] (ESET) R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [222280 2014-10-10] (ESET) R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [44632 2014-10-10] (ESET) R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [63160 2014-10-10] (ESET) S1 ISODrive; C:\Windows\SysWOW64\Drivers\ISODrv64.sys [115600 2010-01-29] (EZB Systems, Inc.) S3 IvtBtBUs; C:\Windows\System32\Drivers\IvtBtBus.sys [31624 2008-07-02] (IVT Corporation.) S3 mvusbews; C:\Windows\System32\Drivers\mvusbews.sys [19968 2012-11-08] (Marvell Semiconductor, Inc.) R3 rtbth; C:\Windows\System32\DRIVERS\rtbth.sys [1162952 2013-07-13] (Ralink Technology, Corp.) R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1864328 2012-10-03] () U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] () U5 BlueletAudio; C:\Windows\SysWOW64\Drivers\BlueletAudio.sys [33968 2012-12-19] (IVT Corporation) S3 BT; system32\DRIVERS\btnetdrv.sys [X] S3 BTCOM; system32\DRIVERS\btcomport.sys [X] S3 BTCOMBUS; System32\Drivers\btcombus.sys [X] S3 NSNDIS5; \??\C:\Windows\system32\NSNDIS5.SYS [X] S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X] S3 VComm; system32\DRIVERS\VComm.sys [X] S3 VcommMgr; System32\Drivers\VcommMgr.sys [X] S3 VGPU; System32\drivers\rdvgkmd.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-02 12:14 - 2015-02-02 12:14 - 00013848 _____ () C:\Users\USER\Desktop\FRST.txt 2015-02-02 12:14 - 2015-02-02 12:14 - 00000000 ____D () C:\FRST 2015-02-02 12:13 - 2015-02-02 12:13 - 02131456 _____ (Farbar) C:\Users\USER\Desktop\FRST64.exe 2015-02-02 11:37 - 2015-02-02 11:50 - 00000112 _____ () C:\Windows\setupact.log 2015-02-02 11:37 - 2015-02-02 11:37 - 00000000 _____ () C:\Windows\setuperr.log 2015-02-02 11:36 - 2015-02-02 11:37 - 00288904 _____ () C:\Windows\system32\FNTCACHE.DAT 2015-02-01 15:48 - 2015-02-01 15:48 - 00001300 _____ () C:\Users\USER\Desktop\CamStudio.lnk 2015-02-01 15:22 - 2015-02-01 15:46 - 00000000 ____D () C:\Users\USER\Documents\My CamStudio Temp Files 2015-02-01 15:20 - 2015-02-01 15:49 - 00000096 _____ () C:\Users\USER\AppData\Roaming\version2.xml 2015-01-28 20:10 - 2015-01-28 20:10 - 00000000 _____ () C:\Users\USER\Desktop\vtornik 3.02.15 - 9.30.txt 2015-01-26 23:06 - 2015-01-26 23:57 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2015-01-25 17:47 - 2015-01-25 17:47 - 00000000 ____D () C:\Users\USER\AppData\Roaming\Macromedia 2015-01-25 17:47 - 2015-01-25 17:47 - 00000000 ____D () C:\Users\USER\AppData\Local\Macromedia 2015-01-25 17:42 - 2015-01-25 17:42 - 00001058 _____ () C:\Users\Public\Desktop\BurnAware.lnk 2015-01-25 17:42 - 2015-01-25 17:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BurnAware Free 2015-01-25 17:42 - 2015-01-25 17:42 - 00000000 ____D () C:\Program Files (x86)\BurnAware Free 2015-01-25 17:37 - 2015-02-02 11:55 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-01-25 17:37 - 2015-01-26 10:07 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2015-01-25 17:37 - 2015-01-25 17:38 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2015-01-25 17:37 - 2015-01-25 17:38 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2015-01-23 21:36 - 2015-01-23 22:06 - 00000000 ___RD () C:\Program Files (x86)\Winamp 2015-01-23 21:36 - 2015-01-23 21:37 - 00001061 _____ () C:\Users\Public\Desktop\Winamp.lnk 2015-01-23 21:36 - 2015-01-23 21:36 - 00001013 _____ () C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Winamp.lnk 2015-01-05 21:15 - 2015-01-05 21:15 - 00000000 ____D () C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WMV9 VCM 2015-01-05 21:15 - 2015-01-05 21:15 - 00000000 ____D () C:\Program Files\WMV9_VCM ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-02 12:15 - 2014-12-31 14:19 - 00000000 ____D () C:\Users\USER\AppData\Roaming\Skype 2015-02-02 11:58 - 2009-07-14 06:45 - 00026352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-02-02 11:58 - 2009-07-14 06:45 - 00026352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-02-02 11:56 - 2009-07-14 07:13 - 00785302 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-02-02 11:52 - 2014-06-06 23:25 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-02-02 11:50 - 2013-09-13 16:20 - 00001017 _____ () C:\Windows\SysWOW64\bscs.ini 2015-02-02 11:50 - 2013-03-07 11:42 - 00000990 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-02-02 11:50 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-02-02 11:47 - 2013-03-07 11:42 - 00000994 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-02-02 11:46 - 2014-06-06 16:38 - 00003620 _____ () C:\Windows\SysWOW64\LOCALSERVICE.INI 2015-02-02 11:46 - 2014-06-06 16:38 - 00000043 _____ () C:\Windows\SysWOW64\LOCALDEVICE.INI 2015-02-02 11:30 - 2014-06-06 15:53 - 00000000 ____D () C:\Users\USER\AppData\Roaming\uTorrent 2015-02-02 00:24 - 2013-11-26 22:18 - 00000000 ____D () C:\Users\USER\AppData\Roaming\vlc 2015-01-26 16:20 - 2014-11-30 15:30 - 00001349 _____ () C:\Users\USER\Desktop\CCleaner.lnk 2015-01-26 09:17 - 2009-07-14 07:08 - 00032646 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2015-01-25 17:49 - 2014-12-31 14:12 - 00000000 ____D () C:\Windows\Prey 2015-01-25 17:45 - 2014-10-29 16:20 - 00000236 _____ () C:\Users\USER\AppData\Roaming\burnaware.ini 2015-01-25 17:42 - 2014-12-31 13:17 - 00000000 ____D () C:\ProgramData\Martau 2015-01-25 17:37 - 2013-03-28 20:01 - 00000000 ____D () C:\Windows\SysWOW64\Macromed 2015-01-25 17:30 - 2014-06-06 20:47 - 00000812 _____ () C:\Users\USER\Desktop\µTorrent.lnk 2015-01-25 17:30 - 2014-06-06 20:47 - 00000792 _____ () C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk 2015-01-24 15:40 - 2012-12-29 22:34 - 00000000 ____D () C:\Users\USER\AppData\Roaming\Thinstall 2015-01-23 23:11 - 2012-12-30 00:56 - 00000000 ____D () C:\ProgramData\TEMP 2015-01-10 11:07 - 2014-11-03 20:17 - 00004096 _____ () C:\Users\USER\AppData\Local\keyfile3.drm 2015-01-08 18:04 - 2014-09-19 16:02 - 00000000 ____D () C:\Users\USER\AppData\Roaming\DAEMON Tools Lite ==================== Files in the root of some directories ======= 2014-10-29 16:20 - 2015-01-25 17:45 - 0000236 _____ () C:\Users\USER\AppData\Roaming\burnaware.ini 2015-02-01 15:20 - 2015-02-01 15:49 - 0000096 _____ () C:\Users\USER\AppData\Roaming\version2.xml 2013-04-18 15:40 - 2013-04-26 13:00 - 0007168 _____ () C:\Users\USER\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2014-11-03 20:17 - 2015-01-10 11:07 - 0004096 _____ () C:\Users\USER\AppData\Local\keyfile3.drm 2013-02-05 23:18 - 2013-02-05 23:18 - 0000001 _____ () C:\Users\USER\AppData\Local\llftool.4.25.agreement 2013-02-18 20:48 - 2013-02-18 20:48 - 0007650 _____ () C:\Users\USER\AppData\Local\Resmon.ResmonCfg 2014-12-31 10:34 - 2014-12-31 10:34 - 0000016 _____ () C:\ProgramData\mntemp ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-01-24 19:24 ==================== End Of Log ============================ Ето и от Addition.txt Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-02-2015 Ran by USER at 2015-02-02 12:15:10 Running from C:\Users\USER\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: ESET Smart Security 8.0 (Enabled - Up to date) {19259FAE-8396-A113-46DB-15B0E7DFA289} AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: ESET Smart Security 8.0 (Enabled - Up to date) {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834} FW: Лична защитна стена на ESET (Enabled) {211E1E8B-C9F9-A04B-6D84-BC85190CE5F2} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) µTorrent (HKU\S-1-5-21-2316775370-2964681540-2297035872-1000\...\uTorrent) (Version: 3.4.2.38397 - BitTorrent Inc.) Adobe Flash Player 16.0.0.296 for Internet Explorer (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.296 - Adobe Systems Incorporated) Adobe Flash Player 16.0.0.296 for Mozilla Firefox (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.296 - Adobe Systems Incorporated) BurnAware Free 7.8 (HKLM-x32\...\BurnAware Free_is1) (Version: - Burnaware) Classic Shell (HKLM\...\{840C85B7-D3D6-4143-9AF9-DAE80FD54CFC}) (Version: 4.1.0 - IvoSoft) Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6514.5001 - Microsoft Corporation) DAEMON Tools Lite 4.49.1.0356 (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd) doPDF 7.3 Build 393 (HKLM\...\doPDF 7 printer_is1) (Version: 7.3.393 - Softland) ESET Smart Security (HKLM\...\{4E84B341-680E-43B9-A016-CBF11DDC1049}) (Version: 8.0.304.1 - ESET, spol s r. o.) Foxit PhantomPDF (HKLM\...\{8FBFCE1E-C0AD-4FB6-A1B9-674613748597}) (Version: 5.2.1.615 - Foxit Corporation) Google Update Helper (x32 Version: 1.3.21.135 - Google Inc.) Hidden High Quality Photo Resizer 3.0 (HKLM-x32\...\High Quality Photo Resizer_is1) (Version: - Naturpic Software) HP 3D DriveGuard (HKLM\...\{C35A147C-5037-443A-9BF8-A5E7C2154CE4}) (Version: 5.1.7.1 - Hewlett-Packard Company) HP HD Webcam Driver (HKLM-x32\...\{399C37FB-08AF-493B-BFED-20FBD85EDF7F}) (Version: 6.0.1112.2_WHQL - Sonix) HP Hotkey Support (HKLM-x32\...\{C97CC14E-4789-4FC5-BC75-79191F7CE009}) (Version: 4.5.12.1 - Hewlett-Packard Company) HP LaserJet Professional M1130-M1210 MFP Series (HKLM\...\HP LaserJet Professional M1130-M1210 MFP Series) (Version: - ) IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6428.0 - IDT) Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.10.1464 - Intel Corporation) Intel® OpenCL CPU Runtime (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: - Intel Corporation) Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2712 - Intel Corporation) Intel® Turbo Boost Technology Monitor 2.6 (HKLM\...\{6C9365EB-1F9E-4893-9196-3EC77C88D0C5}) (Version: 2.6.2.0 - Intel) Intel® USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.4.225 - Intel Corporation) JMicron Flash Media Controller Driver (HKLM-x32\...\{26604C7E-A313-4D12-867F-7C6E7820BE4C}) (Version: 1.0.72.4 - JMicron Technology Corp.) KeyControl v1.02 (HKLM-x32\...\KeyControl) (Version: - ) Malwarebytes Anti-Malware 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation) Mediatek Bluetooth (HKLM\...\{A9409290-2A97-8735-93A3-DF710B1F44B0}) (Version: 11.0.742.0 - Mediatek) Microsoft .NET Framework 4.5 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50709 - Microsoft Corporation) Microsoft Office 2003 Proofing Tools (HKLM-x32\...\{901F0409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.5614.0 - Microsoft Corporation) Microsoft Office Professional Edition 2003 (HKLM-x32\...\{90110409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.5614.0 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Windows Media Video 9 VCM (HKLM-x32\...\WMV9_VCM) (Version: - ) Mozilla Firefox 35.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 en-US)) (Version: 35.0.1 - Mozilla) Prey Anti-Theft (x32 Version: 1.3.6 - Prey, Inc.) Hidden Ralink RT3290 802.11bgn Wi-Fi Adapter (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 5.0.2.0 - Ralink) Realtek Ethernet Controller All-In-One Windows Driver (HKLM-x32\...\{F7E7F0CB-AA41-4D5A-B6F2-8E6738EB063F}) (Version: 7.58.411.2012 - Realtek) Scan To (HKLM\...\{E8A34AC8-0137-4515-A94B-0A0946DDC251}) (Version: 2.0.1 - HP) Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.) Streamripper Plugin 1.62.2 (HKLM-x32\...\Streamripper.Plugin) (Version: - ) Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.0.3.0 - Synaptics Incorporated) Teamviewer 7.0.14563.0 (HKLM-x32\...\TeamViewer 7) (Version: 7.0.14563 - TeamViewer) Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb) Winamp Pro 5.666 Build 3516 (HKLM-x32\...\Winamp_is1) (Version: 5.66 Build 3516 - l-rePack®) Windows Movie Maker 2.6 (HKLM-x32\...\{B3DAF54F-DB25-4586-9EF1-96D24BB14088}) (Version: 2.6.4037.0 - Microsoft Corporation) WinRAR 5.11 (64-битова версия) (HKLM\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) ==================== Restore Points ========================= ATTENTION: System Restore is disabled. ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2009-07-14 04:34 - 2014-12-31 11:43 - 00000923 ____R C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 ursoftware.com 127.0.0.1 www.ursoftware.com 127.0.0.1 www.martau.com ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {1B029E70-7038-4428-BBDF-0C3C8B51A3F3} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc Task: {7DDA1AC3-2D59-4CD5-82D1-E512C8CB0DBD} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: {A1E6B2AD-1700-438F-9F24-A8E81B743FFE} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-25] (Adobe Systems Incorporated) Task: {B151D2D2-45F3-4918-B0CE-52258596D04D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: {FF0EB138-88BB-47BD-B1E4-30441289A378} - System32\Tasks\{B2AA4A6B-D6FD-400E-9C85-520FF4CC53C8} => Firefox.exe http://ui.skype.com/ui/0/6.22.64.107/bg/abandoninstall?source=lightinstaller&amp;page=tsMain Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============= 2013-05-14 16:33 - 2013-05-14 16:33 - 00029432 _____ () C:\Windows\system32\BsTrace.dll 2013-04-20 12:02 - 2012-09-29 12:25 - 00409088 _____ () C:\Windows\System32\HPM1210LM.DLL 2013-04-20 12:03 - 2012-09-29 12:25 - 00074240 _____ () C:\Windows\system32\spool\PRTPROCS\x64\HPM1210PP.dll 2013-02-18 11:57 - 2009-01-12 20:01 - 00061440 _____ () D:\Install\Testing Tools\quietHDD\quietHDD.exe 2013-05-14 16:33 - 2013-05-14 16:33 - 00016632 _____ () C:\Windows\system32\BsHelpCSps.dll 2013-05-14 16:33 - 2013-05-14 16:33 - 00080120 _____ () C:\Windows\system32\BsProfilefunc.dll 2013-05-14 16:33 - 2013-05-14 16:33 - 00371448 _____ () C:\Windows\system32\BsExtendFunc.dll 2015-01-26 23:06 - 2015-01-26 23:06 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) AlternateDataStreams: C:\Windows:AstInfo AlternateDataStreams: C:\ProgramData\TEMP:1CE11B51 ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== EXE Association (whitelisted) ============= (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== MSCONFIG/TASK MANAGER disabled items ========= (Currently there is no automatic fix for this section.) ========================= Accounts: ========================== Administrator (S-1-5-21-2316775370-2964681540-2297035872-500 - Administrator - Disabled) Guest (S-1-5-21-2316775370-2964681540-2297035872-501 - Limited - Disabled) pyxzbclulwzn (S-1-5-21-2316775370-2964681540-2297035872-1009 - Limited - Disabled) taybzabqb (S-1-5-21-2316775370-2964681540-2297035872-1007 - Limited - Disabled) USER (S-1-5-21-2316775370-2964681540-2297035872-1000 - Administrator - Enabled) => C:\Users\USER ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (02/02/2015 11:51:08 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (02/02/2015 11:37:43 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 System errors: ============= Error: (02/02/2015 11:53:04 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The Intel® Management and Security Application User Notification Service service failed to start due to the following error: %%1053 Error: (02/02/2015 11:53:04 AM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: A timeout was reached (30000 milliseconds) while waiting for the Intel® Management and Security Application User Notification Service service to connect. Error: (02/02/2015 11:51:01 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The Intel® Dynamic Application Loader Host Interface Service service failed to start due to the following error: %%1053 Error: (02/02/2015 11:51:01 AM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: A timeout was reached (30000 milliseconds) while waiting for the Intel® Dynamic Application Loader Host Interface Service service to connect. Error: (02/02/2015 11:51:00 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The HP Software Framework Service service failed to start due to the following error: %%1053 Error: (02/02/2015 11:51:00 AM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: A timeout was reached (30000 milliseconds) while waiting for the HP Software Framework Service service to connect. Error: (02/02/2015 11:39:43 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The Intel® Management and Security Application User Notification Service service failed to start due to the following error: %%1053 Error: (02/02/2015 11:39:43 AM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: A timeout was reached (30000 milliseconds) while waiting for the Intel® Management and Security Application User Notification Service service to connect. Error: (02/02/2015 11:37:43 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The Intel® Dynamic Application Loader Host Interface Service service failed to start due to the following error: %%1053 Error: (02/02/2015 11:37:43 AM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: A timeout was reached (30000 milliseconds) while waiting for the Intel® Dynamic Application Loader Host Interface Service service to connect. Microsoft Office Sessions: ========================= Error: (02/02/2015 11:51:08 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (02/02/2015 11:37:43 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 ==================== Memory info =========================== Processor: Intel® Core i5-3210M CPU @ 2.50GHz Percentage of memory in use: 47% Total physical RAM: 3976.57 MB Available physical RAM: 2082.76 MB Total Pagefile: 7951.32 MB Available Pagefile: 5860.96 MB Total Virtual: 8192 MB Available Virtual: 8191.82 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:39.9 GB) (Free:18.42 GB) NTFS Drive d: (Local Disk) (Fixed) (Total:658.63 GB) (Free:527.06 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 698.6 GB) (Disk ID: E3DB5E23) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=39.9 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=658.6 GB) - (Type=07 NTFS) ==================== End Of Log ============================
  10. При стартиране на програма компютъра е много бавен и след това се рестартира сам. FRST.txt Addition.txt
  11. Здравейте, изглежда че благоверната е качила на лаптопа ми няакаква зловредна гад. При стартиране на браузърите (Chrome/IE) постоянно се зарежда зловреден руски портал (hi.ru). Сайтът се разпознава от Нод 32 като зловреден и го блокира. ОС - 8.1 Проблемът е решен с преинсталация
  12. Здравейте приятели. Преди някоко дни забелязах нежелана от мен добавка на всички браузъри на системата ми - AppsHat. Показваше ми разни реклами и подобни. Обичайното деинсталиране не сработи и разбрах че имам работа с вирус. Премахнах я успешно като използвах безплатна версия на malwarebytes. След това обаче премахнах malwarebytes защото беше trial и тогава започнаха проблемите ми - а именно спонатанни рестарти на системата. След рестарт не се показват някои от иконите в SysTray-а а при първия опит за зареждане на сайт чрез chrome ми съобщава че връзката ми не е частна. Рестартите зачестиха и това ме притеснява. Нямам достъп до BIOS или буут меню-то защото са с парола. Компютъра не е краден, дъното е купувано втора ръка и работи отлично но и предишния собственик не помни да е слагал парола. Ако знаете как да я махна ще се радвам и на тази помощ но това е друга тема. За сега няма как да преинсталирам освен директно през уиндолс, но това ще омаже доста нещата. Идеалното ще бъде ако мога да поправя системата. Нямам точки за везстановяване които да вършат работа. Опитах и със SystemRecovery, проблема си остава. Много се разписах вече май - ето ги логовете - ПОМАГАЙТЕ !!!! Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-12-2014 01 Ran by Ivo (administrator) on IVO-PC on 15-12-2014 17:15:35 Running from C:\Users\Ivo\Desktop Loaded Profile: Ivo (Available profiles: Ivo) Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Български (България) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.jcomsoft.com)C:\Windows\SysWOW64\AniGIF.ocx 2014-11-21 21:15 - 2014-11-21 21:15 - 00000000 ____D () C:\Users\Public\Documents\ShopperPro 2014-11-21 21:15 - 2014-11-21 21:15 - 00000000 ____D () C:\Users\Ivo\AppData\Local\CrashRpt 2014-11-21 21:10 - 2014-11-21 21:10 - 00000000 ____D () C:\Users\Ivo\AppData\Roaming\InstallShield 2014-11-21 21:10 - 2014-11-21 21:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayTV MPEG 2 Vista Update 2014-11-21 21:09 - 2014-11-21 21:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\honestech 2014-11-21 21:09 - 2014-11-21 21:09 - 00000000 ____D () C:\Program Files (x86)\honestech 2014-11-21 21:03 - 2014-11-21 21:03 - 00421248 _____ (Illusion & Hope. Porting to AMD64 by Sergey Sakharov.) C:\Windows\system32\Drivers\BT848.sys 2014-11-21 16:08 - 2014-12-11 20:56 - 00000000 ____D () C:\Users\Ivo\AppData\Roaming\Age of Empires II 2014-11-21 16:08 - 2014-11-21 16:08 - 00000000 ____D () C:\Program Files (x86)\Ligos 2014-11-21 16:08 - 2000-06-23 14:05 - 00136704 _____ (Ligos Corporation) C:\Windows\SysWOW64\iacenc.dll 2014-11-21 16:08 - 2000-06-22 13:09 - 00056320 ____N () C:\Windows\SysWOW64\iyvu9_32.dll 2014-11-21 16:04 - 1998-10-29 19:45 - 00306688 _____ (InstallShield Software Corporation) C:\Windows\IsUninst.exe 2014-11-21 15:37 - 2014-11-21 15:37 - 00000000 ____D () C:\ProgramData\Age of Empires 3 2014-11-21 15:35 - 2014-11-21 15:35 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0 2014-11-21 15:34 - 2005-05-26 15:34 - 03767504 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_26.dll 2014-11-21 15:34 - 2005-05-26 15:34 - 02297552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_26.dll 2014-11-21 15:34 - 2005-03-18 17:19 - 03823312 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_25.dll 2014-11-21 15:34 - 2005-03-18 17:19 - 02337488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_25.dll 2014-11-19 15:11 - 2014-11-19 15:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Activision Value 2014-11-19 12:12 - 2014-11-11 05:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2014-11-19 12:12 - 2014-11-11 05:08 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll 2014-11-19 12:12 - 2014-11-11 04:44 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2014-11-19 12:12 - 2014-11-11 04:44 - 00186880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-16 01:32 - 2014-09-08 17:51 - 00000000 ____D () C:\Users\Ivo\AppData\Local\Akamai 2014-12-16 01:32 - 2014-09-08 17:44 - 00000000 ____D () C:\Users\Ivo\AppData\Roaming\uTorrent 2014-12-16 01:32 - 2014-09-08 15:27 - 00000000 ___RD () C:\Users\Ivo\Desktop\Програми 2014-12-16 01:32 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration 2014-12-15 17:14 - 2009-07-14 07:13 - 00781790 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-12-15 17:13 - 2014-09-08 18:24 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-12-15 17:12 - 2014-09-08 15:10 - 01571635 _____ () C:\Windows\WindowsUpdate.log 2014-12-15 17:10 - 2014-09-08 18:11 - 00000000 ____D () C:\Users\Ivo\AppData\Roaming\Skype 2014-12-15 17:09 - 2014-09-14 23:04 - 00000000 ____D () C:\Users\Ivo\AppData\Local\LogMeIn Hamachi 2014-12-15 17:09 - 2014-09-09 10:22 - 00000000 ____D () C:\Windows\Minidump 2014-12-15 17:09 - 2014-09-08 17:06 - 00000994 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-12-15 17:09 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-12-15 17:05 - 2009-07-14 06:45 - 00026576 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-12-15 17:05 - 2009-07-14 06:45 - 00026576 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-12-15 15:34 - 2014-09-08 15:10 - 00000000 ____D () C:\Users\Ivo 2014-12-14 16:25 - 2014-09-08 17:06 - 00000998 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-12-14 09:53 - 2014-09-08 15:27 - 00000000 ___RD () C:\Users\Ivo\Desktop\Игри 2014-12-14 09:01 - 2014-09-18 20:48 - 00000000 ____D () C:\Users\Ivo\AppData\Local\SKIDROW 2014-12-14 08:57 - 2014-09-08 16:48 - 00000000 ____D () C:\Program Files (x86)\Opera 2014-12-14 08:55 - 2014-09-08 15:22 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2014-12-14 08:49 - 2014-09-08 18:24 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-12-14 08:49 - 2014-09-08 18:24 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-12-14 08:49 - 2014-09-08 18:24 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-12-14 08:48 - 2014-09-08 17:24 - 00000000 ____D () C:\Users\Ivo\AppData\Local\Adobe 2014-12-14 07:49 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games 2014-12-13 18:05 - 2014-09-08 17:37 - 00000000 ____D () C:\Users\Ivo\AppData\Roaming\ATI 2014-12-13 14:19 - 2014-09-08 15:47 - 00000000 ____D () C:\Users\Ivo\AppData\Roaming\.minecraft 2014-12-13 12:29 - 2014-09-08 17:23 - 00000000 ____D () C:\ProgramData\Skype 2014-12-13 12:29 - 2014-09-08 17:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype 2014-12-13 02:11 - 2014-09-08 15:39 - 00000000 ____D () C:\Users\Ivo\AppData\Roaming\AIMP3 2014-12-13 02:10 - 2009-01-01 10:07 - 00000000 ____D () C:\Windows\Panther 2014-12-13 00:27 - 2014-09-08 16:46 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-12-12 23:18 - 2014-09-08 18:53 - 00000000 ____D () C:\Users\Ivo\Documents\My Games 2014-12-12 15:01 - 2014-09-08 17:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack 2014-12-12 15:01 - 2014-09-08 17:24 - 00000000 ____D () C:\Program Files (x86)\K-Lite Codec Pack 2014-12-12 01:00 - 2014-09-08 18:53 - 00000000 ____D () C:\Users\Ivo\AppData\Local\Skyrim 2014-12-11 22:51 - 2014-09-08 17:49 - 00000565 _____ () C:\Users\Ivo\AppData\Roaming\myMPQ.ini 2014-12-11 17:47 - 2014-09-16 00:46 - 00000000 ____D () C:\Program Files (x86)\SC2Allin1 2014-12-11 17:45 - 2014-09-16 00:47 - 00000663 _____ () C:\Users\Ivo\AppData\Roaming\MPQEditor.ini 2014-12-11 17:04 - 2014-09-08 18:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\R.G. Catalyst 2014-12-11 16:56 - 2014-09-22 01:45 - 00000000 ____D () C:\Users\Ivo\AppData\Roaming\Origin 2014-12-11 16:56 - 2014-09-22 01:41 - 00000000 ____D () C:\Program Files (x86)\Origin 2014-12-11 16:56 - 2014-09-08 15:49 - 00000000 ____D () C:\ProgramData\Origin 2014-12-11 16:52 - 2014-09-22 01:38 - 00000000 ____D () C:\Users\Ivo\Documents\FIFA 14 2014-12-11 14:59 - 2014-09-18 18:35 - 00000000 ____D () C:\Users\Ivo\AppData\Roaming\TeamViewer 2014-12-11 14:52 - 2014-09-08 15:48 - 00000000 ____D () C:\Users\Ivo\Documents\Euro Truck Simulator 2 2014-12-11 12:42 - 2014-09-15 00:47 - 00281688 _____ () C:\Windows\SysWOW64\PnkBstrB.exe 2014-12-11 12:42 - 2014-09-15 00:46 - 00281688 _____ () C:\Windows\SysWOW64\PnkBstrB.xtr 2014-12-11 11:24 - 2014-09-15 00:47 - 00281688 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0 2014-12-10 19:17 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache 2014-12-10 10:51 - 2014-09-09 17:48 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation 2014-12-10 10:50 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Help 2014-12-10 10:35 - 2014-09-09 08:28 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-12-10 10:35 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\bg-BG 2014-12-10 10:35 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\AppCompat 2014-12-10 10:34 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\bg-BG 2014-12-10 10:34 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-12-10 03:04 - 2014-09-09 08:47 - 00000000 ____D () C:\Windows\system32\MRT 2014-12-10 03:01 - 2014-09-09 08:47 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-12-10 00:40 - 2014-09-09 09:55 - 00000000 ____D () C:\ProgramData\Orbit 2014-12-08 14:26 - 2014-09-10 13:09 - 00000000 ____D () C:\Windows\F9835182794B4F24902AE2CA9D43380F.TMP 2014-12-08 14:24 - 2014-09-08 18:14 - 00000000 ____D () C:\Program Files (x86)\Aeria Games 2014-12-03 17:54 - 2014-09-08 16:48 - 00003842 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1410187723 2014-11-30 19:51 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF 2014-11-29 03:08 - 2014-09-21 17:43 - 00000000 ____D () C:\Windows\pss 2014-11-29 03:02 - 2014-09-08 18:23 - 00000000 ____D () C:\Windows\system32\Macromed 2014-11-29 03:02 - 2014-09-08 17:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-11-29 03:02 - 2011-04-12 10:28 - 00000000 ___RD () C:\Users\Public\Recorded TV 2014-11-22 12:20 - 2014-09-11 19:04 - 00000000 ____D () C:\Program Files (x86)\Adobe 2014-11-22 12:20 - 2014-09-08 18:14 - 00000000 __SHD () C:\Windows\SysWOW64\AI_RecycleBin 2014-11-22 12:20 - 2014-09-08 18:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AeriaGames 2014-11-21 22:02 - 2014-09-08 15:43 - 00058792 _____ () C:\Users\Ivo\AppData\Local\GDIPFONTCACHEV1.DAT 2014-11-21 22:01 - 2009-07-14 06:45 - 00266512 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-11-21 21:23 - 2014-09-14 19:57 - 00000000 ____D () C:\Users\Ivo\AppData\Local\Sony 2014-11-21 21:23 - 2014-09-14 19:57 - 00000000 ____D () C:\Program Files (x86)\Sony 2014-11-21 21:19 - 2014-09-08 16:46 - 00001163 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2014-11-21 21:14 - 2014-09-08 17:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR 2014-11-21 21:10 - 2014-09-08 18:24 - 00000000 ____D () C:\Users\Ivo\AppData\Roaming\Adobe Some content of TEMP: ==================== C:\Users\Ivo\AppData\Local\Temp\MP3_Launcher_1_36_0_0.exe C:\Users\Ivo\AppData\Local\Temp\MP3_Patch_Update_1_0_0_78.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-12-14 17:16 ==================== End Of Log ============================ Addition.txt
  13. Здравеите искам да попитам видях един процес в диспечера на задачите които е, svchost.exe. има ли нещо подозрително щото четох троянски коне всякакви глупости.Благодаря предварително.http://prikachi.com/images.php?images/589/8111589X.png
  14. От 2-3 дни нещо "яде" RAM паметта на компютъра и това естествено забавя работата му. По-рядко процесорът също достига пикови стойности без натоварване. Ето няколко снимки точно след стартирането на компютъра без да съм отворил дори една програма. Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-12-2014 Ran by X64 (administrator) on PC on 18-12-2014 23:50:33 Running from C:\Users\X64\Desktop Loaded Profile: X64 (Available profiles: X64) Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: English (United States) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (Pixart Imaging Inc) C:\Windows\System32\TiltWheelMouse.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Disc Soft Ltd) C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe (Palit Microsystems Ltd.) C:\Program Files (x86)\Thunder Master\THPanel.exe (Microsoft Corporation) C:\Windows\System32\StikyNot.exe (Sysinternals - www.sysinternals.com) C:\Users\X64\AppData\Roaming\Sysinternals.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_235.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_235.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation) HKLM\...\Run: [MouseDriver] => C:\Windows\system32\TiltWheelMouse.exe [241152 2012-12-19] (Pixart Imaging Inc) HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2531472 2014-12-13] (NVIDIA Corporation) HKLM\...\Run: [shadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM\...\Run: [bCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation) HKLM-x32\...\Run: [PCI Monitor] => C:\Program Files (x86)\PCI Monitor\pcimon.exe [20127232 2014-08-03] (Sysinternals - www.sysinternals.com) HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation) HKU\S-1-5-21-1957158611-1858047153-2874929278-1000\...\Run: [THPanel] => C:\Program Files (x86)\Thunder Master\THPanel.exe [2047344 2012-05-24] (Palit Microsystems Ltd.) HKU\S-1-5-21-1957158611-1858047153-2874929278-1000\...\Run: [sysinternals Autoruns] => C:\Users\X64\AppData\Roaming\Sysinternals.exe [20127232 2014-08-03] (Sysinternals - www.sysinternals.com) HKU\S-1-5-21-1957158611-1858047153-2874929278-1000\...\Run: [DAEMON Tools Pro Agent] => C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe [3129560 2014-02-24] (Disc Soft Ltd) HKU\S-1-5-21-1957158611-1858047153-2874929278-1000\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\S-1-5-21-1957158611-1858047153-2874929278-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bg/ HKU\S-1-5-21-1957158611-1858047153-2874929278-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation) BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation) Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation) Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 10.64.68.1 8.8.8.8 Tcpip\..\Interfaces\{C71DF025-54F8-4D12-96BB-F904FC378E1E}: [NameServer] 10.64.68.1 8.8.8.8 FireFox: ======== FF ProfilePath: C:\Users\X64\AppData\Roaming\Mozilla\Firefox\Profiles\k8epdkoe.default FF Homepage: hxxp://www.google.bg/ FF NetworkProxy: "gopher", "" FF NetworkProxy: "gopher_port", 0 FF NetworkProxy: "share_proxy_settings", true FF NetworkProxy: "type", 0 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll () FF Plugin: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll () FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF user.js: detected! => C:\Users\X64\AppData\Roaming\Mozilla\Firefox\Profiles\k8epdkoe.default\user.js FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\911bg.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\diribg.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\pe-bg.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\portalbgdict.xml FF Extension: Ant Video Downloader - C:\Users\X64\AppData\Roaming\Mozilla\Firefox\Profiles\k8epdkoe.default\Extensions\[email protected] [2014-10-18] FF Extension: IE Tab 2 (FF 3.6+) - C:\Users\X64\AppData\Roaming\Mozilla\Firefox\Profiles\k8epdkoe.default\Extensions\{1BC9BA34-1EED-42ca-A505-6D2F1A935BBB} [2014-11-06] FF Extension: Free Hide IP - C:\Users\X64\AppData\Roaming\Mozilla\Firefox\Profiles\k8epdkoe.default\Extensions\[email protected] [2014-11-16] FF Extension: QuickJS - C:\Users\X64\AppData\Roaming\Mozilla\Firefox\Profiles\k8epdkoe.default\Extensions\{bb65e674-b194-4b6e-8033-5fa0afe3a198}.xpi [2014-11-23] FF Extension: Adblock Plus - C:\Users\X64\AppData\Roaming\Mozilla\Firefox\Profiles\k8epdkoe.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-11-29] FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-12-09] Chrome: ======= ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation) R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation) R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148560 2014-12-13] (NVIDIA Corporation) R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation) R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation) R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1701520 2014-12-13] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19823248 2014-12-13] (NVIDIA Corporation) S2 Util AppEnable; "C:\Program Files (x86)\AppEnable\bin\utilAppEnable.exe" [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-11-11] (Disc Soft Ltd) R3 FETNDIS; C:\Windows\System32\DRIVERS\fet6x64.sys [47872 2009-06-10] (VIA Technologies, Inc. ) R3 ip100Avista; C:\Windows\System32\DRIVERS\ipfnd51.sys [37888 2007-09-05] (IC Plus Corp. ) R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation) R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation) R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2014-12-13] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation) R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-11-11] (Duplex Secure Ltd.) R3 t_mouse.sys; C:\Windows\System32\DRIVERS\t_mouse.sys [6144 2012-12-19] () R1 {128614e8-07dd-4e11-b9ec-ca2c14f812c5}Gw64; C:\Windows\System32\drivers\{128614e8-07dd-4e11-b9ec-ca2c14f812c5}Gw64.sys [48776 2014-11-23] (StdLib) S3 EverestDriver; \??\C:\Program Files (x86)\Lavalys\EVEREST Ultimate Edition\kerneld.amd64 [X] S3 VGPU; System32\drivers\rdvgkmd.sys [X] ========================== Drivers MD5 ======================= C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit C:\Windows\system32\drivers\adp94xx.sys ==> MD5 is legit C:\Windows\system32\drivers\adpahci.sys ==> MD5 is legit C:\Windows\system32\drivers\adpu320.sys ==> MD5 is legit C:\Windows\system32\drivers\afd.sys FA886682CFC5D36718D3E436AACF10B9 C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit C:\Windows\system32\drivers\amdk8.sys ==> MD5 is legit C:\Windows\system32\drivers\amdppm.sys ==> MD5 is legit C:\Windows\system32\drivers\amdsata.sys D4121AE6D0C0E7E13AA221AA57EF2D49 C:\Windows\system32\drivers\amdsbs.sys ==> MD5 is legit C:\Windows\System32\drivers\amdxata.sys 540DAF1CEA6094886D72126FD7C33048 C:\Windows\system32\drivers\appid.sys ==> MD5 is legit C:\Windows\system32\drivers\arc.sys ==> MD5 is legit C:\Windows\system32\drivers\arcsas.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit C:\Windows\System32\drivers\atapi.sys ==> MD5 is legit C:\Windows\system32\drivers\bxvbda.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\b57nd60a.sys ==> MD5 is legit C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit C:\Windows\system32\drivers\BrFiltLo.sys ==> MD5 is legit C:\Windows\system32\drivers\BrFiltUp.sys ==> MD5 is legit C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit C:\Windows\system32\drivers\bthmodem.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit C:\Windows\system32\drivers\circlass.sys ==> MD5 is legit C:\Windows\System32\CLFS.sys ==> MD5 is legit C:\Windows\system32\drivers\CmBatt.sys ==> MD5 is legit C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit C:\Windows\System32\Drivers\cng.sys EBF28856F69CF094A902F884CF989706 C:\Windows\system32\drivers\compbatt.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\CompositeBus.sys ==> MD5 is legit C:\Windows\system32\drivers\crcdisk.sys ==> MD5 is legit C:\Windows\System32\drivers\csc.sys ==> MD5 is legit C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit C:\Windows\System32\drivers\discache.sys ==> MD5 is legit C:\Windows\System32\drivers\disk.sys ==> MD5 is legit C:\Windows\system32\drivers\dmvsc.sys 5DB085A8A6600BE6401F2B24EECB5415 C:\Windows\System32\drivers\drmkaud.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\dtsoftbus01.sys E2CA2BC3B16BDA6E6F80F54C88486877 C:\Windows\System32\drivers\dxgkrnl.sys 87CE5C8965E101CCCED1F4675557E868 C:\Windows\system32\drivers\evbda.sys ==> MD5 is legit C:\Windows\system32\drivers\elxstor.sys ==> MD5 is legit C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\fdc.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\fet6x64.sys ECCE54654A19F6CC5E526696680C1827 C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\flpydisk.sys ==> MD5 is legit C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit C:\Windows\System32\Drivers\Fs_Rec.sys 6BD9295CC032DD3077C671FCCF579A7B C:\Windows\System32\DRIVERS\fvevol.sys 8F6322049018354F45F05A2FD2D4E5E0 C:\Windows\system32\drivers\gagp30kx.sys ==> MD5 is legit C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit C:\Windows\System32\drivers\HdAudio.sys 975761C778E33CD22498059B91E7373A C:\Windows\System32\DRIVERS\HDAudBus.sys ==> MD5 is legit C:\Windows\system32\drivers\HidBatt.sys ==> MD5 is legit C:\Windows\system32\drivers\hidbth.sys ==> MD5 is legit C:\Windows\system32\drivers\hidir.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit C:\Windows\System32\drivers\HTTP.sys ==> MD5 is legit C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\i8042prt.sys ==> MD5 is legit C:\Windows\system32\drivers\iaStorV.sys AAAF44DB3BD0B9D1FB6969B23ECC8366 C:\Windows\system32\drivers\iirsp.sys ==> MD5 is legit C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\intelppm.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\ipfnd51.sys 4596BDAB091CD8338966473953ABD68D C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit C:\Windows\system32\drivers\msiscsi.sys 96BB922A0981BC7432C8CF52B5410FE6 C:\Windows\System32\DRIVERS\kbdclass.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\kbdhid.sys ==> MD5 is legit C:\Windows\System32\Drivers\ksecdd.sys 353009DEDF918B2A51414F330CF72DEC C:\Windows\System32\Drivers\ksecpkg.sys 41774FF331F609EF442B7398EE6202B1 C:\Windows\system32\drivers\ksthunk.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit C:\Windows\system32\drivers\lsi_fc.sys ==> MD5 is legit C:\Windows\system32\drivers\lsi_sas.sys ==> MD5 is legit C:\Windows\system32\drivers\lsi_sas2.sys ==> MD5 is legit C:\Windows\system32\drivers\lsi_scsi.sys ==> MD5 is legit C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit C:\Windows\system32\drivers\megasas.sys ==> MD5 is legit C:\Windows\system32\drivers\MegaSR.sys ==> MD5 is legit C:\Windows\System32\drivers\modem.sys BFFB0C93D9FB43CA42EF11C9240BFF7F C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit C:\Windows\System32\drivers\mountmgr.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\MpFilter.sys 6439D1E559D08BD8A1465A8943357053 C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit C:\Windows\system32\drivers\mrxdav.sys 1A4F75E63C9FB84B85DFFC6B63FD5404 C:\Windows\System32\DRIVERS\mrxsmb.sys A5D9106A73DC88564C825D317CAC68AC C:\Windows\System32\DRIVERS\mrxsmb10.sys D711B3C1D5F42C0C2415687BE09FC163 C:\Windows\System32\DRIVERS\mrxsmb20.sys 9423E9D355C8D303E76B8CFBD8A5C30C C:\Windows\system32\drivers\msahci.sys ==> MD5 is legit C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\mssmbios.sys ==> MD5 is legit C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit C:\Windows\system32\drivers\MTConfig.sys ==> MD5 is legit C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit C:\Windows\System32\drivers\ndis.sys 760E38053BF56E501D562B70AD796B88 C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit C:\Windows\system32\drivers\nfrd960.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\NisDrvWFP.sys F9EEFFC65C68A45001D1349E652B8B6F C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit C:\Windows\System32\Drivers\Ntfs.sys 1A29A59A4C5BA6F8C85062A613B7E2B2 C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit C:\Windows\System32\drivers\nvhda64v.sys E366A5681C50785D4ED04FCFD65C3415 C:\Windows\System32\DRIVERS\nvlddmkm.sys 2232AE1BB51A96A7381A2CA17DF12E24 C:\Windows\system32\drivers\nvraid.sys 0A92CB65770442ED0DC44834632F66AD C:\Windows\system32\drivers\nvstor.sys DAB0E87525C10052BF65F06152F37E4A C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys 0C4A0D577A6EF1B9D353851668779944 C:\Windows\System32\drivers\nvvad64v.sys DBFE7B2DF103F74AE51840B3C5F25FE9 C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\parport.sys ==> MD5 is legit C:\Windows\System32\drivers\partmgr.sys E9766131EEADE40A27DC27D2D68FBA9C C:\Windows\System32\drivers\pci.sys ==> MD5 is legit C:\Windows\system32\drivers\pciide.sys ==> MD5 is legit C:\Windows\system32\drivers\pcmcia.sys ==> MD5 is legit C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit C:\Windows\System32\drivers\peauth.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit C:\Windows\system32\drivers\processr.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit C:\Windows\system32\drivers\ql2300.sys ==> MD5 is legit C:\Windows\system32\drivers\ql40xx.sys ==> MD5 is legit C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\rdpbus.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit C:\Windows\System32\drivers\rdpdr.sys ==> MD5 is legit C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit C:\Windows\System32\drivers\rdpvideominiport.sys 313F68E1A3E6345A4F47A36B07062F34 C:\Windows\System32\Drivers\RDPWD.sys FE571E088C2D83619D2D48D4E961BF41 C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit C:\Windows\system32\drivers\vms3cap.sys ==> MD5 is legit C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\serenum.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\serial.sys ==> MD5 is legit C:\Windows\system32\drivers\sermouse.sys ==> MD5 is legit C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit C:\Windows\system32\drivers\sfloppy.sys ==> MD5 is legit C:\Windows\system32\drivers\SiSRaid2.sys ==> MD5 is legit C:\Windows\system32\drivers\sisraid4.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit C:\Windows\System32\Drivers\sptd.sys 74D30C2EF66C2EB19F17ED5423AA8038 C:\Windows\System32\DRIVERS\srv.sys 441FBA48BFF01FDB9D5969EBC1838F0B C:\Windows\System32\DRIVERS\srv2.sys B4ADEBBF5E3677CCE9651E0F01F7CC28 C:\Windows\System32\DRIVERS\srvnet.sys 27E461F0BE5BFF5FC737328F749538C3 C:\Windows\system32\drivers\stexstor.sys ==> MD5 is legit C:\Windows\System32\drivers\vmstorfl.sys ==> MD5 is legit C:\Windows\system32\drivers\storvsc.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\swenum.sys ==> MD5 is legit C:\Windows\System32\drivers\synth3dvsc.sys C3A39C4079305480972D29C44B868C78 C:\Windows\System32\drivers\tcpip.sys 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E C:\Windows\System32\DRIVERS\tcpip.sys 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E C:\Windows\System32\drivers\tcpipreg.sys 1B16D0BD9841794A6E0CDE0CEF744ABC C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit C:\Windows\System32\drivers\tdtcp.sys 51C5ECEB1CDEE2468A1748BE550CFBC8 C:\Windows\System32\DRIVERS\tdx.sys 70988118145F5F10EF24720B97F35F65 C:\Windows\System32\DRIVERS\termdd.sys ==> MD5 is legit C:\Windows\system32\drivers\terminpt.sys EF4469AB69EB15E5D3754E6AEAFBCD3D C:\Windows\System32\DRIVERS\tssecsrv.sys E232A3B43A894BB327FC161529BD9ED1 C:\Windows\System32\drivers\tsusbflt.sys E9981ECE8D894CEF7038FD1D040EB426 C:\Windows\system32\drivers\TsUsbGD.sys AD64450A4ABE076F5CB34CC08EEACB07 C:\Windows\System32\drivers\tsusbhub.sys E1748D04AE40118B62BC18AC86032192 C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\t_mouse.sys A070ABB9D85582B2BECADBE6FCD12350 C:\Windows\System32\DRIVERS\uagp35.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\umbus.sys ==> MD5 is legit C:\Windows\system32\drivers\umpass.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\usbccgp.sys DCA68B0943D6FA415F0C56C92158A83A C:\Windows\system32\drivers\usbcir.sys 80B0F7D5CCF86CEB5D402EAAF61FEC31 C:\Windows\System32\DRIVERS\usbehci.sys 18A85013A3E0F7E1755365D287443965 C:\Windows\System32\DRIVERS\usbhub.sys 8D1196CFBB223621F2C67D45710F25BA C:\Windows\system32\drivers\usbohci.sys 765A92D428A8DB88B960DA5A8D6089DC C:\Windows\system32\drivers\usbprint.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\USBSTOR.SYS FED648B01349A3C8395A5169DB5FB7D6 C:\Windows\System32\DRIVERS\usbuhci.sys DD253AFC3BC6CBA412342DE60C3647F3 C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit C:\Windows\System32\drivers\vga.sys ==> MD5 is legit C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit C:\Windows\System32\drivers\viaide.sys ==> MD5 is legit C:\Windows\system32\drivers\vmbus.sys ==> MD5 is legit C:\Windows\system32\drivers\VMBusHID.sys ==> MD5 is legit C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit C:\Windows\system32\drivers\vsmraid.sys ==> MD5 is legit C:\Windows\System32\drivers\vwifibus.sys ==> MD5 is legit C:\Windows\system32\drivers\wacompen.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit C:\Windows\System32\drivers\wd.sys ==> MD5 is legit C:\Windows\System32\drivers\Wdf01000.sys E2C933EDBC389386EBE6D2BA953F43D8 C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit C:\Windows\SysWOW64\drivers\wimmount.sys ==> MD5 is legit C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit C:\Windows\System32\drivers\WudfPf.sys AB886378EEB55C6C75B4F2D14B6C869F C:\Windows\System32\DRIVERS\WUDFRd.sys DDA4CAF29D8C0A297F886BFE561E6659 C:\Windows\System32\drivers\{128614e8-07dd-4e11-b9ec-ca2c14f812c5}Gw64.sys FC7767D0AEB20E40C69453D4A82B2437 ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-18 23:50 - 2014-12-18 23:51 - 00029370 _____ () C:\Users\X64\Desktop\FRST.txt 2014-12-18 23:49 - 2014-12-18 23:50 - 00000000 ____D () C:\FRST 2014-12-18 23:36 - 2014-12-18 23:36 - 02121216 _____ (Farbar) C:\Users\X64\Desktop\FRST64.exe 2014-12-18 16:55 - 2014-12-13 07:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-12-18 16:55 - 2014-12-13 05:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-12-18 00:09 - 2014-12-18 00:10 - 00000000 ____D () C:\ProgramData\Oracle 2014-12-18 00:09 - 2014-12-18 00:09 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-12-18 00:09 - 2014-12-18 00:09 - 00000000 ____D () C:\ProgramData\Sun 2014-12-18 00:09 - 2014-12-18 00:09 - 00000000 ____D () C:\Program Files (x86)\Java 2014-12-18 00:07 - 2014-12-18 00:07 - 00638888 _____ (Oracle Corporation) C:\Users\X64\Downloads\JavaSetup8u25.com 2014-12-17 00:44 - 2014-11-22 12:46 - 00038032 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys 2014-12-17 00:44 - 2014-11-22 12:46 - 00032400 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll 2014-12-14 21:20 - 2014-12-14 21:19 - 00000000 ____D () C:\Users\X64\Desktop\LegalPorno - PissMyAssOff - Nataly Gold 2014-12-14 00:21 - 2014-12-18 16:59 - 00000414 _____ () C:\Users\X64\Desktop\ПРЕВОДИ.txt 2014-12-13 13:19 - 2014-12-13 13:19 - 00162387 _____ () C:\Users\X64\Desktop\8b9147b7ef3896c15cfa0c0609742fb2.jpeg 2014-12-12 19:34 - 2014-12-12 19:34 - 00000362 _____ () C:\Users\X64\Desktop\444.txt 2014-12-11 23:34 - 2014-12-12 01:44 - 00000366 _____ () C:\Users\X64\Desktop\if i was you.txt 2014-12-11 05:29 - 2014-12-11 05:29 - 00000000 ____D () C:\Windows\system32\appraiser 2014-12-11 03:04 - 2014-10-18 04:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll 2014-12-11 03:04 - 2014-10-18 03:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll 2014-12-11 03:04 - 2014-07-07 04:06 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll 2014-12-11 03:04 - 2014-07-07 04:06 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe 2014-12-11 03:04 - 2014-07-07 04:06 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe 2014-12-11 03:04 - 2014-07-07 04:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll 2014-12-11 03:04 - 2014-07-07 03:40 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll 2014-12-11 03:04 - 2014-07-07 03:39 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe 2014-12-11 03:04 - 2014-07-07 03:39 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe 2014-12-11 03:04 - 2014-07-07 03:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll 2014-12-11 00:16 - 2014-12-04 04:50 - 00830976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll 2014-12-11 00:16 - 2014-12-04 04:50 - 00741376 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll 2014-12-11 00:16 - 2014-12-04 04:50 - 00413184 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll 2014-12-11 00:16 - 2014-12-04 04:50 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll 2014-12-11 00:16 - 2014-12-04 04:50 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-12-11 00:16 - 2014-12-04 04:50 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll 2014-12-11 00:16 - 2014-12-04 04:44 - 01083392 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-12-11 00:16 - 2014-12-02 01:28 - 01232040 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe 2014-12-11 00:16 - 2014-11-27 03:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-12-11 00:16 - 2014-11-27 03:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-12-11 00:16 - 2014-11-22 05:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-12-11 00:16 - 2014-11-22 05:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-12-11 00:16 - 2014-11-22 04:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-12-11 00:16 - 2014-11-22 04:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-12-11 00:16 - 2014-11-22 04:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-12-11 00:16 - 2014-11-22 04:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-12-11 00:16 - 2014-11-22 04:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-12-11 00:16 - 2014-11-22 04:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-12-11 00:16 - 2014-11-22 04:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-12-11 00:16 - 2014-11-22 04:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-12-11 00:16 - 2014-11-22 04:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-12-11 00:16 - 2014-11-22 04:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-12-11 00:16 - 2014-11-22 04:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-12-11 00:16 - 2014-11-22 03:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-12-11 00:16 - 2014-11-22 03:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-12-11 00:16 - 2014-11-22 03:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-12-11 00:16 - 2014-11-22 03:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-12-11 00:16 - 2014-11-22 03:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-12-11 00:16 - 2014-11-22 03:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-12-11 00:16 - 2014-11-22 03:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-12-11 00:16 - 2014-11-22 03:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-12-11 00:16 - 2014-11-22 03:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-12-11 00:16 - 2014-11-22 03:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-12-11 00:16 - 2014-11-22 03:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-12-11 00:16 - 2014-11-22 03:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-12-11 00:16 - 2014-11-22 03:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-12-11 00:16 - 2014-11-22 03:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-12-11 00:16 - 2014-11-22 02:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-12-11 00:16 - 2014-11-22 02:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-12-11 00:16 - 2014-11-11 05:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2014-12-11 00:16 - 2014-11-11 04:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2014-12-11 00:16 - 2014-11-11 03:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys 2014-12-11 00:15 - 2014-11-22 05:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-12-11 00:15 - 2014-11-22 04:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-12-11 00:15 - 2014-11-22 04:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-12-11 00:15 - 2014-11-22 04:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-12-11 00:15 - 2014-11-22 04:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-12-11 00:15 - 2014-11-22 04:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-12-11 00:15 - 2014-11-22 04:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-12-11 00:15 - 2014-11-22 04:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-12-11 00:15 - 2014-11-22 04:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-12-11 00:15 - 2014-11-22 04:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-12-11 00:15 - 2014-11-22 04:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-12-11 00:15 - 2014-11-22 04:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-12-11 00:15 - 2014-11-22 04:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-12-11 00:15 - 2014-11-22 04:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-12-11 00:15 - 2014-11-22 03:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-12-11 00:15 - 2014-11-22 03:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-12-11 00:15 - 2014-11-22 03:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-12-11 00:15 - 2014-11-22 03:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-12-11 00:15 - 2014-11-22 03:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-12-11 00:15 - 2014-11-22 03:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-12-11 00:15 - 2014-11-22 03:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-12-11 00:15 - 2014-11-22 03:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-12-11 00:15 - 2014-11-22 03:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-12-11 00:15 - 2014-11-08 05:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-12-11 00:15 - 2014-11-08 04:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2014-12-11 00:15 - 2014-10-30 04:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe 2014-12-11 00:15 - 2014-10-30 03:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe 2014-12-11 00:15 - 2014-10-03 04:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll 2014-12-11 00:15 - 2014-10-03 04:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll 2014-12-11 00:15 - 2014-10-03 04:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll 2014-12-11 00:15 - 2014-10-03 04:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll 2014-12-11 00:15 - 2014-10-03 04:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe 2014-12-11 00:15 - 2014-10-03 03:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll 2014-12-11 00:15 - 2014-10-03 03:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll 2014-12-11 00:15 - 2014-10-03 03:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll 2014-12-11 00:15 - 2014-10-03 03:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll 2014-12-11 00:15 - 2014-10-03 03:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe 2014-12-09 19:05 - 2014-12-09 19:05 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-12-09 18:49 - 2014-12-09 18:49 - 00000108 _____ () C:\Users\X64\Desktop\musicc.txt 2014-12-08 00:15 - 2014-12-08 00:15 - 00000064 _____ () C:\Users\X64\Desktop\Iva, Veronika - Two in a Row.txt 2014-12-06 03:55 - 2014-12-06 03:55 - 00001478 _____ () C:\Users\X64\Desktop\88.txt 2014-12-03 13:01 - 2014-12-15 03:40 - 00000000 ____D () C:\Users\X64\Downloads\1 2014-11-29 15:56 - 2014-12-18 23:47 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-11-29 15:56 - 2014-12-14 15:28 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-11-29 15:56 - 2014-12-14 15:28 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-11-29 15:56 - 2014-12-14 15:28 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-11-29 15:55 - 2014-12-14 15:28 - 00000000 ____D () C:\Users\X64\AppData\Local\Adobe 2014-11-29 00:16 - 2014-11-29 00:18 - 32126097 _____ () C:\Users\X64\Downloads\6281_02_120sec_00.wmv 2014-11-24 22:07 - 2014-11-24 22:07 - 00000000 ____D () C:\Users\X64\.appwork 2014-11-24 21:55 - 2014-11-24 21:55 - 00000000 ____D () C:\Users\X64\Downloads\PcAtng 2014-11-24 21:19 - 2014-11-23 23:24 - 00048776 _____ (StdLib) C:\Windows\system32\Drivers\{128614e8-07dd-4e11-b9ec-ca2c14f812c5}Gw64.sys 2014-11-24 21:09 - 2014-11-24 21:45 - 00000000 ____D () C:\Program Files (x86)\AppEnable 2014-11-24 21:06 - 2014-11-24 21:07 - 00296144 _____ () C:\Users\X64\Downloads\install_jd_two.exe 2014-11-24 21:04 - 2014-11-24 21:04 - 00319912 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2014-11-24 21:04 - 2014-11-24 21:04 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2014-11-24 21:04 - 2014-11-24 21:04 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe 2014-11-24 21:04 - 2014-11-24 21:04 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll 2014-11-24 21:04 - 2014-11-24 21:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-11-24 21:04 - 2014-11-24 21:04 - 00000000 ____D () C:\Program Files\Java 2014-11-24 20:58 - 2014-11-24 21:00 - 31029672 _____ (Oracle Corporation) C:\Users\X64\Downloads\jre-7u71-windows-x64.exe 2014-11-23 02:40 - 2014-11-23 02:40 - 253376221 _____ () C:\Windows\MEMORY.DMP 2014-11-23 02:40 - 2014-11-23 02:40 - 00751328 _____ () C:\Windows\Minidump\112314-20748-01.dmp 2014-11-23 02:40 - 2014-11-23 02:40 - 00000000 ____D () C:\Windows\Minidump 2014-11-23 01:48 - 2014-11-23 01:48 - 16332718 _____ () C:\Users\X64\Downloads\72242-trailerSilvia Jons.mp4 2014-11-19 04:26 - 2014-11-19 04:26 - 01614504 _____ (Microsoft Corporation) C:\Windows\system32\FM20.DLL 2014-11-18 21:47 - 2014-11-11 05:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2014-11-18 21:47 - 2014-11-11 05:08 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll 2014-11-18 21:47 - 2014-11-11 04:44 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2014-11-18 21:47 - 2014-11-11 04:44 - 00186880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll 2014-11-18 15:59 - 2014-11-18 15:59 - 00001215 _____ () C:\Users\Public\Desktop\Ultra MP4 Video Converter.lnk 2014-11-18 15:59 - 2014-11-18 15:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ultra MP4 Video Converter 2014-11-18 15:59 - 2007-04-12 14:19 - 00129024 _____ () C:\Windows\SysWOW64\AVERM.dll 2014-11-18 15:59 - 2006-09-26 13:57 - 00028672 _____ () C:\Windows\SysWOW64\AVEQT.dll 2014-11-18 15:59 - 2004-01-11 08:02 - 00258048 _____ (Peter Wimmer, Gabest) C:\Windows\SysWOW64\GplMpgDec.ax 2014-11-18 15:58 - 2014-11-18 16:00 - 00000000 ____D () C:\Program Files (x86)\Ultra MP4 Video Converter ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-18 23:34 - 2009-07-14 06:45 - 00026576 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-12-18 23:34 - 2009-07-14 06:45 - 00026576 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-12-18 23:31 - 2014-11-17 00:06 - 00007611 _____ () C:\Users\X64\AppData\Local\Resmon.ResmonCfg 2014-12-18 23:30 - 2014-10-16 22:31 - 01475604 _____ () C:\Windows\WindowsUpdate.log 2014-12-18 23:27 - 2014-10-18 01:32 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-12-18 23:27 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-12-18 23:27 - 2009-07-14 06:51 - 00060012 _____ () C:\Windows\setupact.log 2014-12-18 23:26 - 2014-11-11 15:49 - 00000000 ____D () C:\Users\X64\AppData\Roaming\5AE3CBE9-0A3F-4C53-8891-2FA2D6C29796 2014-12-18 23:25 - 2009-07-14 07:08 - 00032532 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-12-18 23:11 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\tracing 2014-12-18 00:24 - 2014-11-06 02:44 - 00000000 ____D () C:\Users\X64\AppData\Roaming\vlc 2014-12-17 03:16 - 2014-10-17 13:11 - 00000000 ____D () C:\Users\X64\Desktop\p 2014-12-16 00:39 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache 2014-12-15 02:07 - 2014-10-16 23:40 - 00000000 ____D () C:\Users\X64\AppData\Roaming\uTorrent 2014-12-13 02:12 - 2014-10-18 01:34 - 02824504 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll 2014-12-13 02:12 - 2014-10-18 01:34 - 02210040 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll 2014-12-13 02:12 - 2014-10-18 01:34 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll 2014-12-13 02:12 - 2014-10-18 01:34 - 01291464 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll 2014-12-11 05:29 - 2014-10-17 12:42 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-12-11 05:29 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-12-11 05:29 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\AppCompat 2014-12-11 03:13 - 2014-10-17 22:55 - 00000000 ____D () C:\Windows\system32\MRT 2014-12-11 03:08 - 2014-11-11 21:59 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-12-11 03:08 - 2014-10-16 22:45 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-12-10 16:28 - 2014-10-16 23:26 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-12-08 21:32 - 2014-10-17 01:34 - 00000000 ____D () C:\Users\X64\AppData\Roaming\MPC-HC 2014-12-07 20:00 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF 2014-12-05 21:55 - 2014-10-16 23:06 - 00000000 ____D () C:\NVIDIA 2014-12-03 12:59 - 2009-07-14 07:13 - 00781298 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-11-24 22:07 - 2014-10-16 22:46 - 00000000 ____D () C:\Users\X64 2014-11-24 21:45 - 2010-11-21 05:47 - 00016434 _____ () C:\Windows\PFRO.log 2014-11-24 21:19 - 2009-07-14 04:34 - 00000580 _____ () C:\Windows\win.ini 2014-11-23 02:38 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\LiveKernelReports 2014-11-22 12:46 - 2014-10-18 01:23 - 00035472 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll Some content of TEMP: ==================== C:\Users\X64\AppData\Local\Temp\130613296665546762.exe C:\Users\X64\AppData\Local\Temp\13061329701666684542.exe C:\Users\X64\AppData\Local\Temp\ExPromo.exe C:\Users\X64\AppData\Local\Temp\nvSCPAPISvr.exe C:\Users\X64\AppData\Local\Temp\nvStInst.exe C:\Users\X64\AppData\Local\Temp\ose00000.exe C:\Users\X64\AppData\Local\Temp\proxy_vole4541996057606417435.dll C:\Users\X64\AppData\Local\Temp\tmp-drivermax8738812.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed ==================== BCD ================================ Windows Boot Manager -------------------- identifier {bootmgr} device partition=D: description Windows Boot Manager locale en-US inherit {globalsettings} default {current} resumeobject {88b9698c-413e-11dc-a56a-96b998a7e5b5} displayorder {current} toolsdisplayorder {memdiag} timeout 30 Windows Boot Loader ------------------- identifier {88b9698a-413e-11dc-a56a-96b998a7e5b5} device ramdisk=[C:]\Recovery\88b9698a-413e-11dc-a56a-96b998a7e5b5\Winre.wim,{88b9698b-413e-11dc-a56a-96b998a7e5b5} path \windows\system32\winload.exe description Windows Recovery Environment inherit {bootloadersettings} osdevice ramdisk=[C:]\Recovery\88b9698a-413e-11dc-a56a-96b998a7e5b5\Winre.wim,{88b9698b-413e-11dc-a56a-96b998a7e5b5} systemroot \windows nx OptIn winpe Yes Windows Boot Loader ------------------- identifier {current} device partition=C: path \Windows\system32\winload.exe description Windows 7 locale en-US inherit {bootloadersettings} recoverysequence {88b9698e-413e-11dc-a56a-96b998a7e5b5} recoveryenabled Yes osdevice partition=C: systemroot \Windows resumeobject {88b9698c-413e-11dc-a56a-96b998a7e5b5} nx OptIn Windows Boot Loader ------------------- identifier {88b9698e-413e-11dc-a56a-96b998a7e5b5} device ramdisk=[C:]\Recovery\88b9698e-413e-11dc-a56a-96b998a7e5b5\Winre.wim,{88b9698f-413e-11dc-a56a-96b998a7e5b5} path \windows\system32\winload.exe description Windows Recovery Environment inherit {bootloadersettings} osdevice ramdisk=[C:]\Recovery\88b9698e-413e-11dc-a56a-96b998a7e5b5\Winre.wim,{88b9698f-413e-11dc-a56a-96b998a7e5b5} systemroot \windows nx OptIn winpe Yes Resume from Hibernate --------------------- identifier {88b9698c-413e-11dc-a56a-96b998a7e5b5} device partition=C: path \Windows\system32\winresume.exe description Windows Resume Application locale en-US inherit {resumeloadersettings} filedevice partition=C: filepath \hiberfil.sys pae Yes debugoptionenabled No Windows Memory Tester --------------------- identifier {memdiag} device partition=D: path \boot\memtest.exe description Windows Memory Diagnostic locale en-US inherit {globalsettings} badmemoryaccess Yes EMS Settings ------------ identifier {emssettings} bootems Yes Debugger Settings ----------------- identifier {dbgsettings} debugtype Serial debugport 1 baudrate 115200 RAM Defects ----------- identifier {badmemory} Global Settings --------------- identifier {globalsettings} inherit {dbgsettings} {emssettings} {badmemory} Boot Loader Settings -------------------- identifier {bootloadersettings} inherit {globalsettings} {hypervisorsettings} Hypervisor Settings ------------------- identifier {hypervisorsettings} hypervisordebugtype Serial hypervisordebugport 1 hypervisorbaudrate 115200 Resume Loader Settings ---------------------- identifier {resumeloadersettings} inherit {globalsettings} Device options -------------- identifier {88b9698b-413e-11dc-a56a-96b998a7e5b5} description Ramdisk Options ramdisksdidevice partition=C: ramdisksdipath \Recovery\88b9698a-413e-11dc-a56a-96b998a7e5b5\boot.sdi Device options -------------- identifier {88b9698f-413e-11dc-a56a-96b998a7e5b5} description Ramdisk Options ramdisksdidevice partition=C: ramdisksdipath \Recovery\88b9698e-413e-11dc-a56a-96b998a7e5b5\boot.sdi LastRegBack: 2014-12-16 00:31 ==================== End Of Log ============================ Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-12-2014 Ran by X64 at 2014-12-18 23:52:28 Running from C:\Users\X64\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1} AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) µTorrent (HKU\S-1-5-21-1957158611-1858047153-2874929278-1000\...\uTorrent) (Version: 3.4.2.35702 - BitTorrent Inc.) Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems Incorporated) AEnglish Dictionary XP 1.72 (HKLM-x32\...\AEnglish Dictionary_is1) (Version: - Wise Guy) DAEMON Tools Pro (HKLM-x32\...\DAEMON Tools Pro) (Version: 5.5.0.0388 - Disc Soft Ltd) EVEREST Ultimate Edition v5.50 (HKLM-x32\...\EVEREST Ultimate Edition_is1) (Version: 5.50 - Lavalys, Inc.) Free Hide IP (HKLM-x32\...\FreeHideIP) (Version: 4.0.0.2 - ) GOM Player (HKLM-x32\...\GOM Player) (Version: 2.2.64.5211 - Gretech Corporation) Java 7 Update 71 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417071FF}) (Version: 7.0.710 - Oracle) Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation) Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation) Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation) Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation) Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation) Mozilla Firefox 34.0.5 (x86 bg) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 bg)) (Version: 34.0.5 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.0 - Mozilla) MPC-HC 1.7.7 (64-bit) (HKLM\...\{2ACBF1FA-F5C3-4B19-A774-B22A31F231B9}_is1) (Version: 1.7.7 - MPC-HC Team) NVIDIA 3D Vision Controller Driver 340.50 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 340.50 - NVIDIA Corporation) NVIDIA 3D Vision Driver 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 340.52 - NVIDIA Corporation) NVIDIA GeForce Experience 2.1.5 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.5 - NVIDIA Corporation) NVIDIA Graphics Driver 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation) NVIDIA HD Audio Driver 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation) NVIDIA PhysX System Software 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation) Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group) Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{A3364707-2F53-4C83-8F68-C9877A9080C7}) (Version: - Microsoft) Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version: - Microsoft) Hidden SHIELD Streaming (Version: 3.1.3000 - NVIDIA Corporation) Hidden SHIELD Wireless Controller Driver (Version: 16.18.9 - NVIDIA Corporation) Hidden Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation) Skype™ 6.21 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.21.104 - Skype Technologies S.A.) SopCast 3.9.3 (HKLM-x32\...\SopCast) (Version: 3.9.3 - www.sopcast.com) Thunder Master v1.3 (HKLM-x32\...\{EE04522C-0814-4B63-AE57-0B63E5A355BB}_is1) (Version: 1.3.0.1 - Palit Microsystems Ltd.) Ultra MP4 Video Converter 6.0.0202 (HKLM-x32\...\Ultra MP4 Video Converter_is1) (Version: - Aone Software) VLC media player 2.1.4 (HKLM\...\VLC media player) (Version: 2.1.4 - VideoLAN) WinRAR 5.11 (64-битова версия) (HKLM\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) ==================== Restore Points ========================= 11-12-2014 03:00:44 Windows Update 12-12-2014 19:51:10 Windows Update 16-12-2014 20:22:55 Windows Update 18-12-2014 17:37:40 Windows Update ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {2925F4E1-2965-4991-9DF3-D66878395FCA} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-14] (Adobe Systems Incorporated) Task: {5FA02F43-C08F-4BC0-AAA7-C7971969BC6D} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc Task: {80675188-8FBF-4F54-A934-9FAF472B1692} - System32\Tasks\{B5907014-6D39-4CF1-B72C-3C006DE17AA9} => pcalua.exe -a "G:\DAEMON Tools Pro Advanced v5.5.0.0388\DAEMONToolPro.exe" -d "G:\DAEMON Tools Pro Advanced v5.5.0.0388" Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe ==================== Loaded Modules (whitelisted) ============= 2014-10-18 01:32 - 2014-07-02 20:55 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll 2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF 2010-10-20 15:23 - 2010-10-20 15:23 - 08801632 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll 2014-11-11 16:14 - 2014-11-11 15:05 - 00003132 ____R () C:\Program Files (x86)\DAEMON Tools Pro\MSIMG32.dll 2014-12-09 19:05 - 2014-12-09 19:05 - 03758192 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll 2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF 2010-10-20 15:45 - 2010-10-20 15:45 - 08801120 _____ () C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll 2014-12-14 15:28 - 2014-12-14 15:28 - 16843952 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== EXE Association (whitelisted) ============= (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== MSCONFIG/TASK MANAGER disabled items ========= (Currently there is no automatic fix for this section.) ========================= Accounts: ========================== Administrator (S-1-5-21-1957158611-1858047153-2874929278-500 - Administrator - Disabled) Guest (S-1-5-21-1957158611-1858047153-2874929278-501 - Limited - Disabled) HomeGroupUser$ (S-1-5-21-1957158611-1858047153-2874929278-1002 - Limited - Enabled) X64 (S-1-5-21-1957158611-1858047153-2874929278-1000 - Administrator - Enabled) => C:\Users\X64 ==================== Faulty Device Manager Devices ============= Name: Multimedia Audio Controller Description: Multimedia Audio Controller Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. Name: Standard PS/2 Keyboard Description: Standard PS/2 Keyboard Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318} Manufacturer: (Standard keyboards) Service: i8042prt Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24) Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed. Devices stay in this state if they have been prepared for removal. After you remove the device, this error disappears.Remove the device, and this error should be resolved. Name: Teredo Tunneling Pseudo-Interface Description: Microsoft Teredo Tunneling Adapter Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: Microsoft Service: tunnel Problem: : This device cannot start. (Code10) Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device. On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard. ==================== Event log errors: ========================= Application errors: ================== Error: (12/18/2014 11:28:51 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/18/2014 11:26:12 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/18/2014 11:11:05 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/18/2014 04:43:35 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/18/2014 08:55:03 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/17/2014 09:59:17 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/17/2014 05:10:13 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/17/2014 02:16:04 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/17/2014 02:49:04 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/17/2014 00:44:36 AM) (Source: NvStreamSvc) (EventID: 1) (User: ) Description: NvStreamSvcNetworkStreamService did not shut down when asked, terminating. [0] System errors: ============= Error: (12/18/2014 11:27:23 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The Util AppEnable service failed to start due to the following error: %%2 Error: (12/18/2014 11:26:02 PM) (Source: Service Control Manager) (EventID: 7032) (User: ) Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Server service, but this action failed with the following error: %%1056 Error: (12/18/2014 11:25:27 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: The Diagnostic System Host service terminated unexpectedly. It has done this 1 time(s). Error: (12/18/2014 11:25:27 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: The Desktop Window Manager Session Manager service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service. Error: (12/18/2014 11:25:27 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: The Distributed Link Tracking Client service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service. Error: (12/18/2014 11:25:27 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: The Superfetch service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. Error: (12/18/2014 11:25:27 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: The Program Compatibility Assistant Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. Error: (12/18/2014 11:25:27 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: The Network Connections service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 100 milliseconds: Restart the service. Error: (12/18/2014 11:25:27 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: The HomeGroup Listener service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. Error: (12/18/2014 11:25:27 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: The Human Interface Device Access service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service. Microsoft Office Sessions: ========================= Error: (12/18/2014 11:28:51 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/18/2014 11:26:12 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/18/2014 11:11:05 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/18/2014 04:43:35 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/18/2014 08:55:03 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/17/2014 09:59:17 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/17/2014 05:10:13 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/17/2014 02:16:04 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/17/2014 02:49:04 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/17/2014 00:44:36 AM) (Source: NvStreamSvc) (EventID: 1) (User: ) Description: NvStreamSvcNetworkStreamService did not shut down when asked, terminating. [0] ==================== Memory info =========================== Processor: Intel® Pentium® Dual CPU E2180 @ 2.00GHz Percentage of memory in use: 64% Total physical RAM: 2046.49 MB Available physical RAM: 722.14 MB Total Pagefile: 4092.98 MB Available Pagefile: 2397.76 MB Total Virtual: 8192 MB Available Virtual: 8191.81 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:78.03 GB) (Free:36.31 GB) NTFS Drive d: (Резервирана за системата) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[system with boot components (obtained from reading drive)] Drive e: () (Fixed) (Total:219.96 GB) (Free:11.85 GB) NTFS Drive g: (Нов том) (Fixed) (Total:931.51 GB) (Free:24.39 GB) NTFS ==>[system with boot components (obtained from reading drive)] ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 90D42CFD) Partition 1: (Active) - (Size=931.5 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: F90CF90C) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=78 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=220 GB) - (Type=07 NTFS) ==================== End Of Log ============================
  15. Здравеите немога да вляза в системата си поради постоянно излизане на син екран имам опасение че е вирус ето прикачих фаиловете които се изискваха Addition.txt FRST.txt
  16. На чиста система Comodo направи сканиране след ъпдейт и намери някакъв rootkit reset LGKC........след това пуснах Comodo Cleanning Essentials и откри Още няколко ще ги прикача и логовете от него ...............................Няколко пъти ми даде предупреждение,че коментара ми е прекалено дълъг,затова ще пикача всички логове........... В момента C:\ се пълни постоянно ............след инсталацията и всички ъпдейти беше 25гб падна до 19.5гб в момента е 22,6гб............ уж изчистих всичко с WiseDisk................................................ FRST.txt Addition.txt CCE_20141126_155223.txt CCE_20141126_190529.txt
  17. Здравейте, преди време в компютъра ми влезе вирус който кодира всички файлове, отидох на сервиз и ми казаха че няма как да се разкодират, а трябва да се смени windows-а. Предложиха ми да запиша файловете и след време можело да се намери начин да се разкодират. Та искам да попитам има ли такъв начин вече?
  18. 1.Търся програма, с която да си махна вирусите: Постоянно ми излизат вируси - независимо от това дали ще го преинсталирам или не. Вирусите са ,, by context'' -> Сиреч http://malwaretips.com/blogs/remove-offers-by-context-virus/ Добре ама там съветите не помагат. Инсталирал съм Avast, Superantispyware, Malware bytes anti malware. НИЩО ОТ ТОВА НЕ ПОМАГА. Единствено последният продукт от време на време ги блокирва. 2. Лаптопа ми стана супер бавен - забелязвам, че CPU USAGE се вдига от 60% нагоре до 100 почти. Имало е дни, в които нищо не съм отварял а CPU USAGE постояно държи 90-100% Всичко това стана след смяна на хард диска ми. И компютъра не работи както трябва Процесора е Intel core i 3. 3 GB RAM , VIDEO - 1 GB ATI R. Дайте някакви съвети. Забелязвам също, че при претискане силно на клавиатурата или капака т.е. силно натискане и лаптопа забива. Не може да се мърда курсора на мишката или някакви други действия освен да го изключа от бутона/кабела. Това също не знам на какво се дължи. При затваряне на лаптопа също не заспива - както по принцип ставаше. И мисля, че не е от настройките. Сайтове, които работят на флаш (като повечето онлайн казина например) - забиват страшно много. А с калдата нямам този проблем. Също като пиша в някои от сайтовете на флаш - излизат буквите след секунди. Тук си пиша мигновенно. Някакви съвети за програми за оптимизация и тнт ? П.П. -> capnemo знам, че може би ти отговаряш за този раздел. Не влизам тук редовно - ако обичаш не ми затваряй темата, а я премести там където е нужно... / молба /
  19. Здравейте, имам проблем с тези реклами, излизат ми навсякъде в браузъра, явно съм пропуснал да махна тикчето на гадинката в някой инсталатор. Благодаря ви предварително за оказаната помощ. Ето съдържанието на FRST.txt Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-03-2015 Ran by Nikolay (administrator) on NIKI-PC on 03-03-2015 22:21:43 Running from C:\Users\Nikolay\Downloads Loaded Profiles: Nikolay (Available profiles: Nikolay & Valyo) Platform: Windows 8.1 Pro with Media Center (X64) OS Language: English (United States) Internet Explorer Version 11 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ElevationManager\AdobeUpdateService.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Phone Tools\CoreCon\11.0\Bin\IpOverUsbSvc.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe () C:\Program Files (x86)\ver2OffersWizard\B9eG190.exe () C:\Windows\SysWOW64\PnkBstrA.exe () C:\Windows\SysWOW64\PnkBstrB.exe (DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe (VIA Technologies, Inc.) C:\Windows\System32\ViakaraokeSrv.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation) C:\Windows\System32\vmms.exe (Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe () C:\Program Files (x86)\ver2OffersWizard\e6OffersWizard66.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe () C:\Program Files (x86)\ver2OffersWizard\L2h.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (AsusTek) E:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe (VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (Pixart Imaging Inc) C:\Windows\System32\TiltWheelMouse.exe (BitTorrent Inc.) C:\Users\Nikolay\AppData\Roaming\BitTorrent\BitTorrent.exe (AsusTek) E:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3540 series\Bin\ScanToPCActivationApp.exe () C:\Users\Nikolay\AppData\Local\Viber\Viber.exe (Electronic Arts) E:\Program Files (x86)\Origin\Origin.exe (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe () C:\ProgramData\{c0e7f4f5-5eb8-b3cd-c0e7-7f4f55ebd3d5}\pa_gapps-modular-mini-4.4.4-20141103-signed.zip.exe (ASUSTeK Computer Inc.) E:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusSmartGestureDetector64.exe () C:\Users\Nikolay\Downloads\adwcleaner_4.111.exe (Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\livecomm.exe (AsusTek) E:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe (Microsoft Corporation) C:\Windows\System32\WWAHost.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [1796056 2014-08-19] (NVIDIA Corporation) HKLM\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [4689072 2013-12-26] (VIA) HKLM\...\Run: [MouseDriver] => C:\Windows\system32\TiltWheelMouse.exe [241152 2013-04-09] (Pixart Imaging Inc) HKLM\...\Run: [AdobeAAMUpdater-1.0] => "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2694320 2015-01-07] (Adobe Systems Incorporated) HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [508800 2014-12-17] (Oracle Corporation) HKU\S-1-5-21-1890519435-3532758963-1489022427-1001\...\Run: [bitComet] => "C:\Program Files\BitComet\BitComet.exe" /tray HKU\S-1-5-21-1890519435-3532758963-1489022427-1001\...\Run: [bitTorrent] => C:\Users\Nikolay\AppData\Roaming\BitTorrent\BitTorrent.exe [1442904 2015-02-07] (BitTorrent Inc.) HKU\S-1-5-21-1890519435-3532758963-1489022427-1001\...\Run: [swvUpdtr] => C:\Users\Nikolay\AppData\Local\17879\Updater.exe [594432 2015-01-08] () HKU\S-1-5-21-1890519435-3532758963-1489022427-1001\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd) HKU\S-1-5-21-1890519435-3532758963-1489022427-1001\...\Run: [uTorrent] => C:\Users\Valyo\AppData\Roaming\uTorrent\uTorrent.exe [1736784 2015-01-24] (BitTorrent Inc.) HKU\S-1-5-21-1890519435-3532758963-1489022427-1001\...\Run: [HP Deskjet 3540 series (NET)] => C:\Program Files\HP\HP Deskjet 3540 series\Bin\ScanToPCActivationApp.exe [3487240 2014-03-06] (Hewlett-Packard Co.) HKU\S-1-5-21-1890519435-3532758963-1489022427-1001\...\Run: [Viber] => C:\Users\Nikolay\AppData\Local\Viber\Viber.exe [936656 2014-10-20] () HKU\S-1-5-21-1890519435-3532758963-1489022427-1001\...\Run: [EADM] => E:\Program Files (x86)\Origin\Origin.exe [3619160 2015-02-06] (Electronic Arts) HKU\S-1-5-21-1890519435-3532758963-1489022427-1001\...\MountPoints2: {66450df7-978e-11e4-824b-806e6f6e6963} - "H:\QuantorSV.exe" HKU\S-1-5-21-1890519435-3532758963-1489022427-1001\...\MountPoints2: {ebd1fd74-a1cc-11e4-825a-902b345e4cb5} - "J:\LGAutoRun.exe" HKU\S-1-5-21-1890519435-3532758963-1489022427-1001\...\MountPoints2: {f14914e4-9906-11e4-8253-902b345e4cb5} - "I:\vs_ultimate.exe" Startup: C:\Users\Nikolay\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pa_gapps-modular-mini-4.4.4-20141103-signed.zip.lnk ShortcutTarget: pa_gapps-modular-mini-4.4.4-20141103-signed.zip.lnk -> C:\ProgramData\{c0e7f4f5-5eb8-b3cd-c0e7-7f4f55ebd3d5}\pa_gapps-modular-mini-4.4.4-20141103-signed.zip.exe () ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll () ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll () ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll () CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) ProxyEnable: [s-1-5-21-1890519435-3532758963-1489022427-1001] => Internet Explorer proxy is enabled. ProxyServer: [s-1-5-21-1890519435-3532758963-1489022427-1001] => http=127.0.0.1:14076;https=127.0.0.1:14076 SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation) BHO: OffersWizard -> {4359A48A-62E5-9696-71B3-1C273503AA37} -> C:\Program Files (x86)\ver2OffersWizard\190_x64.dll () BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation) BHO-x32: OffersWizard -> {4359A48A-62E5-9696-71B3-1C273503AA37} -> C:\Program Files (x86)\ver2OffersWizard\190.dll () BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation) BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation) Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation) Winsock: Catalog5 07 C:\Windows\SysWOW64\wlidNSP.dll [49664] (Microsoft Corporation) Winsock: Catalog5 08 C:\Windows\SysWOW64\wlidNSP.dll [49664] (Microsoft Corporation) Winsock: Catalog5-x64 07 C:\Windows\system32\wlidnsp.dll [73216] (Microsoft Corporation) Winsock: Catalog5-x64 08 C:\Windows\system32\wlidnsp.dll [73216] (Microsoft Corporation) Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 FireFox: ======== FF ProfilePath: C:\Users\Nikolay\AppData\Roaming\Mozilla\Firefox\Profiles\werc4scl.default FF DefaultSearchEngine: Google FF DefaultSearchEngine.US: Google FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll () FF Plugin: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelogx64.dll (EA Digital Illusions CE AB) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/SharePoint,version=14.0 -> G:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll No File FF Plugin: adobe.com/AdobeAAMDetect_x86_64 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll () FF Plugin-x32: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelog.dll (EA Digital Illusions CE AB) FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll No File FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems) FF user.js: detected! => C:\Users\Nikolay\AppData\Roaming\Mozilla\Firefox\Profiles\werc4scl.default\user.js FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation) FF Extension: ZenMate Security &amp; Privacy VPN - C:\Users\Nikolay\AppData\Roaming\Mozilla\Firefox\Profiles\werc4scl.default\Extensions\[email protected] [2015-02-11] FF Extension: YouTube mp3 - C:\Users\Nikolay\AppData\Roaming\Mozilla\Firefox\Profiles\werc4scl.default\Extensions\[email protected] [2015-01-18] FF Extension: Better Wikipedia - C:\Users\Nikolay\AppData\Roaming\Mozilla\Firefox\Profiles\werc4scl.default\Extensions\[email protected] [2015-02-16] FF Extension: Adblock Plus - C:\Users\Nikolay\AppData\Roaming\Mozilla\Firefox\Profiles\werc4scl.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-01-08] FF HKU\S-1-5-21-1890519435-3532758963-1489022427-1001\...\Firefox\Extensions: [{85A9DD51-C7AB-8CCB-1BF6-9AF83F578FE1}] - C:\Program Files (x86)\ver2OffersWizard\190.xpi FF Extension: No Name - C:\Program Files (x86)\ver2OffersWizard\190.xpi [2015-03-03] Chrome: ======= CHR dev: Chrome dev build detected! <======= ATTENTION ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S2 9617fb41; c:\Program Files (x86)\SystemContinue\SystemContinue.dll [1942016 2015-02-12] () [File not signed] R2 AdobeUpdateService; C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ElevationManager\AdobeUpdateService.exe [710320 2015-01-07] (Adobe Systems Incorporated) S3 ICCS; C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe [160256 2011-08-30] (Intel Corporation) [File not signed] R2 IpOverUsbSvc; C:\Program Files (x86)\Common Files\Microsoft Shared\Phone Tools\CoreCon\11.0\Bin\IpOverUsbSvc.exe [14760 2012-09-26] (Microsoft Corporation) R2 OffersWizard; C:\Program Files (x86)\ver2OffersWizard\B9eG190.exe [349696 2015-03-03] () [File not signed] S3 Origin Client Service; E:\Program Files (x86)\Origin\OriginClientService.exe [1910640 2015-02-27] (Electronic Arts) R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75136 2015-02-11] () R2 PnkBstrB; C:\Windows\SysWOW64\PnkBstrB.exe [189248 2015-02-11] () R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2014-10-12] (DEVGURU Co., LTD.) S3 Survarium Update Service; E:\Program Files (x86)\Survarium\game\binaries\x86\survarium_service.exe [76408 2015-02-25] () R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5426448 2014-12-15] (TeamViewer GmbH) R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27768 2012-12-11] (VIA Technologies, Inc.) R2 vmms; C:\Windows\system32\vmms.exe [13401600 2014-09-03] (Microsoft Corporation) R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-21] (Microsoft Corporation) R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-21] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 AndNetDiag; C:\Windows\system32\DRIVERS\lgandnetdiag64.sys [30720 2014-10-10] (LG Electronics Inc.) S3 ANDNetModem; C:\Windows\system32\DRIVERS\lgandnetmodem64.sys [37376 2014-10-10] (LG Electronics Inc.) R3 AsusVBus; C:\Windows\System32\drivers\AsusVBus.sys [39704 2015-01-23] (Windows ® Win 7 DDK provider) R3 ATP; C:\Windows\System32\drivers\AsusTP.sys [66840 2015-01-23] (ASUS Corporation) R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283064 2015-01-10] (Disc Soft Ltd) R1 hvservice; C:\Windows\System32\drivers\hvservice.sys [68960 2015-01-11] (Microsoft Corporation) S3 lunparser; C:\Windows\System32\drivers\lunparser.sys [19456 2015-01-18] (Microsoft Corporation) S3 passthruparser; C:\Windows\System32\drivers\passthruparser.sys [22016 2015-01-18] (Microsoft Corporation) S3 pvhdparser; C:\Windows\System32\drivers\pvhdparser.sys [27136 2013-11-19] (Microsoft Corporation) R3 SensorsSimulatorDriver; C:\Windows\system32\DRIVERS\WUDFRd.sys [227840 2014-05-30] (Microsoft Corporation) R3 t_mouse.sys; C:\Windows\system32\DRIVERS\t_mouse.sys [6144 2013-04-09] () S3 vhdparser; C:\Windows\System32\drivers\vhdparser.sys [18944 2014-01-27] (Microsoft Corporation) R3 VMSMP; C:\Windows\system32\DRIVERS\vmswitch.sys [690688 2014-08-25] (Microsoft Corporation) S3 VMSP; C:\Windows\system32\DRIVERS\vmswitch.sys [690688 2014-08-25] (Microsoft Corporation) S3 VMSVSF; C:\Windows\system32\DRIVERS\vmswitch.sys [690688 2014-08-25] (Microsoft Corporation) S3 VMSVSP; C:\Windows\system32\DRIVERS\vmswitch.sys [690688 2014-08-25] (Microsoft Corporation) R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-21] (Microsoft Corporation) S3 xusb22; C:\Windows\System32\drivers\xusb22.sys [87040 2014-03-18] (Microsoft Corporation) S3 cpuz138; \??\C:\Users\Nikolay\AppData\Local\Temp\cpuz138\cpuz138_x64.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-03-03 22:21 - 2015-03-03 22:22 - 00018089 _____ () C:\Users\Nikolay\Downloads\FRST.txt 2015-03-03 22:21 - 2015-03-03 22:21 - 02092544 _____ (Farbar) C:\Users\Nikolay\Downloads\FRST64.exe 2015-03-03 22:21 - 2015-03-03 22:21 - 00000000 ____D () C:\FRST 2015-03-03 20:21 - 2015-03-03 20:21 - 02126848 _____ () C:\Users\Nikolay\Downloads\adwcleaner_4.111.exe 2015-03-03 17:29 - 2015-03-03 20:39 - 00000442 _____ () C:\Windows\Tasks\OffersWizard Update.job 2015-03-03 17:29 - 2015-03-03 17:29 - 00003086 _____ () C:\Windows\System32\Tasks\OffersWizard Update 2015-03-03 17:29 - 2015-03-03 17:29 - 00000000 ____D () C:\Program Files (x86)\ver2OffersWizard 2015-02-27 19:30 - 2015-02-27 19:30 - 00000000 ____D () C:\Users\Nikolay\AppData\Roaming\LolClient 2015-02-27 13:26 - 2015-02-27 13:26 - 00001325 _____ () C:\Users\Valyo\Downloads\PAYDAY 2 DLC UNLOCKER (TheLostHackingChannel).rar 2015-02-27 13:17 - 2014-10-24 11:06 - 00000159 _____ () C:\Users\Valyo\Downloads\DLCUnlocker.lua 2015-02-27 13:14 - 2015-02-27 13:14 - 00000000 ____D () C:\Users\Valyo\AppData\Roaming\WinRAR 2015-02-27 00:48 - 2015-02-27 00:48 - 00000000 ____D () C:\ProgramData\Riot Games 2015-02-27 00:48 - 2008-07-12 08:18 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll 2015-02-27 00:48 - 2008-07-12 08:18 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll 2015-02-27 00:48 - 2008-07-12 08:18 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll 2015-02-27 00:47 - 2015-02-27 00:47 - 00001515 _____ () C:\Users\Public\Desktop\League of Legends.lnk 2015-02-27 00:47 - 2015-02-27 00:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\League of Legends 2015-02-27 00:37 - 2015-02-27 00:48 - 00000000 ____D () C:\Users\Nikolay\AppData\Roaming\Riot Games 2015-02-27 00:36 - 2015-02-27 00:36 - 30993712 _____ (Riot Games) C:\Users\Nikolay\Downloads\LeagueofLegends_EUNE_Installer_9_15_2014.exe 2015-02-26 10:03 - 2015-02-26 10:04 - 01802271 _____ () C:\Users\Nikolay\Desktop\Моят начин на Живот.pptm 2015-02-26 10:03 - 2015-02-26 10:03 - 00000165 ____H () C:\Users\Nikolay\Desktop\~$Моят начин на Живот.pptm 2015-02-25 22:31 - 2015-02-26 00:45 - 00000000 ____D () C:\Users\Nikolay\Documents\Survarium 2015-02-25 22:31 - 2015-02-25 22:31 - 00001179 _____ () C:\Users\Public\Desktop\Play Survarium.lnk 2015-02-25 22:31 - 2015-02-25 22:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Survarium 2015-02-25 22:30 - 2015-02-25 22:31 - 00000000 ____D () C:\Windows\SysWOW64\directx 2015-02-25 22:30 - 2015-02-25 22:30 - 01901432 _____ ( ) C:\Users\Nikolay\Downloads\survarium-web-installer-026h0.exe 2015-02-25 21:47 - 2015-02-25 21:47 - 00000000 ____D () C:\Users\Nikolay\Desktop\Моят начин на Живот 2015-02-25 21:45 - 2015-02-25 21:45 - 17551766 _____ () C:\Users\Nikolay\Desktop\Моят начин на Живот.camrec 2015-02-25 21:33 - 2015-02-25 21:33 - 00008768 _____ () C:\Users\Nikolay\Desktop\images21.jpeg 2015-02-25 21:20 - 2015-02-25 21:20 - 00000391 _____ () C:\Users\Nikolay\Desktop\httpsfbcdn-sphotos-h-a.akamaihd.nethphotos-ak-xpf1vt34.0-1210994736_634674856636859_2035101047_n.jpgoh=98e6975d94d1bc49ea73f.URL 2015-02-25 21:18 - 2015-02-25 21:18 - 00000479 _____ () C:\Users\Nikolay\Desktop\Резултат с изображение за 51 соу 800 × 295 - getlokal.com.URL 2015-02-25 12:11 - 2015-02-25 12:11 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2015-02-25 10:39 - 2015-02-25 10:39 - 00010147 _____ () C:\Users\Nikolay\Desktop\dataimagejpeg;base64,9j4AAQSkZJRgABAQAAAQABAAD2wCEAAkGBxQTEhUUExQUFhUUGBcXGBcYFxQYGhoYFxQXGBgXFxgaHCggGBolHBQUITEhJSkrLi4uFx.URL 2015-02-25 10:39 - 2015-02-25 10:39 - 00000475 _____ () C:\Users\Nikolay\Desktop\Резултат с изображение за моя начин на живот 512 × 389 - fitnesinstruktor.com.URL 2015-02-24 23:22 - 2014-12-13 13:28 - 00513488 _____ () C:\Windows\SysWOW64\locale.nls 2015-02-24 23:22 - 2014-12-13 13:28 - 00513488 _____ () C:\Windows\system32\locale.nls 2015-02-24 23:22 - 2014-10-28 17:27 - 01200128 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Globalization.dll 2015-02-24 23:22 - 2014-10-28 17:27 - 00323072 _____ (Microsoft Corporation) C:\Windows\system32\GlobCollationHost.dll 2015-02-24 23:22 - 2014-10-28 17:04 - 00868352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Globalization.dll 2015-02-24 23:22 - 2014-10-28 17:04 - 00200704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GlobCollationHost.dll 2015-02-22 17:33 - 2015-02-23 23:03 - 00000000 ____D () C:\Users\Nikolay\AppData\Local\PAYDAY 2015-02-22 17:05 - 2015-02-22 17:05 - 00000000 ____D () C:\Users\Nikolay\Documents\Battlefield 3 2015-02-22 17:04 - 2015-02-22 17:04 - 01533584 _____ () C:\Users\Nikolay\Downloads\battlelog-web-plugins_2.6.2_157.exe 2015-02-22 17:04 - 2015-02-22 17:04 - 00000000 ____D () C:\Users\Nikolay\AppData\Local\ESN 2015-02-22 17:04 - 2015-02-22 17:04 - 00000000 ____D () C:\Program Files (x86)\Battlelog Web Plugins 2015-02-18 17:30 - 2015-02-18 17:30 - 00000222 _____ () C:\Users\Valyo\Desktop\Besiege.url 2015-02-18 15:11 - 2015-02-18 15:11 - 00000000 ____D () C:\Users\Valyo\Documents\WB Games 2015-02-18 11:22 - 2015-02-18 11:22 - 00000000 ____D () C:\ProgramData\SystemRequirementsLab 2015-02-18 11:22 - 2015-02-18 11:22 - 00000000 ____D () C:\Program Files (x86)\SystemRequirementsLab 2015-02-17 22:42 - 2015-02-17 22:42 - 00000000 ____D () C:\Users\Nikolay\Downloads\Xamarin Visual Studio 3.9.236 2015-02-17 22:22 - 2015-02-17 22:22 - 00267983 _____ () C:\Users\Nikolay\Downloads\WPInsiderHacks.zip 2015-02-17 22:22 - 2015-02-17 22:22 - 00036575 _____ () C:\Users\Nikolay\Downloads\WPInsiderHacks_src.zip 2015-02-17 22:22 - 2015-02-17 22:22 - 00000000 ____D () C:\Users\Nikolay\Downloads\WPInsiderHacks 2015-02-17 16:57 - 2015-02-22 15:18 - 00000000 ____D () C:\Users\Valyo\AppData\Local\PAYDAY 2015-02-17 16:42 - 2015-02-17 16:42 - 00000221 _____ () C:\Users\Valyo\Desktop\PAYDAY The Heist.url 2015-02-16 21:17 - 2015-02-16 21:17 - 00000000 ____D () C:\Users\Nikolay\AppData\Roaming\Love_2015 2015-02-16 17:57 - 2015-02-16 17:57 - 00000000 ____D () C:\Users\Valyo\AppData\Local\EdgeOfReality 2015-02-16 17:45 - 2015-02-18 17:30 - 00000000 ____D () C:\Users\Valyo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam 2015-02-16 17:45 - 2015-02-16 17:45 - 00000222 _____ () C:\Users\Valyo\Desktop\Loadout.url 2015-02-15 12:18 - 2015-02-15 12:19 - 00000000 ____D () C:\ProgramData\Oracle 2015-02-15 12:18 - 2015-02-15 12:18 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2015-02-15 12:18 - 2015-02-15 12:18 - 00000000 ____D () C:\ProgramData\Sun 2015-02-15 12:18 - 2015-02-15 12:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2015-02-15 12:18 - 2015-02-15 12:18 - 00000000 ____D () C:\Program Files (x86)\Java 2015-02-15 12:15 - 2015-02-15 12:15 - 04103951 _____ () C:\Users\Nikolay\Downloads\superbeam.exe 2015-02-14 00:35 - 2015-02-14 00:35 - 00000687 _____ () C:\awh258A.tmp 2015-02-13 05:08 - 2015-02-13 05:08 - 00000000 ____D () C:\Program Files (x86)\Papas Pizzeria 2015-02-12 15:26 - 2015-02-12 15:26 - 00000687 _____ () C:\awh29A7.tmp 2015-02-12 15:09 - 2015-02-12 15:09 - 00000687 _____ () C:\awh4F21.tmp 2015-02-12 14:57 - 2015-02-12 14:57 - 00000000 ____D () C:\Program Files (x86)\SystemContinue 2015-02-12 09:45 - 2015-02-12 09:45 - 00000000 ____D () C:\Users\Nikolay\AppData\Local\MicroDicom 2015-02-12 00:45 - 2015-02-12 00:45 - 00108544 _____ () C:\Windows\SysWOW64\hfnapi.dll 2015-02-11 17:08 - 2015-01-22 20:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2015-02-11 17:08 - 2015-01-22 19:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2015-02-11 11:32 - 2015-02-11 11:32 - 00000687 _____ () C:\awh4D9A.tmp 2015-02-11 11:27 - 2015-03-03 19:43 - 00007443 _____ () C:\Windows\setupact.log 2015-02-11 11:27 - 2015-02-11 11:27 - 00000000 _____ () C:\Windows\setuperr.log 2015-02-11 10:43 - 2015-03-03 21:00 - 00004952 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for Niki-PC-Valyo Niki-PC 2015-02-11 09:14 - 2015-02-11 09:14 - 00000000 ____D () C:\ProgramData\EA Core 2015-02-11 02:07 - 2015-01-15 14:43 - 00563504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2015-02-11 02:07 - 2015-01-15 14:43 - 00177984 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2015-02-11 02:07 - 2015-01-13 20:22 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll 2015-02-11 02:07 - 2015-01-13 19:53 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll 2015-02-11 02:07 - 2015-01-13 14:11 - 01762840 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2015-02-11 02:07 - 2015-01-13 14:04 - 01489072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2015-02-11 02:07 - 2015-01-11 19:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-02-11 02:07 - 2015-01-11 18:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2015-02-11 02:07 - 2015-01-11 17:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-02-11 02:07 - 2015-01-11 17:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2015-02-11 02:07 - 2014-10-28 18:51 - 00154112 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll 2015-02-11 02:07 - 2014-10-28 18:50 - 00736768 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll 2015-02-11 02:07 - 2014-10-28 18:06 - 00736768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll 2015-02-11 02:07 - 2014-10-28 18:06 - 00154112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll 2015-02-11 02:07 - 2014-10-28 17:31 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2015-02-11 02:06 - 2015-01-11 18:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-02-11 02:06 - 2015-01-11 18:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-02-11 02:06 - 2015-01-11 18:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2015-02-11 02:06 - 2015-01-11 18:34 - 00816128 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2015-02-11 02:06 - 2015-01-11 18:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2015-02-11 02:06 - 2015-01-11 18:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2015-02-11 02:06 - 2015-01-11 18:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-02-11 02:06 - 2015-01-11 18:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2015-02-11 02:06 - 2015-01-11 18:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2015-02-11 02:06 - 2015-01-11 17:58 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll 2015-02-11 02:06 - 2015-01-11 17:55 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2015-02-11 02:06 - 2015-01-11 17:51 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2015-02-11 02:06 - 2015-01-11 17:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-02-11 02:06 - 2015-01-11 17:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2015-02-11 02:06 - 2015-01-11 17:48 - 00374272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2015-02-11 02:06 - 2015-01-11 17:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-02-11 02:06 - 2015-01-11 17:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2015-02-11 02:06 - 2015-01-11 17:34 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll 2015-02-11 02:06 - 2015-01-11 17:30 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll 2015-02-11 02:06 - 2015-01-11 17:27 - 02865152 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll 2015-02-11 02:06 - 2015-01-11 17:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-02-11 02:06 - 2015-01-11 17:25 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll 2015-02-11 02:06 - 2015-01-11 17:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2015-02-11 02:06 - 2015-01-11 17:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2015-02-11 02:06 - 2015-01-11 17:23 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2015-02-11 02:06 - 2015-01-11 17:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-02-11 02:06 - 2015-01-11 17:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2015-02-11 02:06 - 2015-01-11 17:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2015-02-11 02:06 - 2015-01-11 16:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2015-02-11 02:06 - 2015-01-11 16:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2015-02-11 02:02 - 2014-12-19 00:57 - 00788680 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll 2015-02-11 02:02 - 2014-12-19 00:25 - 00602776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll 2015-02-11 02:02 - 2014-12-08 19:45 - 00393728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll 2015-02-11 02:02 - 2014-12-08 17:56 - 00538624 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll 2015-02-11 02:02 - 2014-12-08 15:12 - 00391526 _____ () C:\Windows\system32\ApnDatabase.xml 2015-02-11 02:00 - 2015-01-10 01:10 - 07472960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-02-11 02:00 - 2015-01-10 01:10 - 01733440 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2015-02-11 02:00 - 2015-01-10 00:28 - 01498360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll 2015-02-11 02:00 - 2014-10-28 18:02 - 00285184 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll 2015-02-11 02:00 - 2014-10-28 18:02 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll 2015-02-11 02:00 - 2014-10-28 17:57 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll 2015-02-11 02:00 - 2014-10-28 17:15 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll 2015-02-11 02:00 - 2014-10-28 17:15 - 00005632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll 2015-02-11 02:00 - 2014-10-28 17:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe 2015-02-11 02:00 - 2014-10-28 17:13 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe 2015-02-11 02:00 - 2014-10-28 17:13 - 00008704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe 2015-02-11 01:58 - 2015-01-09 23:00 - 00430080 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2015-02-11 01:58 - 2015-01-09 22:38 - 00359424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2015-02-11 01:57 - 2015-01-19 10:42 - 01487976 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll 2015-02-11 01:55 - 2015-02-11 01:55 - 00000865 _____ () C:\Users\Public\Desktop\Battlefield 3.lnk 2015-02-11 01:55 - 2015-02-11 01:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battlefield 3 2015-02-11 01:55 - 2015-02-03 15:38 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2015-02-11 01:55 - 2015-02-03 15:08 - 00761856 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll 2015-02-11 01:55 - 2015-02-03 15:08 - 00414208 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll 2015-02-11 01:55 - 2015-02-02 15:11 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2015-02-11 01:55 - 2015-02-02 15:11 - 00894464 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll 2015-02-11 01:55 - 2015-02-02 15:11 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll 2015-02-11 01:47 - 2015-01-10 00:22 - 04175872 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2015-02-10 20:49 - 2015-02-10 20:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games 2015-02-09 22:19 - 2015-02-09 22:19 - 00000687 _____ () C:\awhB42.tmp 2015-02-08 21:46 - 2015-02-08 21:46 - 00000687 _____ () C:\awh96B0.tmp 2015-02-07 11:15 - 2015-02-07 11:15 - 00000463 _____ () C:\Users\Nikolay\Desktop\1920 × 1080 - wallpaperswide.com.URL 2015-02-06 20:00 - 2015-02-06 20:03 - 00000000 ____D () C:\Users\Nikolay\Documents\samsung 2015-02-06 20:00 - 2015-02-06 20:00 - 00001989 _____ () C:\Users\Public\Desktop\Samsung Kies 3.lnk 2015-02-06 20:00 - 2015-02-06 20:00 - 00000000 ____D () C:\Users\Public\Documents\NativeFus_Log 2015-02-06 20:00 - 2015-02-06 20:00 - 00000000 ____D () C:\Users\Nikolay\Documents\SelfMV 2015-02-06 20:00 - 2015-02-06 20:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung 2015-02-06 19:52 - 2014-10-12 21:57 - 00206080 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudmdm.sys 2015-02-06 19:52 - 2014-10-12 21:57 - 00110336 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudbus.sys 2015-02-06 19:51 - 2015-02-06 20:00 - 00000000 ____D () C:\Users\Nikolay\AppData\Roaming\Samsung 2015-02-06 19:51 - 2015-02-06 19:52 - 00000000 ____D () C:\Program Files (x86)\Samsung 2015-02-06 19:51 - 2014-05-07 17:42 - 00144664 _____ (MAPILab Ltd. & Add-in Express Ltd.) C:\Windows\SysWOW64\secman.dll 2015-02-06 19:34 - 2015-02-22 17:05 - 00000000 ____D () C:\Users\Nikolay\AppData\Local\PunkBuster 2015-02-06 19:32 - 2015-02-06 19:34 - 00000000 ____D () C:\Users\Nikolay\Documents\BFH Beta 2 2015-02-06 13:28 - 2015-02-11 01:55 - 00189248 _____ () C:\Windows\SysWOW64\PnkBstrB.exe 2015-02-06 13:28 - 2015-02-11 01:55 - 00189248 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0 2015-02-06 13:27 - 2015-02-11 01:55 - 00075136 _____ () C:\Windows\SysWOW64\PnkBstrA.exe 2015-02-06 10:45 - 2015-02-22 16:59 - 00000000 ____D () C:\Users\Nikolay\AppData\Roaming\Origin 2015-02-06 10:45 - 2015-02-11 09:14 - 00000000 ____D () C:\Users\Nikolay\AppData\Local\Origin 2015-02-06 10:43 - 2015-03-03 17:25 - 00000000 ____D () C:\ProgramData\Origin 2015-02-06 10:43 - 2015-02-10 20:49 - 00000000 ____D () C:\ProgramData\Electronic Arts 2015-02-06 10:43 - 2015-02-06 10:43 - 00000704 _____ () C:\Users\Public\Desktop\Origin.lnk 2015-02-06 10:43 - 2015-02-06 10:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin 2015-02-05 21:19 - 2015-02-05 21:19 - 00000000 ____D () C:\Users\Valyo\AppData\Local\Steam 2015-02-05 19:11 - 2015-02-05 19:11 - 00000000 ____D () C:\Users\Nikolay\AppData\Local\Steam 2015-02-04 10:38 - 2015-02-04 10:38 - 00000687 _____ () C:\awh99F2.tmp 2015-02-02 16:53 - 2015-03-03 20:39 - 00001116 _____ () C:\Users\Valyo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AsusSmartGestureDetector.lnk 2015-02-02 16:47 - 2015-03-03 19:58 - 00001116 _____ () C:\Users\Nikolay\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AsusSmartGestureDetector.lnk 2015-02-02 16:41 - 2015-02-02 16:41 - 00004990 _____ () C:\Windows\DPINST.LOG 2015-02-02 16:41 - 2015-02-02 16:41 - 00003538 _____ () C:\Windows\System32\Tasks\ASUS Smart Gesture Launcher 2015-02-02 16:41 - 2015-02-02 16:41 - 00001021 _____ () C:\Users\Public\Desktop\ASUS Smart Gesture.lnk 2015-02-02 16:41 - 2015-02-02 16:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS 2015-02-02 16:41 - 2015-02-02 16:41 - 00000000 ____D () C:\Program Files\DIFX 2015-02-02 15:35 - 2015-02-06 19:52 - 00000000 ____D () C:\Program Files\SAMSUNG 2015-02-02 15:34 - 2015-02-06 20:01 - 00000000 ____D () C:\ProgramData\Samsung 2015-02-01 23:59 - 2015-03-03 19:57 - 00000000 ____D () C:\Users\Nikolay\AppData\Roaming\ViberPC 2015-02-01 23:59 - 2015-03-03 19:57 - 00000000 ____D () C:\Users\Nikolay\AppData\Local\Viber 2015-02-01 23:59 - 2015-02-01 23:59 - 00001119 _____ () C:\Users\Nikolay\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Viber.lnk 2015-02-01 23:59 - 2015-02-01 23:59 - 00001111 _____ () C:\Users\Nikolay\Desktop\Viber.lnk 2015-02-01 23:51 - 2015-02-01 23:51 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01007.Wdf 2015-02-01 22:06 - 2015-02-01 22:06 - 00000000 ____D () C:\Users\Nikolay\.android ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-03-03 22:17 - 2015-01-08 06:49 - 00000000 ____D () C:\Users\Nikolay\AppData\Roaming\BitTorrent 2015-03-03 22:12 - 2015-01-08 15:39 - 01976556 _____ () C:\Windows\WindowsUpdate.log 2015-03-03 22:03 - 2015-01-24 14:56 - 00000000 ____D () C:\Users\Valyo\AppData\Roaming\uTorrent 2015-03-03 22:00 - 2013-08-22 07:36 - 00000000 ____D () C:\Windows\system32\sru 2015-03-03 21:56 - 2015-01-09 04:14 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-03-03 21:43 - 2013-08-21 22:56 - 00148386 _____ () C:\Windows\system32\slmgr.vbs 2015-03-03 21:43 - 2013-08-21 15:52 - 00148386 _____ () C:\Windows\SysWOW64\slmgr.vbs 2015-03-03 20:44 - 2015-01-08 10:48 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1890519435-3532758963-1489022427-1004 2015-03-03 20:37 - 2015-01-08 05:49 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1890519435-3532758963-1489022427-1001 2015-03-03 20:33 - 2015-01-10 12:21 - 00000000 ____D () C:\AdwCleaner 2015-03-03 19:57 - 2015-01-08 05:44 - 00000000 ___DO () C:\Users\Nikolay\SkyDrive 2015-03-03 19:47 - 2015-01-18 21:25 - 27590656 _____ () C:\Windows\system32\vmguest.iso 2015-03-03 19:47 - 2015-01-08 05:44 - 00818732 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-03-03 19:43 - 2015-01-08 05:50 - 00000000 ____D () C:\ProgramData\NVIDIA 2015-03-03 19:43 - 2015-01-08 05:41 - 00000000 ____D () C:\Users\Nikolay 2015-03-03 19:43 - 2013-08-22 06:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-03-03 19:20 - 2015-01-14 22:46 - 00004962 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for NIKI-PC-Nikolay Niki-PC 2015-03-03 17:26 - 2015-01-08 05:46 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{60D446FC-215E-4BFE-876E-1E1EC307CB30} 2015-02-27 17:29 - 2015-01-20 18:28 - 00000000 ____D () C:\Users\Valyo\AppData\Local\CrashDumps 2015-02-27 12:12 - 2015-01-20 03:50 - 00000000 ____D () C:\Users\Nikolay\AppData\Local\CrashDumps 2015-02-27 11:05 - 2015-01-08 05:47 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2015-02-26 23:15 - 2015-01-08 05:42 - 00000000 ____D () C:\Users\Nikolay\AppData\Local\Packages 2015-02-26 08:03 - 2015-01-14 22:37 - 00522240 ___SH () C:\Users\Nikolay\Desktop\Thumbs.db 2015-02-25 10:10 - 2013-08-22 05:25 - 00524288 ___SH () C:\Windows\system32\config\BBI 2015-02-25 03:03 - 2013-08-22 07:20 - 00000000 ____D () C:\Windows\CbsTemp 2015-02-22 21:03 - 2015-01-08 10:49 - 00003922 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{9214E139-A08C-4541-8E68-656264088DCB} 2015-02-22 20:29 - 2015-01-24 15:39 - 00044544 ___SH () C:\Users\Valyo\Desktop\Thumbs.db 2015-02-22 17:33 - 2015-01-08 09:44 - 00098354 _____ () C:\Windows\DirectX.log 2015-02-22 16:45 - 2015-01-08 10:43 - 00000000 ____D () C:\Users\Valyo 2015-02-22 14:36 - 2015-01-17 20:10 - 00007739 _____ () C:\Windows\system32\lvcoinst.log 2015-02-21 15:49 - 2013-08-22 07:36 - 00000000 ____D () C:\Windows\AppReadiness 2015-02-19 19:07 - 2015-01-08 15:31 - 00011772 _____ () C:\Windows\PFRO.log 2015-02-17 10:07 - 2015-01-11 22:58 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013 2015-02-17 10:03 - 2015-01-11 22:54 - 00000000 ____D () C:\ProgramData\Microsoft Help 2015-02-12 15:11 - 2015-01-08 15:32 - 00000000 __SHD () C:\Recovery 2015-02-12 14:57 - 2015-01-21 21:09 - 00000000 ____D () C:\ProgramData\{c0e7f4f5-5eb8-b3cd-c0e7-7f4f55ebd3d5} 2015-02-12 05:17 - 2013-08-22 07:36 - 00000000 ____D () C:\Windows\rescache 2015-02-11 11:27 - 2013-08-22 06:44 - 00537880 _____ () C:\Windows\system32\FNTCACHE.DAT 2015-02-11 04:03 - 2015-01-09 22:30 - 00000000 ____D () C:\Windows\system32\MRT 2015-02-11 03:47 - 2015-01-09 22:30 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-02-11 03:44 - 2013-08-22 05:25 - 00000167 _____ () C:\Windows\win.ini 2015-02-11 03:41 - 2015-01-15 15:31 - 00000000 ___SD () C:\Windows\system32\CompatTel 2015-02-11 03:41 - 2015-01-15 15:31 - 00000000 ____D () C:\Windows\system32\appraiser 2015-02-06 19:51 - 2015-01-08 05:59 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2015-02-06 13:27 - 2015-01-15 21:39 - 00000000 ____D () C:\ProgramData\Package Cache 2015-02-05 03:12 - 2015-01-09 04:01 - 00000000 ____D () C:\Users\Nikolay\AppData\Local\Adobe 2015-02-04 20:56 - 2015-01-09 04:14 - 00003718 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2015-02-03 15:49 - 2015-01-27 15:18 - 00000000 ____D () C:\Users\Nikolay\AppData\Roaming\HpUpdate 2015-02-03 11:31 - 2015-01-15 15:37 - 00714720 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2015-02-03 11:31 - 2015-01-15 15:37 - 00106976 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl ==================== Files in the root of some directories ======= 2015-01-18 12:01 - 2015-01-18 13:29 - 0000104 ____H () C:\Users\Nikolay\AppData\Roaming\WPVXAP.setting 2015-01-27 15:18 - 2015-01-27 15:18 - 0000057 _____ () C:\ProgramData\Ament.ini Some content of TEMP: ==================== C:\Users\Nikolay\AppData\Local\Temp\013A9e6dCcf7.exe C:\Users\Nikolay\AppData\Local\Temp\16BA9D84-BE45-773C-B929-B2B4D1E1B9D8.exe C:\Users\Nikolay\AppData\Local\Temp\2229670114113368278.exe C:\Users\Nikolay\AppData\Local\Temp\85016E178ac.exe C:\Users\Nikolay\AppData\Local\Temp\95A2852A-0989-E48C-B47B-A5C0CBB8AE9A.dll C:\Users\Nikolay\AppData\Local\Temp\95A2852A-0989-E48C-B47B-A5C0CBB8AE9A.exe C:\Users\Nikolay\AppData\Local\Temp\AAMHelper.exe C:\Users\Nikolay\AppData\Local\Temp\AdobeApplicationManager.exe C:\Users\Nikolay\AppData\Local\Temp\InstallMonetizer.exe C:\Users\Nikolay\AppData\Local\Temp\ose00000.exe C:\Users\Nikolay\AppData\Local\Temp\Quarantine.exe C:\Users\Nikolay\AppData\Local\Temp\revs.exe C:\Users\Nikolay\AppData\Local\Temp\speccycpuid.dll C:\Users\Nikolay\AppData\Local\Temp\sqlite3.dll C:\Users\Nikolay\AppData\Local\Temp\sr35252.exe C:\Users\Nikolay\AppData\Local\Temp\SRLDetectionLibrary23700509833009252.dll C:\Users\Nikolay\AppData\Local\Temp\srv2322.exe C:\Users\Nikolay\AppData\Local\Temp\srv75486.exe C:\Users\Nikolay\AppData\Local\Temp\srv9063.exe C:\Users\Nikolay\AppData\Local\Temp\updr35119.exe C:\Users\Nikolay\AppData\Local\Temp\updt22105.exe C:\Users\Nikolay\AppData\Local\Temp\updtr70085.exe C:\Users\Nikolay\AppData\Local\Temp\uttBE03.tmp.exe C:\Users\Nikolay\AppData\Local\Temp\uttCFDB.tmp.exe C:\Users\Nikolay\AppData\Local\Temp\xmlUpdater.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-02-22 16:50 ==================== End Of Log ============================ Addition.txt
  20. От 1 месец си сложих антивирусната 360 интернет секюрити и днес реших да истегля malwarebytes за контролен преглед и се оказа ,че имам гадина не съм я истрил ,но запазих лога от намерените заплахи както и логовете които се изискват от frst.Разполагам с диск за преинсталиране ето и нужните логове Malwarebytes Anti-Malware www.malwarebytes.org Дата на сканиране: 06.3.2015 г. Час на сканиране: 14:57:16 Дневник: malware.txt Администратор: Да Версия: 2.00.4.1028 База от данни за злонамерен софтуер: v2015.03.06.03 База от данни за рууткити: v2015.02.25.01 Лиценз: Безплатен Защита от злонамерен софтуер: Забранено Защита от злонамерени страници: Забранено Самозащита: Забранено ОС: Windows XP Service Pack 3 Процесор: x86 Файлова система: NTFS Потребител: Admin Тип сканиране: Сканиране по избор Резултат: Завършено Сканиране обекти: 363676 Изминало време: 1 ч., 32 мин., 24 сек. Памет: Разрешено Начално стартиране: Разрешено Файлова система: Разрешено Архиви: Разрешено Рууткити: Разрешено Евристика: Разрешено ПНП: Разрешено ПНИ: Разрешено Процеси: 0 (№ злобен открити статии) Модули: 0 (№ злобен открити статии) Ключове в системния регистър: 0 (№ злобен открити статии) Стойности в системния регистър: 1 Hijack.ControlPanelStyle, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER|ForceClassicControlPanel, 1, , [9a0f160c6921e254b5304d2b0103c13f] Данни в системния регистър: 1 PUM.Hijack.StartMenu, HKU\S-1-5-21-220523388-515967899-1801674531-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED|Start_ShowHelp, 0, Добър: (1), Лош: (0),,[04a5c260ef9b241280457b5ea65f2ad6] Папки: 0 (№ злобен открити статии) Файлове: 0 (№ злобен открити статии) Физически сектори: 0 (№ злобен открити статии) (end) Много голям пост става и качих логовете на друго място http://gangosan.grn.cc/FRST.txt http://gangosan.grn.cc/Addition.txt
  21. Здравейте, мисля, че системата ми е инфектирана, защото се изключва сам, без причина, нито е загрял нито нищо, вдига до 60-65 градуса най-много 70 когато играя. А и IP адреса ми се смени неочаквано т.е. винаги е започвало с 84.54..., а сега започва 94.190... FRST Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-01-2015 02 Ran by RR-PC (administrator) on RR on 13-01-2015 21:01:17 Running from C:\Users\RR-PC\Desktop Loaded Profile: RR-PC (Available profiles: RR-PC) Platform: Windows 8.1 Pro (X64) OS Language: English (United States) Internet Explorer Version 11 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (AMD) C:\Windows\System32\atiesrxx.exe (Intel Corporation) C:\Windows\System32\igfxCUIService.exe (AMD) C:\Windows\System32\atieclxx.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Intel Corporation) C:\Windows\System32\igfxEM.exe (Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe (Intel Corporation) C:\Windows\System32\igfxHK.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe (Raptr, Inc) C:\Program Files (x86)\Raptr\raptr.exe (Raptr, Inc) C:\Program Files (x86)\Raptr\raptr_im.exe (Raptr Inc.) C:\Program Files (x86)\Raptr\raptr_ep64.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-10] (AVAST Software) HKLM-x32\...\Run: [startCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2014-11-20] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [Raptr] => C:\Program Files (x86)\Raptr\raptrstub.exe [55568 2014-12-08] (Raptr, Inc) HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation) HKU\S-1-5-21-654867888-2556937384-2701218319-1001\...\Run: [steam] => C:\Program Files (x86)\Steam\steam.exe [1941696 2015-01-06] (Valve Corporation) Startup: C:\Users\RR-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Curse.lnk ShortcutTarget: Curse.lnk -> C:\Users\RR-PC\AppData\Roaming\Curse Client\Bin\Curse.exe (Curse, Inc) ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-654867888-2556937384-2701218319-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation) BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 Tcpip\..\Interfaces\{EC158776-18EC-4889-B3DD-74BA17A03A4F}: [NameServer] 8.8.8.8,8.8.4.4 FireFox: ======== FF ProfilePath: C:\Users\RR-PC\AppData\Roaming\Mozilla\Firefox\Profiles\ertuc8su.default FF Homepage: https://www.google.bg/?gws_rd=ssl FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll () FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll () FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\911bg.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\diribg.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\pe-bg.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\portalbgdict.xml FF Extension: ABV Notifier - C:\Users\RR-PC\AppData\Roaming\Mozilla\Firefox\Profiles\ertuc8su.default\Extensions\[email protected] [2014-12-12] FF Extension: Adblock Plus - C:\Users\RR-PC\AppData\Roaming\Mozilla\Firefox\Profiles\ertuc8su.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-12-12] FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-12-12] Chrome: ======= CHR StartupUrls: Default -> "hxxp://www.google.com" CHR Profile: C:\Users\RR-PC\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Docs) - C:\Users\RR-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-12-21] CHR Extension: (Google Drive) - C:\Users\RR-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-12-21] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\RR-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-12-21] CHR Extension: (YouTube) - C:\Users\RR-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-12-21] CHR Extension: (Google Search) - C:\Users\RR-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-12-21] CHR Extension: (Avast SafePrice) - C:\Users\RR-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2014-12-21] CHR Extension: (Google Wallet) - C:\Users\RR-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-12-21] CHR Extension: (Gmail) - C:\Users\RR-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-12-21] CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx [2014-12-12] CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-12-12] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-12-12] (AVAST Software) R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2014-12-12] (Avast Software) S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [321024 2013-08-22] (Microsoft Corporation) S4 HiPatchService; C:\GAMES\HiPatchService.exe [9216 2015-01-06] (Hi-Rez Studios) [File not signed] R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [319376 2014-10-01] (Intel Corporation) R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation) S3 PrintNotify; C:\Windows\system32\spool\drivers\x64\3\PrintConfig.dll [2987520 2014-10-29] (Microsoft Corporation) [File not signed] S4 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [691480 2013-11-20] () [File not signed] S4 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5426448 2014-12-15] (TeamViewer GmbH) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation) S3 COMSysApp; %SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [62152 2014-10-28] (Advanced Micro Devices, Inc.) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-12-12] () R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2014-12-12] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-12-12] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-12-12] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2014-12-12] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-12-12] (AVAST Software) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-12-12] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2014-12-12] () R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-13] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-11-21] (Malwarebytes Corporation) U4 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [271752 2014-12-12] (Avast Software) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-13 21:01 - 2015-01-13 21:01 - 00011604 _____ () C:\Users\RR-PC\Desktop\FRST.txt 2015-01-13 21:01 - 2015-01-13 21:01 - 00000000 ____D () C:\FRST 2015-01-13 21:00 - 2015-01-13 21:00 - 02124288 _____ (Farbar) C:\Users\RR-PC\Desktop\FRST64.exe 2015-01-13 20:25 - 2015-01-13 20:25 - 01318006 _____ () C:\Users\RR-PC\Downloads\dox_20150113202514267.zip 2015-01-12 20:00 - 2015-01-12 20:00 - 00001625 _____ () C:\Users\Public\Desktop\League of Legends.lnk 2015-01-12 20:00 - 2015-01-12 20:00 - 00000000 ____D () C:\Riot Games 2015-01-12 20:00 - 2015-01-12 20:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\League of Legends 2015-01-12 20:00 - 2008-07-12 08:18 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll 2015-01-12 20:00 - 2008-07-12 08:18 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll 2015-01-12 20:00 - 2008-07-12 08:18 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll 2015-01-12 19:58 - 2015-01-12 19:58 - 30993712 _____ (Riot Games) C:\Users\RR-PC\Downloads\LeagueofLegends_EUNE_Installer_9_15_2014.exe 2015-01-11 14:04 - 2015-01-11 14:04 - 00907045 _____ () C:\Users\RR-PC\Downloads\aylin_9v_2.pptx 2015-01-11 14:03 - 2015-01-11 14:03 - 01058680 _____ () C:\Users\RR-PC\Downloads\Grid-компютинг Росен Иванов (№20).pptx 2015-01-10 18:16 - 2015-01-10 18:16 - 00001710 _____ () C:\Users\RR-PC\Desktop\Counter-Strike WaRzOnE.lnk 2015-01-10 18:16 - 2015-01-10 18:16 - 00000806 _____ () C:\Users\RR-PC\Desktop\Half-Life WaRzOnE.lnk 2015-01-10 18:16 - 2015-01-10 18:16 - 00000744 _____ () C:\Users\RR-PC\Desktop\HLDS.lnk 2015-01-10 01:52 - 2015-01-10 01:58 - 00000000 ____D () C:\Users\RR-PC\Downloads\Dumb And Dumber UNRATED 1994 BRRip XviD AC3 SANTi 2015-01-10 01:09 - 2015-01-10 01:09 - 00001154 _____ () C:\Users\RR-PC\Desktop\DAPlayer.lnk 2015-01-10 01:09 - 2015-01-10 01:09 - 00000000 ____D () C:\Users\RR-PC\AppData\Roaming\Digiarty 2015-01-10 01:09 - 2015-01-10 01:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Digiarty 2015-01-10 01:08 - 2015-01-10 01:08 - 15970392 _____ (Digiarty Software,Inc. ) C:\Users\RR-PC\Downloads\daplayer.exe 2015-01-10 01:08 - 2015-01-10 01:08 - 00000000 ____D () C:\Program Files (x86)\Digiarty 2015-01-10 00:58 - 2015-01-10 00:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VSFilter 2015-01-10 00:58 - 2015-01-10 00:58 - 00000000 ____D () C:\Program Files\VSFilter 2015-01-10 00:58 - 2014-01-11 13:09 - 00877616 _____ (MPC-HC Team ) C:\Users\RR-PC\Desktop\VSFilter_2.41.322_x64.exe 2015-01-10 00:57 - 2015-01-10 00:57 - 00850726 _____ () C:\Users\RR-PC\Downloads\VSFilter_2.41.322_x64.zip 2015-01-10 00:41 - 2015-01-10 00:41 - 00034915 _____ () C:\Users\RR-PC\Downloads\dumb__dumber(subsunacs.net).zip 2015-01-10 00:31 - 2015-01-10 00:31 - 00000404 __RSH () C:\ProgramData\ntuser.pol 2015-01-10 00:20 - 2015-01-10 01:20 - 00000000 ____D () C:\Users\RR-PC\Downloads\Dumb & Dumber 2015-01-09 14:55 - 2015-01-09 14:55 - 00000375 _____ () C:\Windows\system32\Drivers\etc\hosts.ics 2015-01-08 22:56 - 2015-01-08 22:56 - 00155879 _____ () C:\Users\RR-PC\Downloads\the_hobbit_the_battle_of_the_five_armies_2014(subsunacs.net).rar 2015-01-08 13:29 - 2015-01-10 00:20 - 00000000 ____D () C:\Users\RR-PC\Downloads\The.Hobbit.2014.Battle.Of.The.Five.Armies.DVDScr.XVID.AC3.HQ.Hive-CM8 2015-01-07 17:49 - 2015-01-09 08:48 - 00000000 __RDO () C:\Users\RR-PC\OneDrive 2015-01-07 16:02 - 2015-01-07 16:02 - 00000000 __SHD () C:\ProgramData\DSS 2015-01-07 16:02 - 2015-01-07 16:02 - 00000000 ____D () C:\ProgramData\Codemasters 2015-01-07 16:00 - 2015-01-07 16:00 - 00000000 ____D () C:\Users\RR-PC\Documents\Games for Windows - LIVE Demos 2015-01-07 15:57 - 2015-01-07 15:57 - 00000000 ____D () C:\Windows\SysWOW64\xlive 2015-01-07 15:57 - 2015-01-07 15:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Games for Windows Marketplace 2015-01-07 15:57 - 2015-01-07 15:57 - 00000000 ____D () C:\Program Files (x86)\Microsoft Games for Windows - LIVE 2015-01-07 15:56 - 2015-01-07 15:56 - 00638104 _____ (Microsoft Corporation) C:\Users\RR-PC\Downloads\gfwlivesetup.exe 2015-01-07 00:52 - 2015-01-10 01:03 - 00000000 ____D () C:\Users\RR-PC\Downloads\Deja.Vu.2006.720p.BRRip.XviD.AC3-FLAWL3SS 2015-01-07 00:13 - 2015-01-07 00:35 - 00000000 ____D () C:\Users\RR-PC\Downloads\Deja.Vu.2006.480p.BRRip.AC3.BGAUDIO-SlzD 2015-01-06 23:52 - 2015-01-06 23:52 - 00000003 _____ () C:\Windows\system32\HRUPPROG.EXIT 2015-01-06 23:52 - 2015-01-06 23:52 - 00000002 _____ () C:\Windows\system32\HRUPPROG.TXT 2015-01-06 15:37 - 2015-01-06 15:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Blue Ripple Sound 2015-01-06 15:37 - 2015-01-06 15:37 - 00000000 ____D () C:\Program Files (x86)\BRS 2015-01-06 15:37 - 2011-03-19 15:16 - 01417216 _____ (Blue Ripple Sound Limited) C:\Windows\SysWOW64\rapture3d_oal.dll 2015-01-06 15:37 - 2010-09-22 13:12 - 19087360 _____ (Intel Corporation / Blue Ripple Sound Limited) C:\Windows\SysWOW64\mkl_blueripple.dll 2015-01-06 14:55 - 2015-01-06 14:55 - 00000000 ____D () C:\Users\RR-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam 2015-01-06 14:49 - 2015-01-07 23:52 - 00000000 ____D () C:\Program Files (x86)\Steam 2015-01-06 14:49 - 2015-01-06 14:49 - 17102864 _____ (Electronic Arts, Inc.) C:\Users\RR-PC\Downloads\OriginThinSetup.exe 2015-01-06 14:49 - 2015-01-06 14:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam 2015-01-06 14:48 - 2015-01-06 14:49 - 01142128 _____ () C:\Users\RR-PC\Downloads\SteamSetup.exe 2015-01-05 23:14 - 2015-01-05 23:14 - 00143310 _____ () C:\Users\RR-PC\Downloads\predestination.2014.bluray.dvdripped(subsunacs.net).rar 2015-01-05 22:48 - 2015-01-06 01:09 - 00000000 ____D () C:\Users\RR-PC\Downloads\Predestination.2014.BluRay.720p.DTS.x264-CHD 2015-01-05 00:13 - 2015-01-05 00:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2015-01-05 00:12 - 2015-01-13 20:22 - 00000998 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-01-05 00:12 - 2015-01-13 20:17 - 00001002 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-01-05 00:12 - 2015-01-05 00:12 - 00880784 _____ (Google Inc.) C:\Users\RR-PC\Downloads\ChromeSetup(1).exe 2015-01-05 00:12 - 2015-01-05 00:12 - 00003974 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2015-01-05 00:12 - 2015-01-05 00:12 - 00003738 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2015-01-04 23:40 - 2015-01-04 23:40 - 00059134 _____ () C:\Users\RR-PC\Downloads\the_interview_2014_-_bg_subs(subsunacs.net).rar 2015-01-04 23:35 - 2015-01-04 23:41 - 00000000 ____D () C:\Users\RR-PC\Downloads\The Interview 2014 WebDL XviD AC3 - KINGDOM 2015-01-03 23:18 - 2015-01-04 11:18 - 00000000 ____D () C:\Users\RR-PC\Downloads\Open.Windows.2014.720p.BluRay.x264.DTS-iFT 2015-01-03 23:18 - 2015-01-03 23:18 - 00023874 _____ () C:\Users\RR-PC\Downloads\Open.Windows.2014.720p.BluRay.x264.DTS-iFT.torrent 2015-01-03 22:50 - 2015-01-03 22:52 - 00000000 ____D () C:\Users\RR-PC\Downloads\Taken.Duology.BDRip.XviD.AC3.BGAUDiO-HS0 2015-01-02 21:06 - 2015-01-02 21:15 - 1519417223 _____ () C:\Users\RR-PC\Downloads\LOLPBE.zip 2015-01-01 17:32 - 2014-10-31 06:50 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\BulkOperationHost.exe 2015-01-01 17:32 - 2014-10-31 05:30 - 00120832 _____ (Microsoft Corporation) C:\Windows\system32\winbici.dll 2015-01-01 17:32 - 2014-10-31 05:23 - 00733696 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveTelemetry.dll 2015-01-01 17:32 - 2014-10-31 05:22 - 00291840 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveShell.dll 2015-01-01 17:32 - 2014-10-31 05:18 - 04840960 _____ (Microsoft Corporation) C:\Windows\system32\SyncEngine.dll 2015-01-01 17:32 - 2014-10-31 05:09 - 01154048 _____ (Microsoft Corporation) C:\Windows\system32\SkyDrive.exe 2015-01-01 17:32 - 2014-10-31 04:12 - 00266752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SkyDriveShell.dll 2015-01-01 17:06 - 2015-01-01 17:06 - 00000000 ____D () C:\Users\RR-PC\.android 2015-01-01 17:04 - 2015-01-13 20:54 - 00000000 ____D () C:\Users\RR-PC\AppData\Local\CrashDumps 2015-01-01 17:03 - 2015-01-01 17:03 - 00966912 _____ () C:\Users\RR-PC\Downloads\Download_Driver_1.0_Setup.rar 2015-01-01 17:03 - 2015-01-01 17:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver 1.0 2015-01-01 17:03 - 2015-01-01 17:03 - 00000000 ____D () C:\Driver 1.0 2015-01-01 16:58 - 2015-01-01 16:58 - 00014573 _____ () C:\Users\RR-PC\Downloads\A25_USB_VCOM_Drivers.rar 2014-12-31 19:01 - 2014-12-31 19:01 - 00000000 ____D () C:\Users\RR-PC\AppData\Local\TechSmith 2014-12-31 15:00 - 2014-12-31 15:00 - 00335253 _____ () C:\Users\RR-PC\Downloads\trayit_4_6_5_5.zip 2014-12-31 14:44 - 2015-01-05 14:51 - 00000000 ____D () C:\Mobile Upgrade S 4.1.3 2014-12-31 14:44 - 2014-12-31 19:00 - 00004608 _____ () C:\Users\RR-PC\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2014-12-31 14:44 - 2014-12-31 14:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mobile Upgrade S 4.1.3 2014-12-31 14:42 - 2014-12-31 19:00 - 00000000 ____D () C:\Users\RR-PC\Documents\Camtasia Studio 2014-12-31 14:42 - 2014-12-31 14:42 - 00000000 ____D () C:\Users\RR-PC\AppData\Roaming\TechSmith 2014-12-31 14:40 - 2014-12-31 14:40 - 00000000 ____D () C:\ProgramData\TechSmith 2014-12-31 14:40 - 2014-12-31 14:40 - 00000000 ____D () C:\ProgramData\regid.1995-08.com.techsmith 2014-12-31 14:40 - 2014-12-31 14:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TechSmith 2014-12-31 14:40 - 2014-12-31 14:40 - 00000000 ____D () C:\Program Files (x86)\TechSmith 2014-12-31 14:40 - 2014-12-31 14:40 - 00000000 ____D () C:\Program Files (x86)\QuickTime 2014-12-31 14:30 - 2014-12-31 14:31 - 00000000 ____D () C:\Users\RR-PC\Downloads\TechSmith Camtasia Studio v8.3.0 Build 1471 with Key - [MUMBAI-TPB] 2014-12-31 04:10 - 2014-12-31 04:10 - 05175548 _____ () C:\Users\RR-PC\Downloads\Finlandia 1.8(1).zip 2014-12-30 13:24 - 2014-12-30 13:24 - 00110268 _____ () C:\Users\RR-PC\Downloads\TooManyItems2014_07_05_1.7.10.zip 2014-12-29 23:04 - 2014-12-29 23:04 - 00001055 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk 2014-12-29 23:04 - 2014-12-29 23:04 - 00000000 ____D () C:\Users\RR-PC\AppData\Local\TeamViewer 2014-12-29 23:04 - 2014-12-29 23:04 - 00000000 ____D () C:\Program Files (x86)\TeamViewer 2014-12-29 23:03 - 2014-12-29 23:12 - 00000000 ____D () C:\Users\RR-PC\AppData\Roaming\TeamViewer 2014-12-29 23:00 - 2014-12-29 23:00 - 07720424 _____ (TeamViewer GmbH) C:\Users\RR-PC\Downloads\TeamViewer_Setup_bg.exe 2014-12-29 04:38 - 2014-12-29 04:38 - 00729632 _____ () C:\Users\RR-PC\Downloads\10603.zip 2014-12-29 04:12 - 2014-12-31 04:33 - 00000000 ____D () C:\Users\RR-PC\AppData\Roaming\OBS 2014-12-29 04:12 - 2014-12-29 04:12 - 00000000 ____D () C:\Users\RR-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Open Broadcaster Software 2014-12-29 04:12 - 2014-12-29 04:12 - 00000000 ____D () C:\Program Files\OBS 2014-12-29 04:12 - 2014-12-29 04:12 - 00000000 ____D () C:\Program Files (x86)\OBS 2014-12-29 04:11 - 2014-12-29 04:11 - 07518634 _____ () C:\Users\RR-PC\Downloads\OBS_0_638b_Installer.exe 2014-12-28 18:48 - 2014-12-28 18:48 - 00000000 ____D () C:\Users\RR-PC\AppData\Roaming\java 2014-12-28 17:55 - 2014-12-28 17:55 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-12-28 17:55 - 2014-12-28 17:55 - 00000000 ____D () C:\ProgramData\Sun 2014-12-28 17:55 - 2014-12-28 17:55 - 00000000 ____D () C:\ProgramData\Oracle 2014-12-28 17:55 - 2014-12-28 17:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-12-28 17:55 - 2014-12-28 17:55 - 00000000 ____D () C:\Program Files (x86)\Java 2014-12-28 17:54 - 2014-12-28 17:54 - 00638888 _____ (Oracle Corporation) C:\Users\RR-PC\Downloads\jxpiinstall.exe 2014-12-28 17:53 - 2014-12-28 17:53 - 00000000 ____D () C:\Users\RR-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Minecraft 2014-12-28 17:51 - 2014-12-28 17:52 - 163759374 _____ (TeamExtreme ) C:\Users\RR-PC\Downloads\Minecraft 1.8.exe 2014-12-28 14:42 - 2014-12-28 14:42 - 00000000 ____H () C:\Users\RR-PC\Documents\Default.rdp 2014-12-28 01:25 - 2014-12-28 01:25 - 00880784 _____ (Google Inc.) C:\Users\RR-PC\Downloads\ChromeSetup.exe 2014-12-28 00:34 - 2014-12-28 00:34 - 00024231 _____ () C:\Users\RR-PC\Downloads\1527_Redirected_2014.rar 2014-12-28 00:33 - 2014-12-28 00:34 - 00000000 ____D () C:\Users\RR-PC\Downloads\Redirected.2014.720p.WEBRIP.H264.AAC-MAJESTiC 2014-12-27 17:11 - 2014-12-27 17:11 - 00000000 ____D () C:\Users\RR-PC\AppData\Roaming\AMD 2014-12-26 12:36 - 2014-12-26 12:36 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf 2014-12-26 12:35 - 2014-12-26 12:35 - 07779866 _____ () C:\Users\RR-PC\Downloads\Change My Software 8 Edition.rar 2014-12-26 03:58 - 2014-12-26 03:58 - 00994498 _____ () C:\Users\RR-PC\Downloads\ElophantClient.zip 2014-12-25 23:28 - 2014-06-10 00:13 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe 2014-12-25 23:28 - 2014-06-10 00:13 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe 2014-12-25 14:30 - 2015-01-11 15:03 - 00000000 ____D () C:\Users\RR-PC\AppData\Roaming\Curse Client 2014-12-25 14:30 - 2014-12-25 14:30 - 00001062 _____ () C:\Users\RR-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Curse.lnk 2014-12-25 14:28 - 2014-12-25 14:28 - 32691072 _____ (Curse) C:\Users\RR-PC\Downloads\CurseClientSetup.exe 2014-12-25 14:28 - 2014-12-25 14:28 - 00000000 ____D () C:\Users\RR-PC\AppData\Roaming\Curse 2014-12-25 13:42 - 2015-01-07 16:02 - 00000000 ____D () C:\Users\RR-PC\Documents\My Games 2014-12-25 12:39 - 2014-12-25 12:39 - 00000000 ____D () C:\Users\RR-PC\AppData\Roaming\Awesomium 2014-12-25 12:38 - 2014-12-25 12:38 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2014-12-25 12:38 - 2014-12-25 12:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hi-Rez Studios 2014-12-25 12:38 - 2014-12-25 12:38 - 00000000 ____D () C:\ProgramData\Hi-Rez Studios 2014-12-25 12:33 - 2014-12-25 12:33 - 00000000 ____D () C:\Program Files (x86)\Reference Assemblies 2014-12-25 12:33 - 2014-12-25 12:33 - 00000000 ____D () C:\Program Files (x86)\MSBuild 2014-12-25 12:32 - 2014-12-25 12:32 - 00000000 ____D () C:\Program Files\Reference Assemblies 2014-12-25 12:32 - 2014-12-25 12:32 - 00000000 ____D () C:\Program Files\MSBuild 2014-12-25 12:31 - 2013-08-03 06:48 - 01166520 _____ (Microsoft Corporation) C:\Windows\system32\PresentationNative_v0300.dll 2014-12-25 12:31 - 2013-08-03 06:48 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll 2014-12-25 12:31 - 2013-08-03 06:41 - 00778936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationNative_v0300.dll 2014-12-25 12:31 - 2013-08-03 06:41 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll 2014-12-25 12:28 - 2014-12-25 12:28 - 46655528 _____ (Hi-Rez Studios) C:\Users\RR-PC\Downloads\InstallSmite.exe 2014-12-25 02:04 - 2014-12-25 02:04 - 00031622 _____ () C:\Users\RR-PC\Downloads\teenage_mutant_ninja_turtles_2014_hdrip_x264_aac-cpg(subsunacs.net).rar 2014-12-25 00:58 - 2014-12-25 00:58 - 00155860 _____ () C:\Users\RR-PC\Downloads\new imageset.rar 2014-12-25 00:36 - 2014-12-25 02:04 - 00000000 ____D () C:\Users\RR-PC\Downloads\Teenage.Mutant.Ninja.Turtles.2014.720p.BluRay.x264-WARHD 2014-12-24 22:27 - 2014-12-24 22:28 - 00000000 ____D () C:\Users\RR-PC\Downloads\Adobe Photoshop CS5.1 v12.10 Extended 2014-12-24 22:13 - 2014-12-24 22:13 - 00831496 _____ (SysProgs.org) C:\Users\RR-PC\Downloads\WinCDEmu-3.6.exe 2014-12-24 22:13 - 2014-12-24 22:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinCDEmu 2014-12-24 22:13 - 2014-12-24 22:13 - 00000000 ____D () C:\Program Files (x86)\WinCDEmu 2014-12-24 22:12 - 2014-12-24 22:19 - 00000000 ____D () C:\Users\RR-PC\Downloads\Adobe Photoshop CS6 13 1 2 Extended Final Portable 2014-12-24 13:31 - 2015-01-10 00:21 - 00000000 ____D () C:\Users\RR-PC\Desktop\AiO 2014-12-24 00:18 - 2014-12-26 03:48 - 00000000 ____D () C:\Users\RR-PC\Downloads\The.Equalizer.2014.720p.BRRip.x264.AAC-Monster 2014-12-24 00:18 - 2014-12-24 00:18 - 00164436 _____ () C:\Users\RR-PC\Downloads\the.equalizer.2014.bluray(subsunacs.net).rar 2014-12-23 23:44 - 2015-01-10 18:16 - 00000000 ____D () C:\Users\RR-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Counter-Strike 2014-12-23 23:44 - 2014-12-23 23:44 - 00000000 ____D () C:\Users\RR-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HLDS 2014-12-23 23:44 - 2014-12-23 23:44 - 00000000 ____D () C:\Users\RR-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Half-Life 2014-12-23 23:42 - 2015-01-10 18:15 - 00000000 ____D () C:\GAMES 2014-12-23 23:41 - 2014-12-23 23:42 - 268591972 ____R (CSwarzone) C:\Users\RR-PC\Downloads\Counter-Strike.exe 2014-12-23 22:49 - 2014-12-23 22:49 - 00000000 ____D () C:\Users\RR-PC\VirtualBox VMs 2014-12-23 19:27 - 2015-01-10 20:12 - 00000000 ____D () C:\Users\RR-PC\.VirtualBox 2014-12-23 14:53 - 2014-12-23 14:53 - 34305058 _____ () C:\Users\RR-PC\Downloads\torbrowser-install-4.0.2_en-US.exe 2014-12-23 14:53 - 2014-12-23 14:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox 2014-12-23 14:53 - 2014-12-23 14:53 - 00000000 ____D () C:\Program Files\Oracle 2014-12-23 14:53 - 2014-11-24 12:07 - 00916024 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxDrv.sys 2014-12-23 14:53 - 2014-11-24 12:07 - 00128080 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxUSBMon.sys 2014-12-23 09:39 - 2014-12-23 09:39 - 110587080 _____ (Oracle Corporation) C:\Users\RR-PC\Downloads\VirtualBox-4.3.20-96997-Win.exe 2014-12-22 23:38 - 2015-01-10 01:04 - 00000000 ____D () C:\Users\RR-PC\Downloads\Mr.and.Mrs.Smith.2005.BDRip.x264.DTS.2AUDIO-WAF 2014-12-22 23:07 - 2014-12-22 23:28 - 00000000 ____D () C:\Users\RR-PC\Downloads\kali-linux-1.0.9a-amd64 2014-12-22 12:26 - 2014-12-22 12:27 - 00000000 ____D () C:\Users\RR-PC\AppData\Roaming\Notepad++ 2014-12-22 12:26 - 2014-12-22 12:27 - 00000000 ____D () C:\Program Files (x86)\Notepad++ 2014-12-22 12:26 - 2014-12-22 12:26 - 07955776 _____ () C:\Users\RR-PC\Downloads\npp.6.7.1.Installer.exe 2014-12-22 12:26 - 2014-12-22 12:26 - 00000000 ____D () C:\Users\RR-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Notepad++ 2014-12-22 12:26 - 2014-12-22 12:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++ 2014-12-22 00:13 - 2014-11-11 20:06 - 00058524 _____ () C:\Users\RR-PC\Downloads\the.november.man.2014.dvdrip.x264-larceny.srt 2014-12-22 00:13 - 2013-03-06 04:29 - 00002335 _____ () C:\Users\RR-PC\Downloads\- README - subs.sab.bz - Brought to you by xen.headoff.com -.html 2014-12-22 00:03 - 2014-12-31 03:59 - 00025600 ___SH () C:\Users\RR-PC\Downloads\Thumbs.db 2014-12-21 22:04 - 2014-12-21 22:40 - 1570267292 _____ () C:\Users\RR-PC\Downloads\The.November.Man.2014.720p.BluRay.x264-SPARKS.mkv 2014-12-21 22:04 - 2014-12-21 22:04 - 00025774 _____ () C:\Users\RR-PC\Downloads\the.november.man.2014.dvdrip.x264_larceny.(subs.sab.bz).rar 2014-12-21 11:39 - 2014-12-21 11:39 - 00000000 ____D () C:\Users\RR-PC\AppData\Local\Google 2014-12-21 11:39 - 2014-12-21 11:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Speccy 2014-12-21 11:39 - 2014-12-21 11:39 - 00000000 ____D () C:\Program Files\Speccy 2014-12-21 11:38 - 2015-01-05 00:12 - 00000000 ____D () C:\Program Files (x86)\Google 2014-12-21 11:38 - 2014-12-21 11:38 - 05122624 _____ (Piriform Ltd) C:\Users\RR-PC\Downloads\spsetup127.exe 2014-12-20 22:57 - 2015-01-10 01:04 - 00000000 ____D () C:\Users\RR-PC\Downloads\A.Merry.Friggin.Christmas.2014.720p.Blu-ray.DTS.x264-playHD 2014-12-20 22:57 - 2014-12-20 22:57 - 00143552 _____ () C:\Users\RR-PC\Downloads\1515_A_Merry_Friggin.rar 2014-12-20 18:02 - 2014-12-20 18:02 - 00000000 ____D () C:\Windows\pss 2014-12-15 22:15 - 2014-12-15 22:15 - 00031275 _____ () C:\Users\RR-PC\Downloads\open.season.3.2010.bdrip.xvid-oem(subsunacs.net).rar 2014-12-15 22:11 - 2014-12-15 22:18 - 00000000 ____D () C:\Users\RR-PC\Downloads\Open Season 3 2010 BRRip XvidHD 720p-NPW 2014-12-15 22:06 - 2014-12-15 22:08 - 770113526 _____ () C:\Users\RR-PC\Downloads\Open Season 3 (2010).avi 2014-12-15 20:44 - 2014-12-15 20:56 - 00000000 ____D () C:\Users\RR-PC\Downloads\Open Season 2 2008 BRRip XvidHD 720p-NPW 2014-12-15 20:44 - 2014-12-15 20:44 - 00026557 _____ () C:\Users\RR-PC\Downloads\open.season.2.2008.bluray.720p.x264.dts-wiki(subsunacs.net).rar 2014-12-14 21:53 - 2014-12-14 22:00 - 1468420096 _____ () C:\Users\RR-PC\Downloads\Open Season (2006) DVDRip.BGAudio.avi 2014-12-14 01:50 - 2015-01-10 01:55 - 00000000 ____D () C:\Users\RR-PC\AppData\Roaming\vlc 2014-12-14 01:50 - 2014-12-14 01:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN 2014-12-14 01:49 - 2014-12-14 01:49 - 24743106 _____ () C:\Users\RR-PC\Downloads\vlc-2.1.5-win32.exe 2014-12-14 01:49 - 2014-12-14 01:49 - 00000000 ____D () C:\Program Files (x86)\VideoLAN 2014-12-14 01:12 - 2014-12-14 01:20 - 00000000 ____D () C:\Users\RR-PC\Downloads\A.Christmas.Carol.2009.1080p.BluRay.DTS.x264-HDClub ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-13 21:01 - 2014-12-12 20:49 - 00000000 ____D () C:\Users\RR-PC\AppData\Roaming\Skype 2015-01-13 21:00 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\sru 2015-01-13 20:53 - 2014-12-12 01:20 - 01315649 _____ () C:\Windows\WindowsUpdate.log 2015-01-13 20:32 - 2013-08-22 17:20 - 00000000 ____D () C:\Windows\CbsTemp 2015-01-13 20:32 - 2013-08-22 13:22 - 00461312 _____ (Microsoft Corporation) C:\Windows\system32\dpnet.dll 2015-01-13 20:32 - 2013-08-22 13:22 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\dpnsvr.exe 2015-01-13 20:32 - 2013-08-22 13:17 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\dpnathlp.dll 2015-01-13 20:32 - 2013-08-22 13:17 - 00009216 _____ (Microsoft Corporation) C:\Windows\system32\dpnhupnp.dll 2015-01-13 20:32 - 2013-08-22 13:17 - 00009216 _____ (Microsoft Corporation) C:\Windows\system32\dpnhpast.dll 2015-01-13 20:32 - 2013-08-22 06:05 - 00023552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpmodemx.dll 2015-01-13 20:32 - 2013-08-22 06:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dplaysvr.exe 2015-01-13 20:32 - 2013-08-22 05:59 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dplayx.dll 2015-01-13 20:32 - 2013-08-22 05:56 - 00377856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnet.dll 2015-01-13 20:32 - 2013-08-22 05:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnsvr.exe 2015-01-13 20:32 - 2013-08-22 05:51 - 00059904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnathlp.dll 2015-01-13 20:32 - 2013-08-22 05:51 - 00045056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpwsockx.dll 2015-01-13 20:32 - 2013-08-22 05:51 - 00009216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnhupnp.dll 2015-01-13 20:32 - 2013-08-22 05:51 - 00009216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnhpast.dll 2015-01-13 20:25 - 2014-01-21 16:54 - 00000139 _____ () C:\Users\RR-PC\Desktop\launcher.cfg 2015-01-13 20:25 - 2014-01-21 16:54 - 00000019 _____ () C:\Users\RR-PC\Desktop\user.cfg 2015-01-13 20:25 - 2014-01-21 16:54 - 00000012 _____ () C:\Users\RR-PC\Desktop\locale.cfg 2015-01-13 20:23 - 2014-12-12 11:26 - 00000000 ____D () C:\Users\RR-PC\AppData\Roaming\Raptr 2015-01-13 20:22 - 2014-12-12 01:39 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-01-13 20:21 - 2014-12-12 01:22 - 00000000 ____D () C:\Users\RR-PC 2015-01-13 20:21 - 2013-08-22 16:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-01-13 19:29 - 2014-12-12 01:27 - 00003902 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{7ED5D7CE-6A66-4D3C-8631-11EE7D1B1AA2} 2015-01-13 08:05 - 2014-12-12 01:27 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-654867888-2556937384-2701218319-1001 2015-01-12 20:00 - 2014-12-12 01:49 - 00000000 ____D () C:\Users\RR-PC\AppData\Roaming\Riot Games 2015-01-12 19:55 - 2014-12-12 11:55 - 00574464 ___SH () C:\Users\RR-PC\Desktop\Thumbs.db 2015-01-12 19:44 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\BBI 2015-01-12 19:25 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\NDF 2015-01-11 14:27 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\AppReadiness 2015-01-11 02:25 - 2014-03-18 12:04 - 00863592 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-01-10 18:15 - 2014-12-12 10:52 - 00000000 ____D () C:\Users\RR-PC\AppData\Roaming\uTorrent 2015-01-10 00:29 - 2013-08-22 17:36 - 00000000 ___HD () C:\Windows\system32\GroupPolicy 2015-01-07 17:35 - 2014-03-18 11:54 - 00012734 _____ () C:\Windows\PFRO.log 2015-01-05 17:38 - 2013-08-22 16:46 - 00019392 _____ () C:\Windows\setupact.log 2015-01-02 05:42 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\rescache 2015-01-01 23:35 - 2013-08-22 17:37 - 00003312 _____ () C:\Windows\DtcInstall.log 2015-01-01 23:33 - 2013-08-22 16:44 - 00337840 _____ () C:\Windows\system32\FNTCACHE.DAT 2015-01-01 23:29 - 2014-03-18 11:46 - 00000000 __SHD () C:\Windows\BitLockerDiscoveryVolumeContents 2015-01-01 23:29 - 2014-03-18 11:46 - 00000000 ____D () C:\Program Files\Windows Journal 2015-01-01 23:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Windows\ToastData 2015-01-01 23:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools 2015-01-01 23:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2015-01-01 23:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility 2015-01-01 23:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools 2015-01-01 23:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2015-01-01 23:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility 2015-01-01 23:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools 2015-01-01 23:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories 2015-01-01 23:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility 2015-01-01 23:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\WinStore 2015-01-01 23:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\SysWOW64\sppui 2015-01-01 23:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\SysWOW64\setup 2015-01-01 23:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\SysWOW64\migwiz 2015-01-01 23:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\SysWOW64\Com 2015-01-01 23:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\WindowsPowerShell 2015-01-01 23:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows Portable Devices 2015-01-01 23:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows Photo Viewer 2015-01-01 23:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows Multimedia Platform 2015-01-01 23:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Common Files\System 2015-01-01 23:29 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\SysWOW64\oobe 2015-01-01 23:29 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\SysWOW64\Dism 2015-01-01 23:29 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\servicing 2015-01-01 23:28 - 2013-08-22 17:36 - 00000000 ___SD () C:\Windows\system32\dsc 2015-01-01 23:28 - 2013-08-22 17:36 - 00000000 ___RD () C:\Windows\ImmersiveControlPanel 2015-01-01 23:28 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\WinBioPlugIns 2015-01-01 23:28 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\SystemResetPlatform 2015-01-01 23:28 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\sppui 2015-01-01 23:28 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\setup 2015-01-01 23:28 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\migwiz 2015-01-01 23:28 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\Com 2015-01-01 23:28 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\PolicyDefinitions 2015-01-01 23:28 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\IME 2015-01-01 23:28 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\system32\Sysprep 2015-01-01 23:28 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\system32\oobe 2015-01-01 23:28 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\system32\Dism 2015-01-01 23:27 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files (x86)\Windows Portable Devices 2015-01-01 23:27 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files (x86)\Windows Photo Viewer 2015-01-01 23:27 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files (x86)\Windows Multimedia Platform 2015-01-01 23:14 - 2013-08-22 17:36 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msclmd.dll 2015-01-01 23:13 - 2013-08-22 17:36 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\msclmd.dll 2015-01-01 18:15 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\MediaViewer 2015-01-01 18:15 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\FileManager 2015-01-01 18:15 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\Camera 2014-12-31 04:56 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\LiveKernelReports 2014-12-25 13:37 - 2014-12-12 11:18 - 00010372 _____ () C:\Windows\DirectX.log 2014-12-25 13:37 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared 2014-12-23 22:42 - 2014-12-12 01:34 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update Some content of TEMP: ==================== C:\Users\RR-PC\AppData\Local\Temp\BingBarSetup-Partner.exe C:\Users\RR-PC\AppData\Local\Temp\raptrpatch.exe C:\Users\RR-PC\AppData\Local\Temp\raptr_stub.exe C:\Users\RR-PC\AppData\Local\Temp\uttA4CF.tmp.exe C:\Users\RR-PC\AppData\Local\Temp\xmlUpdater.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-01-05 08:59 ==================== End Of Log ============================ И понеже другият файл е прекалено голям, го качих тук : https://drive.google.com/file/d/0B6DvfXIf9eWhZ0xhUjR3a3BFZ2c/view?usp=sharing
  22. Здравейте, Отскоро компютъра държи високо натоварване на процесора от порядъка най-често на 100%. Компютъра е служебен и като такъв нямам администраторски права над него. Моля да имате предвид това и ако е възможно по-някакъв начин да помогнете с инструменти който мога да използвам без да съм админ. Виждам, че има Trend Macro Office scan антивирусна, но няма как да пусна скан от нея за начална проверка. Ето ги и логовете от FRST.exe Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-01-2015 Ran by Muratovski (ATTENTION: The logged in user is not administrator) on CWP1103 on 10-01-2015 19:47:45 Running from \\swi.srse.net\home\01\muratovski\System\Desktop Loaded Profile: Muratovski (Available profiles: Fsdwin7testA & FcolinstA & FhugdA & Muratovski) Platform: Windows 7 Enterprise Service Pack 1 (X64) OS Language: English (United States) Internet Explorer Version 9 (Default browser: IE) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (LogMeIn, Inc.) C:\Program Files (x86)\RemotelyAnywhere\x64\RAGui.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation) C:\Windows\System32\StikyNot.exe (LogMeIn, Inc.) C:\Program Files (x86)\RemotelyAnywhere\x64\LMIGuardian.exe (Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\OfficeScan Client\PccNTMon.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe (Express Metrix) C:\Windows\SysWOW64\wex4962\EMMeter.exe (Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe (shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\concentr.exe (Microsoft Corporation) C:\Windows\System32\mobsync.exe (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe (Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\btplayerctrl.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPConnectionManager.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Farbar) \\swi.srse.net\home\01\muratovski\System\Desktop\FRST64.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [synTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2774256 2013-09-04] (Synaptics Incorporated) HKLM\...\Run: [sysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1703424 2013-08-16] (IDT, Inc.) HKLM\...\Run: [bLEServicesCtrl] => C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe [184112 2012-09-17] (Intel Corporation) HKLM\...\Run: [bTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp HKLM\...\Run: [RemotelyAnywhere GUI] => C:\Program Files (x86)\RemotelyAnywhere\x64\RAGui.exe [58456 2013-02-21] (LogMeIn, Inc.) HKLM-x32\...\Run: [bCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation) HKLM-x32\...\Run: [OfficeScanNT Monitor] => C:\Program Files (x86)\Trend Micro\OfficeScan Client\pccntmon.exe [2301160 2014-08-13] (Trend Micro Inc.) HKLM-x32\...\Run: [HPConnectionManager] => C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe [185144 2013-08-15] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [QLBController] => C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe [337184 2013-07-31] (Hewlett-Packard Company) HKLM-x32\...\Run: [EMMeter] => C:\Windows\SysWOW64\wex4962\EMMeter.exe [623612 2013-04-15] (Express Metrix) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [946352 2012-12-18] (Adobe Systems Incorporated) HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2011-09-27] (Apple Inc.) HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2011-10-24] (Apple Inc.) HKLM-x32\...\Run: [CfgDownload] => C:\Program Files (x86)\IXOS\bin\CfgDownload.exe [212992 2013-02-18] (Open Text Corporation) HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [701872 2013-01-24] (Cisco Systems, Inc.) HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [371200 2012-03-15] (shbox.de) HKLM-x32\...\Run: [ConnectionCenter] => C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [305088 2011-04-25] (Citrix Systems, Inc.) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKLM\...\Policies\Explorer: [NoWebServices] 1 HKLM\...\Policies\Explorer: [NoPublishingWizard] 1 HKU\S-1-5-21-902098597-719047761-1686532399-98385\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation) HKU\S-1-5-21-902098597-719047761-1686532399-98385\...\Policies\Explorer: [NoDrives] 128 HKU\S-1-5-21-902098597-719047761-1686532399-98385\...\Policies\Explorer: [HideSCAHealth] 1 HKU\S-1-5-21-902098597-719047761-1686532399-98385\...\Policies\Explorer: [NoStartMenuMyGames] 1 HKU\S-1-5-21-902098597-719047761-1686532399-98385\...\MountPoints2: {9239ca10-6272-11e4-b116-005056c00008} - D:\autorun.exe AppInit_DLLs: btpload64.dll => C:\Windows\system32\btpload64.dll [98280 2013-01-16] (BeyondTrust Software, Inc.) AppInit_DLLs-x32: btpload32.dll => "btpload32.dll" File Not Found ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\S-1-5-21-902098597-719047761-1686532399-98385\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION AutoConfigURL: [s-1-5-21-902098597-719047761-1686532399-98385] => http://pacserver/proxyironport.pac HKU\S-1-5-21-902098597-719047761-1686532399-98385\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.swi.srse.net HKU\S-1-5-21-902098597-719047761-1686532399-98385\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.swi.srse.net StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe BHO: PowerBroker Desktops Browser Helper -> {0A9CDB52-EBDF-4210-9C6A-B90C2FD410AB} -> C:\Windows\system32\pmbho.dll (BeyondTrust Software, Inc.) BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation) BHO: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: PowerBroker Desktops Browser Helper -> {0A9CDB52-EBDF-4210-9C6A-B90C2FD410AB} -> C:\Windows\SysWOW64\pmbho.dll (BeyondTrust Software, Inc.) BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation) BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) DPF: HKLM-x32 {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://akamaicdn.webex.com/client/WBXclient-T29L10NSP10EP1-10115/webex/ieatgpc1.cab Handler-x32: saphtmlp - {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - c:\program files (x86)\sap\frontend\sapgui\saphtmlp.dll (SAP, Walldorf) Handler-x32: sapr3 - {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - c:\program files (x86)\sap\frontend\sapgui\saphtmlp.dll (SAP, Walldorf) Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Tcpip\Parameters: [DhcpNameServer] 62.2.17.61 62.2.24.158 62.2.17.60 62.2.24.162 Tcpip\..\Interfaces\{222EE192-1502-42D5-9F99-4A5CEE49444D}: [NameServer] 192.168.88.26,192.168.55.155 Tcpip\..\Interfaces\{82711754-E3BD-4E44-BAE0-D63FAF9DCC65}: [NameServer] 10.200.102.243 10.200.102.244 FireFox: ======== FF ProfilePath: C:\Users\muratovski\AppData\Roaming\Mozilla\Firefox\Profiles\g9car0dz.default FF Homepage: hxxp://go.swi.srse.net/ FF NetworkProxy: "autoconfig_url", "http://pacserver/proxyironport.pac" FF NetworkProxy: "type", 2 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll () FF Plugin: @java.com/DTPlugin,version=10.9.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.9.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office15\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKU\.DEFAULT: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin HKU\S-1-5-21-902098597-719047761-1686532399-98385: @citrixonline.com/appdetectorplugin -> C:\Users\muratovski\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online) FF Plugin HKU\S-1-5-21-902098597-719047761-1686532399-98385: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation) FF Extension: IE Tab 2 (FF 3.6+) - C:\Users\muratovski\AppData\Roaming\Mozilla\Firefox\Profiles\g9car0dz.default\Extensions\{1BC9BA34-1EED-42ca-A505-6D2F1A935BBB} [2014-10-23] FF Extension: UnMHT - C:\Users\muratovski\AppData\Roaming\Mozilla\Firefox\Profiles\g9car0dz.default\Extensions\{f759ca51-3a91-4dd1-ae78-9db5eee9ebf0}.xpi [2013-11-06] Chrome: ======= ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 BTService; C:\Windows\system32\btservice.exe [491576 2013-01-16] (BeyondTrust Software, Inc.) R2 CommService; C:\Program Files (x86)\HP HSPA+ Mobile Broadband\CommService\CommServiceEx.exe [73296 2014-10-21] () R2 EMCliSrv; C:\Windows\SysWOW64\wex4962\EMCliSrv.exe [331776 2013-04-15] (Express Metrix) [File not signed] R2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe [681760 2013-07-31] (Hewlett-Packard Company) R2 lmhosts; C:\Windows\system32\svchost.exe [27136 2012-10-18] (Microsoft Corporation) R2 lmhosts; C:\Windows\SysWOW64\svchost.exe [21504 2012-10-18] (Microsoft Corporation) R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2012-10-18] (Microsoft Corporation) R2 NlaSvc; C:\Windows\SysWOW64\svchost.exe [21504 2012-10-18] (Microsoft Corporation) R2 nsi; C:\Windows\system32\svchost.exe [27136 2012-10-18] (Microsoft Corporation) R2 nsi; C:\Windows\SysWOW64\svchost.exe [21504 2012-10-18] (Microsoft Corporation) R2 ntrtscan; C:\Program Files (x86)\Trend Micro\OfficeScan Client\ntrtscan.exe [3447568 2014-08-12] (Trend Micro Inc.) R2 RAMaint; C:\Program Files (x86)\RemotelyAnywhere\x64\RaMaint.exe [120728 2013-02-21] (LogMeIn, Inc.) R2 RemotelyAnywhere; C:\Program Files (x86)\RemotelyAnywhere\x64\RemotelyAnywhere.exe [58456 2013-02-21] (LogMeIn, Inc.) S3 smstsmgr; C:\Windows\SysWOW64\CCM\TSManager.exe [246624 2009-09-18] () [File not signed] R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [339456 2013-08-16] (IDT, Inc.) [File not signed] R3 TMBMServer; C:\Program Files (x86)\Trend Micro\BM\TMBMSRV.exe [573488 2014-04-21] (Trend Micro Inc.) R2 tmlisten; C:\Program Files (x86)\Trend Micro\OfficeScan Client\tmlisten.exe [3503952 2014-08-12] (Trend Micro Inc.) S3 TmProxy; C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmProxy.exe [917016 2013-07-01] (Trend Micro Inc.) R2 VMAuthdService; C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe [79872 2012-01-18] (VMware, Inc.) [File not signed] S3 COMSysApp; %SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} S3 rpcapd; "%ProgramFiles(x86)%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles(x86)%\WinPcap\rpcapd.ini" [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 btmaux; C:\Windows\System32\DRIVERS\btmaux.sys [132920 2013-04-23] (Motorola Solutions, Inc.) S3 btmhsf; C:\Windows\System32\DRIVERS\btmhsf.sys [1385272 2013-08-08] (Motorola Solutions, Inc.) R3 e1dexpress; C:\Windows\System32\DRIVERS\e1d62x64.sys [495376 2013-07-12] (Intel Corporation) R3 huawei_cdcacm; C:\Windows\System32\DRIVERS\ew_jucdcacm.sys [110592 2014-10-21] (MBB Technologies Co., Ltd.) R3 huawei_enumerator; C:\Windows\System32\DRIVERS\ew_jubusenum.sys [91648 2014-10-21] (MBB Technologies Co., Ltd.) R3 huawei_ext_ctrl; C:\Windows\System32\DRIVERS\ew_juextctrl.sys [30720 2014-10-21] (MBB Technologies Co., Ltd.) R3 huawei_wwanecm; C:\Windows\System32\DRIVERS\ew_juwwanecm.sys [244736 2014-10-21] (MBB Technologies Co., Ltd.) R0 iaStorF; C:\Windows\System32\drivers\iaStorF.sys [28008 2013-08-01] (Intel Corporation) S3 ibtusb; C:\Windows\System32\DRIVERS\ibtusb.sys [113096 2013-08-07] (Intel Corporation) R3 ISCT; C:\Windows\System32\DRIVERS\ISCTD64.sys [46568 2013-08-07] () R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation) R3 NETwNs64; C:\Windows\System32\DRIVERS\NETwsw02.sys [3586016 2013-08-30] (Intel Corporation) R2 npf; C:\Windows\System32\drivers\npf.sys [35344 2012-04-10] (CACE Technologies, Inc.) R3 prepdrvr; C:\Windows\SysWOW64\CCM\prepdrv.sys [26992 2009-09-18] () [File not signed] R1 privman; C:\Windows\System32\DRIVERS\privman.sys [41280 2013-01-16] (BeyondTrust Software, Inc.) R2 RAInfo; C:\Program Files (x86)\RemotelyAnywhere\x64\RaInfo.sys [15928 2013-02-21] (LogMeIn, Inc.) R3 ramirr; C:\Windows\System32\DRIVERS\ramirr.sys [11576 2013-02-21] (LogMeIn, Inc.) S4 RARfsClientNP; No ImagePath R2 RARfsDriver; C:\Windows\system32\drivers\RARfsDriver.sys [72232 2013-02-21] (LogMeIn, Inc.) R3 RTSPER; C:\Windows\System32\DRIVERS\RtsPer.sys [429272 2013-08-21] (Realsil Semiconductor Corporation) S3 SmbDrv; C:\Windows\system32\drivers\Smb_driver_AMDASF.sys [30448 2013-09-04] (Synaptics Incorporated) R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [34544 2013-09-04] (Synaptics Incorporated) R2 tmactmon; C:\Windows\System32\DRIVERS\tmactmon.sys [86936 2014-04-21] (Trend Micro Inc.) R1 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [180160 2013-12-25] (Trend Micro Inc.) R2 tmevtmgr; C:\Windows\System32\DRIVERS\tmevtmgr.sys [66896 2014-04-21] (Trend Micro Inc.) R2 TmFilter; C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmXPFlt.sys [351032 2014-08-30] (Trend Micro Inc.) R2 TmPreFilter; C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmPreFlt.sys [44856 2014-08-30] (Trend Micro Inc.) R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [109080 2013-06-18] (Trend Micro Inc.) R2 VSApiNt; C:\Program Files (x86)\Trend Micro\OfficeScan Client\VSApiNt.sys [2316600 2014-08-30] (Trend Micro Inc.) S3 VGPU; System32\drivers\rdvgkmd.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-10 19:47 - 2015-01-10 19:47 - 00000000 ____D () C:\FRST 2015-01-10 19:26 - 2015-01-10 19:47 - 00011777 _____ () C:\Windows\SysWOW64\EMCliSrv.log 2015-01-08 13:54 - 2015-01-08 13:54 - 00000000 ____D () C:\Users\muratovski\AppData\Roaming\sqldeveloper 2015-01-07 22:19 - 2015-01-10 19:22 - 00072041 _____ () C:\Windows\RemotelyAnywhere.log 2015-01-07 22:19 - 2015-01-09 23:47 - 00025212 _____ () C:\Windows\RA20150109.log 2015-01-07 22:19 - 2015-01-08 23:47 - 00010453 _____ () C:\Windows\RA20150108.log 2015-01-06 08:53 - 2015-01-08 22:17 - 00000000 ____D () C:\Users\muratovski\AppData\Roaming\AIMP3 2015-01-05 17:38 - 2015-01-05 17:38 - 00000000 ____D () C:\Users\muratovski\AppData\Roaming\Wireshark 2014-12-29 14:59 - 2014-12-29 14:59 - 00000000 ____D () C:\Users\muratovski\AppData\Roaming\Teradata 2014-12-29 14:57 - 2014-12-29 14:57 - 00000000 ____D () C:\ProgramData\Teradata 2014-12-29 14:55 - 2014-12-29 14:58 - 00000000 ____D () C:\_SMSTaskSequence 2014-12-29 14:55 - 2014-12-29 14:55 - 00000000 __SHD () C:\Windows\system32\%APPDATA% 2014-12-29 14:55 - 2014-12-29 14:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\.NET Data Provider for Teradata 14.00.0.1 2014-12-19 11:06 - 2014-12-19 11:16 - 00000000 ____D () C:\Users\FcolinstA 2014-12-16 16:10 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL 2014-12-16 16:10 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL 2014-12-16 16:10 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL 2014-12-16 16:10 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL 2014-12-16 16:10 - 2014-07-09 03:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL 2014-12-16 16:10 - 2014-07-09 02:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL 2014-12-16 16:10 - 2014-07-09 02:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL 2014-12-16 16:10 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL 2014-12-16 16:10 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL 2014-12-16 16:10 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL 2014-12-16 16:10 - 2014-07-08 23:38 - 00419992 _____ () C:\Windows\system32\locale.nls 2014-12-16 16:10 - 2014-07-08 23:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls 2014-12-12 20:36 - 2014-12-12 20:36 - 01047017 _____ () C:\Users\muratovski\Downloads\=3G_Main=NoFilters_Query_Result_20141212203539422.xlsx 2014-12-12 20:36 - 2014-12-12 20:36 - 00937802 _____ () C:\Users\muratovski\Downloads\=3G_Main=NoFilters_Query_Result_20141212203539422.zip 2014-12-12 20:24 - 2014-12-12 20:24 - 00057241 _____ () C:\Users\muratovski\Downloads\HSDPA_2.xlsx 2014-12-12 20:24 - 2014-12-12 20:24 - 00044963 _____ () C:\Users\muratovski\Downloads\temporary_Query_Result_2014121220234676.zip 2014-12-12 20:24 - 2014-12-12 20:23 - 00078827 _____ () C:\Users\muratovski\Downloads\HSDPA_1_Query_Result_2014121220232291.xlsx 2014-12-12 20:23 - 2014-12-12 20:23 - 00071059 _____ () C:\Users\muratovski\Downloads\HSDPA_1_Query_Result_2014121220232291.zip 2014-12-11 09:42 - 2014-09-05 03:11 - 06584320 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll 2014-12-11 09:42 - 2014-09-05 02:52 - 05703168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll 2014-12-11 09:40 - 2014-08-23 03:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2014-12-11 09:40 - 2014-08-23 02:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2014-12-11 09:40 - 2014-06-30 23:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll 2014-12-11 09:40 - 2014-06-30 23:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll 2014-12-11 09:40 - 2014-06-06 07:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe 2014-12-11 09:40 - 2014-06-06 07:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe 2014-12-11 09:40 - 2014-03-09 22:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe 2014-12-11 09:40 - 2014-03-09 22:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll 2014-12-11 09:40 - 2014-03-09 22:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe 2014-12-11 09:40 - 2014-03-09 22:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll 2014-12-11 09:39 - 2014-06-24 04:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll 2014-12-11 09:39 - 2014-06-24 03:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll 2014-12-11 09:39 - 2014-06-16 03:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys 2014-12-11 09:38 - 2014-06-27 03:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll 2014-12-11 09:38 - 2014-06-27 02:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll 2014-12-11 09:37 - 2014-08-29 03:07 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll 2014-12-11 09:36 - 2014-10-14 03:13 - 00683520 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll 2014-12-11 09:36 - 2014-10-14 03:09 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll 2014-12-11 09:36 - 2014-10-14 03:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll 2014-12-11 09:36 - 2014-10-14 02:47 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll 2014-12-11 09:36 - 2014-10-14 02:46 - 00681984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll 2014-12-11 09:36 - 2014-10-09 07:49 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-12-11 09:35 - 2014-05-30 07:41 - 00496640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys 2014-12-11 09:33 - 2014-10-03 03:12 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll 2014-12-11 09:33 - 2014-10-03 03:11 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll 2014-12-11 09:33 - 2014-10-03 03:11 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll 2014-12-11 09:33 - 2014-10-03 03:11 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll 2014-12-11 09:33 - 2014-10-03 03:11 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll 2014-12-11 09:33 - 2014-10-03 02:44 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll 2014-12-11 09:33 - 2014-10-03 02:44 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll 2014-12-11 09:33 - 2014-10-03 02:44 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll 2014-12-11 09:33 - 2014-06-25 03:06 - 14179328 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-12-11 09:33 - 2014-06-25 02:37 - 12877312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2014-12-11 09:32 - 2014-08-01 12:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll 2014-12-11 09:32 - 2014-08-01 12:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll 2014-12-11 09:32 - 2014-06-18 23:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll 2014-12-11 09:32 - 2014-06-18 23:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll 2014-12-11 09:32 - 2014-06-18 23:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll 2014-12-11 09:32 - 2014-06-18 23:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll 2014-12-11 09:32 - 2014-06-18 23:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll 2014-12-11 09:32 - 2014-06-18 23:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll 2014-12-11 09:28 - 2014-08-21 07:43 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll 2014-12-11 09:28 - 2014-08-21 07:40 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll 2014-12-11 09:28 - 2014-08-21 07:26 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll 2014-12-11 09:28 - 2014-08-21 07:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll 2014-12-11 09:27 - 2014-06-18 03:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe 2014-12-11 09:27 - 2014-06-18 02:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe 2014-12-11 09:17 - 2014-10-18 03:05 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll 2014-12-11 09:17 - 2014-10-18 02:33 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll 2014-12-11 09:17 - 2014-06-06 11:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll 2014-12-11 09:17 - 2014-06-06 10:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll 2014-12-11 09:16 - 2014-10-14 03:16 - 03243008 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll 2014-12-11 09:16 - 2014-10-14 02:49 - 02364416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll 2014-12-11 09:16 - 2014-09-18 22:32 - 00112568 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe 2014-12-11 09:16 - 2014-09-18 22:29 - 01942016 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll 2014-12-11 09:16 - 2014-09-18 02:43 - 01806848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll 2014-12-11 09:16 - 2014-09-18 02:43 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll 2014-12-11 09:16 - 2014-07-14 03:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll 2014-12-11 09:16 - 2014-07-14 02:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll 2014-12-11 09:16 - 2014-06-03 03:42 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll 2014-12-11 09:15 - 2014-09-25 03:08 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll 2014-12-11 09:15 - 2014-09-25 02:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll 2014-12-11 09:15 - 2014-09-04 06:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll 2014-12-11 09:15 - 2014-09-04 06:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll 2014-12-11 09:09 - 2014-08-12 03:02 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL 2014-12-11 09:09 - 2014-08-12 02:36 - 00701440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IMJP10K.DLL 2014-12-11 09:02 - 2014-11-11 04:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2014-12-11 09:02 - 2014-11-11 04:08 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll 2014-12-11 09:02 - 2014-11-11 03:44 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2014-12-11 09:02 - 2014-11-11 03:44 - 00186880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll 2014-12-11 09:02 - 2014-10-14 03:16 - 00155064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2014-12-11 09:02 - 2014-10-14 03:12 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-12-11 09:02 - 2014-10-14 02:50 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2014-12-11 09:02 - 2014-10-14 02:49 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2014-12-11 09:02 - 2014-09-19 10:42 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2014-12-11 09:02 - 2014-09-19 10:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2014-12-11 09:02 - 2014-09-19 10:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2014-12-11 09:02 - 2014-09-19 10:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2014-12-11 09:02 - 2014-09-19 10:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2014-12-11 09:02 - 2014-09-19 10:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2014-12-11 09:02 - 2014-09-19 10:23 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2014-12-11 09:02 - 2014-09-19 10:23 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2014-12-11 09:02 - 2014-09-19 10:23 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2014-12-11 09:02 - 2014-09-19 10:23 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2014-12-11 09:02 - 2014-09-19 10:23 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2014-12-11 09:02 - 2014-09-19 10:23 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2014-12-11 08:55 - 2014-07-17 03:07 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe 2014-12-11 08:55 - 2014-07-17 03:07 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll 2014-12-11 08:55 - 2014-07-17 03:07 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll 2014-12-11 08:55 - 2014-07-17 02:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll 2014-12-11 08:55 - 2014-07-17 02:21 - 00212480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys 2014-12-11 08:55 - 2014-07-17 02:21 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys 2014-12-11 08:53 - 2014-10-25 02:57 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll 2014-12-11 08:53 - 2014-10-25 02:32 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-10 19:49 - 2014-10-21 10:22 - 01290188 _____ () C:\Windows\WindowsUpdate.log 2015-01-10 19:43 - 2014-10-23 10:14 - 00051868 __RSH () C:\Users\muratovski\ntuser.pol 2015-01-10 19:43 - 2014-10-23 10:14 - 00000000 ____D () C:\Users\muratovski 2015-01-10 19:43 - 2014-10-21 13:09 - 00114428 __RSH () C:\ProgramData\ntuser.pol 2015-01-10 19:42 - 2014-10-21 10:26 - 04656590 _____ () C:\Windows\SysWOW64\TmInstall.log 2015-01-10 19:42 - 2014-10-21 10:26 - 02725674 _____ () C:\Windows\system32\TmInstall.log 2015-01-10 19:40 - 2014-10-23 10:33 - 00000000 ____D () C:\Users\muratovski\AppData\Local\Express Software Manager 2015-01-10 19:38 - 2014-11-24 22:20 - 00000000 ____D () C:\Users\muratovski\AppData\Roaming\Skype 2015-01-10 19:36 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF 2015-01-10 19:32 - 2009-07-14 06:13 - 00819424 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-01-10 19:29 - 2009-07-14 05:45 - 00023808 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-01-10 19:29 - 2009-07-14 05:45 - 00023808 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-01-10 19:25 - 2014-12-03 22:45 - 00007667 _____ () C:\Users\muratovski\AppData\Local\Resmon.ResmonCfg 2015-01-10 19:25 - 2014-11-18 09:07 - 00004469 _____ () C:\Windows\TMFilter.log 2015-01-10 19:24 - 2013-12-03 11:17 - 00000404 _____ () C:\Windows\SMSCFG.INI 2015-01-10 19:22 - 2014-10-23 07:49 - 00034666 _____ () C:\Windows\SysWOW64\EMCliSrv.bak 2015-01-10 19:22 - 2014-10-22 09:26 - 00000000 ____D () C:\ProgramData\VMware 2015-01-10 19:22 - 2014-10-21 11:50 - 00018360 _____ () C:\Windows\dbg_RA_printer.txt 2015-01-10 19:22 - 2014-10-21 11:50 - 00017712 _____ () C:\Windows\dbg_RA_proc.txt 2015-01-10 19:22 - 2014-10-21 11:16 - 00000000 ____D () C:\Windows\SysWOW64\wex4962 2015-01-10 19:22 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-01-10 19:22 - 2009-07-14 05:51 - 00053032 _____ () C:\Windows\setupact.log 2015-01-10 18:52 - 2014-11-11 11:06 - 00000592 _____ () C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-902098597-719047761-1686532399-98385.job 2015-01-10 09:56 - 2014-10-21 10:27 - 00009310 _____ () C:\Windows\cfgall.ini 2015-01-09 22:14 - 2014-10-23 12:01 - 00000000 ____D () C:\=EXPORT= 2015-01-09 17:17 - 2014-10-23 14:49 - 00000000 ____D () C:\Users\muratovski\AppData\Local\CrashDumps 2015-01-09 16:56 - 2014-10-23 11:10 - 00000000 ___RD () C:\=BO= 2015-01-09 12:21 - 2014-10-21 11:17 - 00000000 ____D () C:\ProgramData\Express Software Manager 2015-01-09 08:44 - 2009-07-14 06:08 - 00032636 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2015-01-08 14:03 - 2014-10-23 14:10 - 00000000 ____D () C:\Users\muratovski\INSTALL 2015-01-08 10:39 - 2014-10-23 12:02 - 00000000 ___RD () C:\Users\muratovski\=CME= 2015-01-07 22:26 - 2014-10-23 12:52 - 00000000 ___RD () C:\=Other= 2015-01-06 00:05 - 2014-10-21 10:29 - 00000000 ____D () C:\ProgramData\Hewlett-Packard 2015-01-04 18:15 - 2014-10-27 19:54 - 00000000 ____D () C:\Users\muratovski\AppData\Roaming\Foxit Software 2015-01-04 18:06 - 2014-10-21 13:07 - 00000000 ____D () C:\Temp 2014-12-29 16:12 - 2014-10-23 10:14 - 00000000 ____D () C:\Users\muratovski\AppData\Local\Microsoft Help 2014-12-29 15:36 - 2014-10-23 15:09 - 00000000 ____D () C:\Users\muratovski\==OTHERS 2014-12-29 15:16 - 2014-10-23 10:18 - 00000000 ____D () C:\Users\muratovski\AppData\Local\VirtualStore 2014-12-29 14:57 - 2014-10-22 09:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Teradata Client 14.00 2014-12-29 14:56 - 2013-12-03 15:15 - 00000000 ____D () C:\Windows\SCCM 2014-12-29 14:55 - 2014-10-22 09:20 - 00000000 ____D () C:\Program Files (x86)\Teradata 2014-12-29 14:55 - 2013-12-03 15:39 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-12-29 14:55 - 2013-12-03 11:18 - 00826696 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI 2014-12-26 13:42 - 2014-10-23 15:24 - 00000000 ___RD () C:\=PRS= 2014-12-25 09:59 - 2014-10-23 15:13 - 00000000 ____D () C:\Users\muratovski\==NEW DOCS 2014-12-16 21:58 - 2009-07-14 05:45 - 00462584 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-12-16 21:31 - 2014-10-24 13:54 - 00000000 ____D () C:\Users\muratovski\AppData\Local\Adobe 2014-12-16 16:53 - 2010-11-21 04:47 - 00004964 _____ () C:\Windows\PFRO.log 2014-12-12 14:05 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2014-12-11 17:57 - 2010-11-21 07:30 - 00000000 ____D () C:\Program Files\Windows Journal 2014-12-11 17:57 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism 2014-12-11 17:57 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\Dism 2014-12-11 09:00 - 2014-10-23 10:34 - 00126664 _____ () C:\Users\muratovski\AppData\Local\GDIPFONTCACHEV1.DAT Files to move or delete: ==================== C:\Users\muratovski\Disable_SunriseTemplates.vbs Some content of TEMP: ==================== C:\Users\muratovski\AppData\Local\Temp\Foxit Reader Updater.exe C:\Users\muratovski\AppData\Local\Temp\H2Reg.exe C:\Users\muratovski\AppData\Local\Temp\SkypeSetup.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed ATTENTION: ==> Could not access BCD. Check to make sure user is administrator or see Addition.txt for additional information. ==================== End Of Log ============================ Addition.txt
  23. Добър ден преди 30 минути забелязах аномалии ,които се състоят в много бързо показване и скриване на нещо подобно на истриване на файлове.Сещате се какво се появява като дадем команда да се истрие някой файл.Дано не съм пипнал гадинка , но за това ще стане ясно по късно.Разполагам с преинсталационен диск пускам и логовете: Забравих да кажа от скоро часовника ми се размества и имам проблем с акаунта преди от таск мениджъра избирах switch user и компа се заключваше сега като цъкна switch user и нищо не се случва и съм принуден да чакам компа да заспи и да се заключи сам. Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 04-01-2015 Ran by Admin (administrator) on UNKNOWN-8383362 on 05-01-2015 12:30:11 Running from E:\Documents and Settings\Admin\Desktop Loaded Profile: Admin (Available profiles: Admin & Administrator) Platform: Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: English (United States) Internet Explorer Version 8 (Default browser: Chrome) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Intel Corporation) E:\WINDOWS\system32\igfxtray.exe (Intel Corporation) E:\WINDOWS\system32\hkcmd.exe (Intel Corporation) E:\WINDOWS\system32\igfxpers.exe (Realtek Semiconductor Corp.) E:\WINDOWS\RTHDCPL.EXE (Samsung Electronics Co., Ltd.) E:\Program Files\SAMSUNG\Kies\KiesTrayAgent.exe (Intel Corporation) E:\WINDOWS\system32\igfxsrvc.exe (Oracle Corporation) E:\Program Files\Common Files\Java\Java Update\jusched.exe (ESET) E:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET) E:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe (Oracle Corporation) E:\Program Files\Java\jre7\bin\jqs.exe () E:\Program Files\Localphone Ltd\Localphone\Localphone_mod.exe (Tonec Inc.) E:\Program Files\Internet Download Manager\IDMan.exe (Samsung) E:\Program Files\SAMSUNG\Kies\Kies.exe () E:\Program Files\Photodex\ProShow Gold\scsiaccess.exe (Windows ® Codename Longhorn DDK provider) E:\Program Files\UPHClean\uphclean.exe (CyberGhost S.R.L) E:\Program Files\CyberGhost 5\Service.exe (Tonec Inc.) E:\Program Files\Internet Download Manager\IEMonitor.exe (mIRC Co. Ltd.) D:\Programi\4avdoScript\mirc.exe (Microsoft Corporation) E:\WINDOWS\system32\taskmgr.exe (Google Inc.) E:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) E:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) E:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) E:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) E:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) E:\Program Files\Google\Chrome\Application\chrome.exe (Skype Technologies S.A.) E:\Program Files\Skype\Phone\Skype.exe (Google Inc.) E:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) E:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) E:\Program Files\Google\Chrome\Application\chrome.exe (BitTorrent Inc.) E:\Documents and Settings\Admin\Application Data\uTorrent\uTorrent.exe (Google Inc.) E:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) E:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) E:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) E:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) E:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) E:\Program Files\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [iMJPMIG8.1] => E:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE [208952 2008-04-14] (Microsoft Corporation) HKLM\...\Run: [PHIME2002ASync] => E:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [455168 2008-04-14] (Microsoft Corporation) HKLM\...\Run: [PHIME2002A] => E:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [455168 2008-04-14] (Microsoft Corporation) HKLM\...\Run: [RTHDCPL] => E:\WINDOWS\RTHDCPL.EXE [18671104 2009-07-29] (Realtek Semiconductor Corp.) HKLM\...\Run: [KiesTrayAgent] => E:\Program Files\Samsung\Kies\KiesTrayAgent.exe [310064 2014-06-14] (Samsung Electronics Co., Ltd.) HKLM\...\Run: [sunJavaUpdateSched] => E:\Program Files\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation) HKLM\...\Run: [egui] => E:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [5088456 2014-10-01] (ESET) HKLM\...\Run: [KernelFaultCheck] => %systemroot%\system32\dumprep 0 -k HKLM\...\Policies\Explorer: [NoDesktopCleanupWizard] 1 HKLM\...\Policies\Explorer: [NoFavoritesMenu] 0 HKLM\...\Policies\Explorer: [NoRecentDocsMenu] 0 HKLM\...\Policies\Explorer: [NoNetworkConnections] 0 HKLM\...\Policies\Explorer: [NoSMMyDocs] 0 HKLM\...\Policies\Explorer: [NoSMMyPictures] 0 HKLM\...\Policies\Explorer: [NoStartMenuMyMusic] 0 HKLM\...\Policies\Explorer: [NoSetFolders] 0 HKLM\...\Policies\Explorer: [NoSetTaskbar] 0 HKLM\...\Policies\Explorer: [NoCommonGroups] 0 HKLM\...\Policies\Explorer: [NoStartMenuNetworkPlaces] 0 HKLM\...\Policies\Explorer: [NoFind] 0 HKLM\...\Policies\Explorer: [NoTrayItemsDisplay] 0 HKLM\...\Policies\Explorer: [NoToolbarsOnTaskbar] 0 HKLM\...\Policies\Explorer: [NoSimpleStartMenu] 0 HKLM\...\Policies\Explorer: [HideClock] 0 HKLM\...\Policies\Explorer: [NoCDBurning] 0 HKU\S-1-5-19\...\RunOnce: [_nltide_3] => rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N HKU\S-1-5-20\...\RunOnce: [_nltide_3] => rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N HKU\S-1-5-21-117609710-776561741-1417001333-1003\...\Run: [iDMan] => E:\Program Files\Internet Download Manager\IDMan.exe [3886672 2014-12-17] (Tonec Inc.) HKU\S-1-5-21-117609710-776561741-1417001333-1003\...\Run: [KiesPreload] => E:\Program Files\Samsung\Kies\Kies.exe [1563440 2014-06-14] (Samsung) HKU\S-1-5-21-117609710-776561741-1417001333-1003\...\Run: [uTorrent] => E:\Documents and Settings\Admin\Application Data\uTorrent\uTorrent.exe [1680464 2014-11-27] (BitTorrent Inc.) HKU\S-1-5-21-117609710-776561741-1417001333-1003\...\Policies\Explorer: [NoAddPrinter] 0 HKU\S-1-5-21-117609710-776561741-1417001333-1003\...\Policies\Explorer: [NoDeletePrinter] 0 HKU\S-1-5-21-117609710-776561741-1417001333-1003\...\Policies\Explorer: [NoThemesTab] 0 HKU\S-1-5-21-117609710-776561741-1417001333-1003\...\Policies\Explorer: [NoChangeKeyboardNavigationIndicators] 0 HKU\S-1-5-21-117609710-776561741-1417001333-1003\...\Policies\Explorer: [NoChangeAnimation] 0 HKU\S-1-5-21-117609710-776561741-1417001333-1003\...\Policies\Explorer: [NoViewContextMenu] 0 HKU\S-1-5-21-117609710-776561741-1417001333-1003\...\Policies\Explorer: [NoDFSTab] 0 HKU\S-1-5-21-117609710-776561741-1417001333-1003\...\Policies\Explorer: [NoSecurityTab] 0 HKU\S-1-5-21-117609710-776561741-1417001333-1003\...\Policies\Explorer: [NoHardwareTab] 0 HKU\S-1-5-21-117609710-776561741-1417001333-1003\...\Policies\Explorer: [NoToolbarCustomize] 0 HKU\S-1-5-21-117609710-776561741-1417001333-1003\...\Policies\Explorer: [NoBandCustomize] 0 HKU\S-1-5-21-117609710-776561741-1417001333-1003\...\Policies\Explorer: [NoFileMenu] 0 HKU\S-1-5-21-117609710-776561741-1417001333-1003\...\Policies\Explorer: [NoNetHood] 0 HKU\S-1-5-18\...\RunOnce: [_nltide_3] => rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N SecurityProviders: schannel.dll, credssp.dll, digest.dll Startup: E:\Documents and Settings\Admin\Start Menu\Programs\Startup\AutorunsDisabled () Startup: E:\Documents and Settings\All Users\Start Menu\Programs\Startup\AutorunsDisabled () Startup: E:\Documents and Settings\All Users\Start Menu\Programs\Startup\CrashPlan Tray.lnk ShortcutTarget: CrashPlan Tray.lnk -> E:\Program Files\CrashPlan\CrashPlanTray.exe (No File) Startup: E:\Documents and Settings\All Users\Start Menu\Programs\Startup\MS .NET Framework 4 - WinXP Slow Boot Fix v3.1.vbs () ShellIconOverlayIdentifiers: [0_FlingIconOverlay] -> {02696AD5-FF96-454B-9E00-81DA8B79B678} => E:\Program Files\NCH Software\Fling\fldll.dll () ShellIconOverlayIdentifiers: [iDM Shell Extension] -> {CDC95B92-E27C-4745-A8C5-64A52A78855D} => E:\Program Files\Internet Download Manager\IDMShellExt.dll (Tonec Inc.) BootExecute: autocheck autochk * ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\S-1-5-19\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\S-1-5-20\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\S-1-5-21-117609710-776561741-1417001333-1003\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled. ProxyServer: [.DEFAULT] => http=127.0.0.1:2944;https=127.0.0.1:2944; HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = HKU\S-1-5-21-117609710-776561741-1417001333-1003\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp HKU\S-1-5-21-117609710-776561741-1417001333-1003\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.bg/ BHO: IDM integration (IDMIEHlprObj Class) -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> E:\Program Files\Internet Download Manager\IDMIECC.dll (Internet Download Manager, Tonec Inc.) BHO: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> E:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> E:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF ProfilePath: E:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\1ln2ume0.default FF Homepage: https://www.google.bg FF Plugin: @adobe.com/FlashPlayer -> E:\WINDOWS\system32\Macromed\Flash\NPSWF32_16_0_0_235.dll () FF Plugin: @java.com/DTPlugin,version=10.71.2 -> E:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.71.2 -> E:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> E:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/WPF,version=3.5 -> E:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF Plugin: @photodex.com/PhotodexPresenter -> E:\Program Files\Photodex Presenter\npPxPlay.dll ( ) FF Plugin: @tools.google.com/Google Update;version=3 -> E:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 -> E:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @videolan.org/vlc,version=2.1.5 -> E:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Extension: No Name - E:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\1ln2ume0.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-09-09] FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - E:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF Extension: Microsoft .NET Framework Assistant - E:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2014-09-18] FF HKU\S-1-5-21-117609710-776561741-1417001333-1003\...\Firefox\Extensions: [[email protected]] - E:\Documents and Settings\Admin\Application Data\IDM\idmmzcc5 FF Extension: IDM CC - E:\Documents and Settings\Admin\Application Data\IDM\idmmzcc5 [2014-12-17] FF HKU\S-1-5-21-117609710-776561741-1417001333-1003\...\SeaMonkey\Extensions: [[email protected]] - E:\Documents and Settings\Admin\Application Data\IDM\idmmzcc5 Chrome: ======= CHR HomePage: Default -> hxxp://www.google.com/ CHR StartupUrls: Default -> "hxxp://crunchbang.org/start/", "hxxp://www.search.ask.com/?o=APN10653A&gct=hp&d=1-1868&v=n12521-372&t=4", "hxxp://www.search.ask.com/?o=APN10653A&gct=hp&d=1-1868&v=a12720-372&t=4", "hxxp://gangosan.dc7.us/bg/" CHR Profile: E:\Documents and Settings\Admin\Local Settings\Application Data\Google\Chrome\User Data\Default CHR Extension: (Google Презентации) - E:\Documents and Settings\Admin\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-12-31] CHR Extension: (Google Документи) - E:\Documents and Settings\Admin\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-12-31] CHR Extension: (Google Диск) - E:\Documents and Settings\Admin\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-12-31] CHR Extension: (YouTube) - E:\Documents and Settings\Admin\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-12-31] CHR Extension: (Adblock Plus) - E:\Documents and Settings\Admin\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-12-31] CHR Extension: (Google Търсене) - E:\Documents and Settings\Admin\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-12-31] CHR Extension: (SSLTrust SSL Certificate Store) - E:\Documents and Settings\Admin\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\fappknnhhggcjmeljjbjmibmhoninmem [2014-12-31] CHR Extension: (Hola Better Internet) - E:\Documents and Settings\Admin\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio [2014-12-31] CHR Extension: (Lunapic Photo Editor) - E:\Documents and Settings\Admin\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ifimmnanlabnljjnaegjmgnelmdmjabn [2014-12-31] CHR Extension: (Online PDF Tools) - E:\Documents and Settings\Admin\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jddfpnmfhodaljeelokfceepbeapgbdn [2014-12-31] CHR Extension: (IDM Integration Module) - E:\Documents and Settings\Admin\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jeaohhlajejodfjadcponpnjgkiikocn [2014-12-31] CHR Extension: (IP адрес) - E:\Documents and Settings\Admin\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jpnjjlbngpejmmhgcaagljaomgnginml [2014-12-31] CHR Extension: (Video Download Helper) - E:\Documents and Settings\Admin\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ldcccbolclahdbkahlppenfodnheapah [2014-12-31] CHR Extension: (Cloud9) - E:\Documents and Settings\Admin\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nbdmccoknlfggadpfkmcpnamfnbkmkcp [2014-12-31] CHR Extension: (Google Wallet) - E:\Documents and Settings\Admin\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-12-31] CHR Extension: (Weather Underground) - E:\Documents and Settings\Admin\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjejbgheonogbpfkkjigbmahaljipoej [2014-12-31] CHR Extension: (Gmail) - E:\Documents and Settings\Admin\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-12-31] CHR HKLM\...\Chrome\Extension: [jeaohhlajejodfjadcponpnjgkiikocn] - E:\Program Files\Internet Download Manager\IDMGCExt.crx [2014-12-16] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 CGVPNCliService; E:\Program Files\CyberGhost 5\Service.exe [64616 2014-11-03] (CyberGhost S.R.L) R2 ekrn; E:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [1349576 2014-10-01] (ESET) R2 JavaQuickStarterService; E:\Program Files\Java\jre7\bin\jqs.exe [182696 2014-11-27] (Oracle Corporation) R2 LocalphoneWinService; E:\Program Files\Localphone Ltd\Localphone\Localphone_mod.exe [1046016 2013-08-22] () [File not signed] R2 ScsiAccess; E:\Program Files\Photodex\ProShow Gold\ScsiAccess.exe [186760 2014-12-09] () S4 SEVPNCLIENT; E:\Program Files\SoftEther VPN Client\vpnclient.exe [3544632 2014-08-08] (SoftEther VPN Project at University of Tsukuba, Japan.) R2 UPHClean; E:\Program Files\UPHClean\uphclean.exe [399872 2010-09-14] (Windows ® Codename Longhorn DDK provider) [File not signed] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 Ambfilt; E:\WINDOWS\System32\drivers\Ambfilt.sys [1684736 2008-08-06] (Creative) R3 eamonm; E:\WINDOWS\System32\DRIVERS\eamonm.sys [191928 2014-10-10] (ESET) R1 ehdrv; E:\WINDOWS\System32\DRIVERS\ehdrv.sys [135296 2014-10-10] (ESET) R1 epfwtdir; E:\WINDOWS\System32\DRIVERS\epfwtdir.sys [119792 2014-10-10] (ESET) R1 GUBootStartup; E:\WINDOWS\System32\drivers\GUBootStartup.sys [17344 2014-09-20] (Glarysoft Ltd) R1 IDMTDI; E:\WINDOWS\System32\DRIVERS\idmtdi.sys [123360 2014-11-29] (Tonec Inc.) R3 mcdbus; E:\WINDOWS\System32\DRIVERS\mcdbus.sys [116736 2009-02-24] (MagicISO, Inc.) [File not signed] S3 Monfilt; E:\WINDOWS\System32\drivers\Monfilt.sys [1389056 2006-01-05] (Creative Technology Ltd.) S4 Neo_VPN; E:\WINDOWS\System32\DRIVERS\Neo_0108.sys [25824 2014-08-08] (SoftEther VPN Project at University of Tsukuba, Japan.) S3 ssudserd; E:\WINDOWS\System32\DRIVERS\ssudserd.sys [181432 2011-10-18] (DEVGURU Co., LTD.(www.devguru.co.kr)) S3 tap0801; E:\WINDOWS\System32\DRIVERS\tap0801.sys [26624 2006-10-01] (The OpenVPN Project) [File not signed] S3 tap0901; E:\WINDOWS\System32\DRIVERS\tap0901.sys [35288 2013-09-13] (The OpenVPN Project) S3 btaudio; system32\drivers\btaudio.sys [X] S3 BTDriver; system32\DRIVERS\btport.sys [X] S3 BTWDNDIS; system32\DRIVERS\btwdndis.sys [X] S3 btwhid; system32\DRIVERS\btwhid.sys [X] S3 btwmodem; system32\DRIVERS\btwmodem.sys [X] S3 BTWUSB; System32\Drivers\btwusb.sys [X] U1 eamon; system32\DRIVERS\eamon.sys [X] S4 IntelIde; No ImagePath U1 WS2IFSL; No ImagePath ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-05 12:30 - 2015-01-05 12:30 - 00018608 _____ () E:\Documents and Settings\Admin\Desktop\FRST.txt 2015-01-05 12:29 - 2015-01-05 12:30 - 00000000 ____D () E:\FRST 2015-01-05 03:36 - 2012-07-25 21:09 - 00000000 ____D () E:\Documents and Settings\Admin\Desktop\openpublish-7.x-1.0-beta2 2015-01-05 02:46 - 2015-01-05 02:46 - 02379400 _____ () E:\Documents and Settings\Admin\Desktop\xara.zip 2015-01-05 02:34 - 2015-01-05 02:34 - 00000916 _____ () E:\Documents and Settings\All Users\Desktop\Xara Web Designer 10 Premium.lnk 2015-01-05 02:33 - 2015-01-05 02:33 - 00000000 ___RD () E:\Documents and Settings\Admin\My Documents\Xara 2015-01-05 02:33 - 2015-01-05 02:33 - 00000000 ____D () E:\Program Files\Common Files\Xara Services 2015-01-05 02:33 - 2015-01-05 02:33 - 00000000 ____D () E:\Program Files\Common Files\MAGIX Services 2015-01-05 00:44 - 2015-01-05 00:47 - 00000000 ____D () E:\Program Files\smartmontools 2015-01-05 00:16 - 2015-01-05 00:27 - 00000000 ____D () E:\Documents and Settings\Admin\Desktop\ezpublish5_community_project-2014.11.1-gpl-full 2015-01-04 23:25 - 2015-01-04 23:25 - 00000000 ____D () E:\Program Files\Microsoft Silverlight 2015-01-04 23:25 - 2015-01-04 23:25 - 00000000 ____D () E:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Silverlight 2015-01-04 18:13 - 2015-01-04 18:13 - 01115136 _____ (Farbar) E:\Documents and Settings\Admin\Desktop\FRST.exe 2015-01-04 03:52 - 2015-01-04 03:52 - 00000000 ____D () E:\Documents and Settings\Admin\Application Data\CrystalIdea Software 2015-01-04 03:40 - 2015-01-04 03:40 - 00000000 _____ () E:\Documents and Settings\Admin\Application Data\ClassicFTP.dmp 2015-01-03 23:11 - 2015-01-03 23:11 - 02406926 _____ () E:\Documents and Settings\Admin\Desktop\MyBackup Pro v4.0.9 apkmania.com.rar 2015-01-03 13:12 - 2015-01-05 00:51 - 00000000 ____D () E:\Program Files\CrashPlan 2015-01-03 13:12 - 2015-01-05 00:51 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\CrashPlan 2015-01-03 13:12 - 2015-01-03 13:12 - 00000000 ____D () E:\Documents and Settings\Admin\Application Data\CrashPlan 2015-01-03 12:33 - 2015-01-03 12:33 - 00081920 _____ () E:\WINDOWS\Minidump\Mini010315-01.dmp 2015-01-03 03:23 - 2015-01-03 03:29 - 00000000 ____D () E:\Documents and Settings\Admin\Application Data\.minecraft 2015-01-03 03:23 - 2015-01-03 03:23 - 00000000 ____D () E:\Documents and Settings\Admin\Application Data\java 2014-12-31 15:01 - 2014-12-31 15:01 - 00000822 _____ () E:\Documents and Settings\Admin\Desktop\Auslogics BoostSpeed.lnk 2014-12-31 07:08 - 2014-12-31 07:08 - 00001811 _____ () E:\Documents and Settings\All Users\Desktop\Google Chrome.lnk 2014-12-31 07:08 - 2014-12-31 07:08 - 00000000 ____D () E:\Documents and Settings\All Users\Start Menu\Programs\Google Chrome 2014-12-31 07:07 - 2015-01-05 12:12 - 00000984 _____ () E:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job 2014-12-31 07:07 - 2015-01-05 07:12 - 00000980 _____ () E:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job 2014-12-30 03:43 - 2014-12-30 03:43 - 00000000 ____D () E:\Program Files\Temp File Cleaner 2014-12-29 19:28 - 2014-12-29 19:31 - 00000000 ____D () E:\Documents and Settings\Admin\Local Settings\Application Data\Adobe 2014-12-29 02:42 - 2014-12-29 02:42 - 00000000 ____D () E:\Documents and Settings\Admin\Application Data\Steganos Updates 2014-12-29 02:39 - 2014-12-31 07:05 - 00000000 ____D () E:\Program Files\OkayFreedom 2014-12-29 02:39 - 2014-12-31 07:04 - 00000000 ____D () E:\Documents and Settings\Admin\Application Data\Steganos 2014-12-29 02:39 - 2014-12-29 19:53 - 00000000 ____D () E:\Documents and Settings\Admin\Application Data\Steganos VPN 2014-12-29 02:39 - 2014-12-29 02:39 - 00000000 ____D () E:\Program Files\Common Files\Steganos 2014-12-19 22:50 - 2014-12-30 03:50 - 00000000 ____D () E:\Program Files\Steam 2014-12-19 22:50 - 2014-12-19 22:50 - 00000000 ____D () E:\Documents and Settings\All Users\Start Menu\Programs\Steam 2014-12-16 14:07 - 2014-12-30 03:45 - 00000000 __HDC () E:\WINDOWS\$NtUninstallKB3013126$ 2014-12-15 23:23 - 2014-12-15 23:25 - 00000000 ____D () E:\Program Files\OpenVPN 2014-12-15 21:56 - 2015-01-03 12:33 - 00000306 _____ () E:\WINDOWS\Tasks\Anvi AD Blocker Ultimate.job 2014-12-15 21:56 - 2014-12-15 21:56 - 00000000 ____D () E:\Program Files\Common Files\Anvisoft 2014-12-15 21:56 - 2014-12-15 21:56 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\Anvisoft 2014-12-13 22:15 - 2014-12-13 22:15 - 00000780 _____ () E:\Documents and Settings\All Users\Desktop\FastStone Image Viewer.lnk 2014-12-13 22:15 - 2014-12-13 22:15 - 00000000 ____D () E:\Program Files\FastStone Image Viewer 2014-12-13 22:15 - 2014-12-13 22:15 - 00000000 ____D () E:\Documents and Settings\All Users\Start Menu\Programs\FastStone Image Viewer 2014-12-11 15:20 - 2014-12-30 03:50 - 00000000 ____D () E:\Program Files\Mozilla Firefox 2014-12-10 01:22 - 2014-12-10 01:22 - 00446622 _____ () E:\Documents and Settings\Admin\Desktop\x5.zip 2014-12-10 01:04 - 2014-12-10 01:09 - 00000000 ____D () E:\Documents and Settings\Admin\Desktop\x5 2014-12-09 22:10 - 2014-12-09 22:10 - 00001738 _____ () E:\Documents and Settings\All Users\Desktop\ProShow Gold.lnk 2014-12-09 22:10 - 2014-12-09 22:10 - 00000000 ____D () E:\Program Files\Photodex Presenter 2014-12-09 22:10 - 2014-12-09 22:10 - 00000000 ____D () E:\Documents and Settings\Admin\Application Data\Netscape 2014-12-09 22:09 - 2014-12-09 22:09 - 00000000 ____D () E:\Program Files\Photodex 2014-12-09 22:09 - 2014-12-09 22:09 - 00000000 ____D () E:\Documents and Settings\Admin\Application Data\Photodex 2014-12-09 22:08 - 2014-12-09 22:09 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\Photodex 2014-12-09 22:02 - 2014-12-09 22:02 - 00000000 ____D () E:\Documents and Settings\Admin\My Documents\Incomedia 2014-12-09 21:57 - 2014-12-09 21:57 - 00000778 _____ () E:\Documents and Settings\All Users\Desktop\WebSite X5 Home 11.lnk 2014-12-09 21:57 - 2014-12-09 21:57 - 00000000 ____D () E:\Documents and Settings\All Users\Start Menu\Programs\WebSite X5 v11 - Home 2014-12-09 21:57 - 2014-12-09 21:57 - 00000000 ____D () E:\Documents and Settings\Admin\Local Settings\Application Data\Incomedia 2014-12-09 21:56 - 2014-12-09 22:02 - 00000000 ____D () E:\Program Files\WebSite X5 v11 - Home ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-05 12:30 - 2014-09-18 11:19 - 00000000 ____D () E:\Documents and Settings\Admin\Local Settings\Temp 2015-01-05 12:30 - 2014-09-06 12:38 - 139263040 _____ () E:\WINDOWS\system32\localphone.log 2015-01-05 12:29 - 2014-08-06 13:51 - 00000000 ____D () E:\Documents and Settings\Admin\Application Data\uTorrent 2015-01-05 12:21 - 2014-08-04 23:40 - 00000422 ____H () E:\WINDOWS\Tasks\User_Feed_Synchronization-{28E14D98-3938-4F39-A46A-0C98F66DE9A8}.job 2015-01-05 12:15 - 2014-07-09 15:45 - 00000830 _____ () E:\WINDOWS\Tasks\Adobe Flash Player Updater.job 2015-01-05 11:57 - 2014-08-05 01:23 - 00000000 ____D () E:\Documents and Settings\Admin\Application Data\Skype 2015-01-05 11:51 - 2014-08-05 04:32 - 00032526 _____ () E:\WINDOWS\SchedLgU.Txt 2015-01-05 06:19 - 2014-08-05 04:29 - 01216891 _____ () E:\WINDOWS\WindowsUpdate.log 2015-01-05 03:32 - 2014-08-06 11:19 - 00000000 ____D () E:\Documents and Settings\Admin\Application Data\DMCache 2015-01-05 02:34 - 2014-08-09 18:37 - 00000000 ____D () E:\Documents and Settings\All Users\Start Menu\Programs\Xara 2015-01-05 02:33 - 2014-08-09 18:37 - 00000000 ____D () E:\Program Files\Xara 2015-01-05 02:28 - 2014-09-02 11:27 - 00000000 ____D () E:\Program Files\WinTools Software 2015-01-05 02:25 - 2014-08-11 09:56 - 00045752 _____ () E:\Documents and Settings\Admin\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2015-01-05 02:25 - 2014-08-10 13:54 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\TEMP 2015-01-05 02:17 - 2014-08-08 18:41 - 00041600 ____H () E:\WINDOWS\system32\mlfcache.dat 2015-01-05 02:01 - 2014-08-09 18:38 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\MAGIX 2015-01-05 02:01 - 2014-08-09 18:38 - 00000000 ____D () E:\Documents and Settings\Admin\Application Data\MAGIX 2015-01-05 02:01 - 2014-08-09 18:37 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\Xara 2015-01-04 15:53 - 2014-08-16 22:18 - 00000000 ____D () E:\Documents and Settings\Admin\Application Data\TeamViewer 2015-01-04 12:55 - 2014-11-30 01:59 - 00002265 _____ () E:\Documents and Settings\All Users\Desktop\Skype.lnk 2015-01-04 02:57 - 2014-08-17 22:47 - 00000600 _____ () E:\Documents and Settings\Admin\Application Data\winscp.rnd 2015-01-04 02:56 - 2014-08-17 22:45 - 04635145 _____ () E:\Documents and Settings\Admin\Desktop\winscp554.zip 2015-01-04 00:29 - 2014-08-07 09:48 - 00000000 ____D () E:\Documents and Settings\Admin\Application Data\vlc 2015-01-03 18:55 - 2014-08-06 11:19 - 00000000 ____D () E:\Documents and Settings\Admin\Application Data\IDM 2015-01-03 12:34 - 2014-09-20 13:05 - 00000320 _____ () E:\WINDOWS\Tasks\GlaryInitialize 5.job 2015-01-03 12:33 - 2014-09-30 14:16 - 00000000 ____D () E:\WINDOWS\Minidump 2015-01-03 12:33 - 2014-08-05 04:32 - 00000006 ____H () E:\WINDOWS\Tasks\SA.DAT 2015-01-03 12:33 - 2008-04-14 14:00 - 00002206 _____ () E:\WINDOWS\system32\wpa.dbl 2014-12-31 16:36 - 2014-09-11 01:16 - 01190243 _____ () E:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-117609710-776561741-1417001333-1003-0.dat 2014-12-31 16:36 - 2014-09-06 12:38 - 00065536 _____ () E:\WINDOWS\system32\config\Localpho.evt 2014-12-31 16:36 - 2014-09-06 02:10 - 00147582 _____ () E:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat 2014-12-31 16:36 - 2014-08-05 04:33 - 00000178 ___SH () E:\Documents and Settings\Admin\ntuser.ini 2014-12-31 15:12 - 2014-09-03 19:47 - 00000000 ____D () E:\Documents and Settings\Admin\Start Menu\Programs\Utilities 2014-12-31 15:12 - 2014-08-24 20:24 - 00000000 ____D () E:\Documents and Settings\Admin\Start Menu\Programs\BlueVoda Website Builder 2014-12-31 15:03 - 2014-09-29 16:26 - 00000000 ____D () E:\WINDOWS\system32\LogFiles 2014-12-31 15:01 - 2014-09-02 11:52 - 00000000 ____D () E:\Program Files\Auslogics 2014-12-31 15:01 - 2014-09-02 11:52 - 00000000 ____D () E:\Documents and Settings\All Users\Start Menu\Programs\Auslogics 2014-12-31 07:08 - 2014-08-05 00:32 - 00000000 ____D () E:\Documents and Settings\Admin\Local Settings\Application Data\Google 2014-12-31 07:07 - 2014-08-04 23:34 - 00000000 ____D () E:\Program Files\Google 2014-12-30 18:12 - 2014-08-06 14:31 - 00000000 ____D () E:\Program Files\Counter-Strike 1.6 2014-12-30 03:56 - 2014-09-30 14:50 - 00114904 _____ (Malwarebytes Corporation) E:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2014-12-30 03:52 - 2014-09-20 13:04 - 00000000 ____D () E:\Program Files\Glary Utilities 5 2014-12-30 03:50 - 2014-08-06 11:19 - 00000000 ____D () E:\Program Files\Internet Download Manager 2014-12-30 03:50 - 2014-08-04 23:12 - 00000000 ____D () E:\WINDOWS\Help 2014-12-30 03:44 - 2014-08-05 04:33 - 00000000 ____D () E:\Documents and Settings\Admin 2014-12-30 03:43 - 2014-09-05 19:38 - 00000716 _____ () E:\Documents and Settings\Admin\Start Menu\Programs\Temp File Cleaner.lnk 2014-12-30 03:43 - 2014-09-05 19:38 - 00000710 _____ () E:\Documents and Settings\Admin\Desktop\Temp File Cleaner.lnk 2014-12-30 02:50 - 2014-09-05 19:36 - 00000682 _____ () E:\Documents and Settings\All Users\Desktop\CCleaner.lnk 2014-12-30 02:50 - 2014-09-05 19:36 - 00000000 ____D () E:\Program Files\CCleaner 2014-12-29 19:31 - 2014-07-09 15:45 - 00701616 _____ (Adobe Systems Incorporated) E:\WINDOWS\system32\FlashPlayerApp.exe 2014-12-29 19:31 - 2014-07-09 15:45 - 00071344 _____ (Adobe Systems Incorporated) E:\WINDOWS\system32\FlashPlayerCPLApp.cpl 2014-12-17 16:59 - 2014-08-08 00:37 - 00000000 ____D () E:\Program Files\PokerStars.BG 2014-12-17 16:11 - 2014-08-06 11:19 - 00000696 _____ () E:\Documents and Settings\Admin\Desktop\Internet Download Manager.lnk 2014-12-16 14:39 - 2014-09-05 19:35 - 00000000 ____D () E:\WINDOWS\Microsoft.NET 2014-12-16 14:08 - 2014-08-25 09:55 - 00000000 ____D () E:\WINDOWS\system32\MRT 2014-12-16 14:07 - 2014-07-09 01:28 - 109818608 _____ (Microsoft Corporation) E:\WINDOWS\system32\mrt.exe 2014-12-16 14:06 - 2014-08-04 23:21 - 00568940 _____ () E:\WINDOWS\system32\PerfStringBackup.INI 2014-12-14 10:49 - 2014-08-06 13:54 - 00000000 ____D () E:\Documents and Settings\Admin\Application Data\FastStone 2014-12-13 07:21 - 2014-09-21 20:51 - 00000000 ____D () E:\Program Files\Mozilla Maintenance Service 2014-12-12 23:23 - 2014-11-27 21:36 - 00000000 __HDC () E:\WINDOWS\$NtUninstallKB2992611$ 2014-12-12 23:23 - 2014-11-27 21:35 - 00000000 __HDC () E:\WINDOWS\$NtUninstallKB3006226$ 2014-12-12 23:23 - 2014-11-27 21:34 - 00000000 __HDC () E:\WINDOWS\$NtUninstallKB2998579$ 2014-12-12 23:23 - 2014-11-27 21:30 - 00000000 __HDC () E:\WINDOWS\$NtUninstallKB2993254$ 2014-12-12 23:23 - 2014-11-27 21:30 - 00000000 __HDC () E:\WINDOWS\$NtUninstallKB2991963$ 2014-12-12 23:23 - 2014-11-27 21:29 - 00000000 __HDC () E:\WINDOWS\$NtUninstallKB3002885$ 2014-12-12 23:23 - 2014-11-27 21:28 - 00000000 __HDC () E:\WINDOWS\$NtUninstallKB2989935$ 2014-12-12 23:23 - 2014-11-27 21:26 - 00000000 ___HD () E:\WINDOWS\$hf_mig$ 2014-12-12 23:23 - 2014-11-27 21:25 - 00000000 __HDC () E:\WINDOWS\$NtUninstallKB3011780$ 2014-12-12 23:23 - 2014-11-27 21:25 - 00000000 __HDC () E:\WINDOWS\$NtUninstallKB2993958$ 2014-12-10 17:45 - 2014-09-30 14:50 - 00000777 _____ () E:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk 2014-12-10 17:45 - 2014-09-30 14:50 - 00000000 ____D () E:\Program Files\Malwarebytes Anti-Malware 2014-12-10 17:45 - 2014-09-30 14:50 - 00000000 ____D () E:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes Anti-Malware 2014-12-09 22:10 - 2014-08-07 09:19 - 00000000 ____D () E:\Documents and Settings\Admin\Application Data\Mozilla ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) E:\WINDOWS\explorer.exe => File is digitally signed E:\WINDOWS\system32\winlogon.exe => File is digitally signed E:\WINDOWS\system32\svchost.exe => File is digitally signed E:\WINDOWS\system32\services.exe => File is digitally signed E:\WINDOWS\system32\User32.dll => File is digitally signed E:\WINDOWS\system32\userinit.exe => File is digitally signed E:\WINDOWS\system32\rpcss.dll => File is digitally signed E:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed ==================== End Of Log ============================ Additional scan result of Farbar Recovery Scan Tool (x86) Version: 04-01-2015 Ran by Admin at 2015-01-05 12:31:24 Running from E:\Documents and Settings\Admin\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: ESET NOD32 Antivirus 8.0 (Disabled - Up to date) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) µTorrent (HKU\S-1-5-21-117609710-776561741-1417001333-1003\...\uTorrent) (Version: 3.4.2.36615 - BitTorrent Inc.) Adobe Flash Player 15 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 15.0.0.152 - Adobe Systems Incorporated) Adobe Flash Player 16 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems Incorporated) AIDA64 Extreme v4.60 (HKLM\...\AIDA64 Extreme_is1) (Version: 4.60 - FinalWire Ltd.) Ashampoo Burning Studio 2015 v.1.15.0 (HKLM\...\{91B33C97-21E3-DF34-9630-2EE80DDE1648}_is1) (Version: 1.15.0 - Ashampoo GmbH & Co. KG) Auslogics BoostSpeed (HKLM\...\{7216871F-869E-437C-B9BF-2A13F2DCE63F}_is1) (Version: 6.5.6.0 - Auslogics Labs Pty Ltd) Auslogics DiskDefrag (HKLM\...\{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1) (Version: 4.5.5.0 - Auslogics Labs Pty Ltd) Bulgarian (Phonetic) by Iliya Dankov (HKLM\...\{57BA3105-8E44-45BD-BB3A-F0BD5EA0575B}) (Version: 1.0.3.13 - ILIYA DANKOV - www.dankov.hit.bg) CCleaner (HKLM\...\CCleaner) (Version: 5.01 - Piriform) Classic FTP (HKLM\...\ClassicFTP) (Version: 2.38 - NCH Software) Counter-Strike 1.6 (HKLM\...\Counter-Strike 1.6) (Version: - ) CyberGhost 5 (HKLM\...\CyberGhost 5_is1) (Version: - CyberGhost S.R.L.) Exterminate It! (HKLM\...\Exterminate It!) (Version: 2.12.08.31 - CURIOLAB S.M.B.A.) FastStone Capture 7.8 (HKLM\...\FastStone Capture) (Version: 7.8 - FastStone Soft) FastStone Image Viewer 5.3 (HKLM\...\FastStone Image Viewer) (Version: 5.3 - FastStone Soft) FileZilla Client 3.9.0.3 (HKLM\...\FileZilla Client) (Version: 3.9.0.3 - Tim Kosse) Glary Utilities 5.8 (HKLM\...\Glary Utilities 5) (Version: 5.8.0.15 - Glarysoft Ltd) Google Chrome (HKLM\...\Google Chrome) (Version: 39.0.2171.95 - Google Inc.) Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden Incomedia WebSite X5 v11 - Home (HKLM\...\{C5743DB8-7BDF-47D3-8D41-0BBD487B48A1}_is1) (Version: 11.0.2.14 - Incomedia s.r.l.) Intel® Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: - ) Internet Download Manager (HKLM\...\Internet Download Manager) (Version: - Tonec Inc.) Java 7 Update 71 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F03217071FF}) (Version: 7.0.710 - Oracle) K-Lite Mega Codec Pack 10.7.1 (HKLM\...\KLiteCodecPack_is1) (Version: 10.7.1 - ) Localphone (HKLM\...\{161F93FE-B8B1-48F2-AE05-994608C50E27}) (Version: 2.2.2 - Localphone Ltd.) LogoMaker 3.1 (HKLM\...\LogoMaker_is1) (Version: - Studio V5) MagicDisc 2.7.106 (HKLM\...\MagicDisc 2.7.106) (Version: - ) Malwarebytes Anti-Malware, версия 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation) Microsoft .NET Framework 2.0 Service Pack 2 (HKLM\...\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}) (Version: 2.2.30729 - Microsoft Corporation) Microsoft .NET Framework 3.0 Service Pack 2 (HKLM\...\{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}) (Version: 3.2.30729 - Microsoft Corporation) Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation) Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation) Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61187 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.7523 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.7523 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 (HKLM\...\{B175520C-86A2-35A7-8619-86DC379688B9}) (Version: 11.0.61030 - Microsoft Corporation) Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 (HKLM\...\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}) (Version: 11.0.61030 - Microsoft Corporation) Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (HKLM\...\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}) (Version: 12.0.21005 - Microsoft Corporation) Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (HKLM\...\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}) (Version: 12.0.21005 - Microsoft Corporation) Mozilla Firefox 34.0.5 (x86 en-US) (HKLM\...\Mozilla Firefox 34.0.5 (x86 en-US)) (Version: 34.0.5 - Mozilla) Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 32.0.2 - Mozilla) MSXML 4.0 SP3 Parser (HKLM\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation) MyFreeCodec (HKU\S-1-5-21-117609710-776561741-1417001333-1003\...\MyFreeCodec) (Version: - ) Nero 8 Micro 8.3.2.1 (HKLM\...\Nero8Lite_is1) (Version: 8.3.2.1 - Updatepack.nl) Photodex Presenter (HKLM\...\Photodex Presenter) (Version: - Photodex Corporation) PokerStars.bg (HKLM\...\PokerStars.bg) (Version: - PokerStars.bg) ProShow Gold (HKLM\...\ProShow Gold) (Version: - Photodex Corporation) Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 5.10.0.5904 - Realtek Semiconductor Corp.) RefreshPC (HKLM\...\RefreshPC_is1) (Version: 2.0 - WareSoft Software) Samsung Kies (HKLM\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.3.14044_17 - Samsung Electronics Co., Ltd.) Samsung Kies (Version: 2.6.3.14044_17 - Samsung Electronics Co., Ltd.) Hidden SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.43.0 - SAMSUNG Electronics Co., Ltd.) Skype™ 6.22 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.22.105 - Skype Technologies S.A.) SoftEther VPN Client (HKLM\...\softether_sevpnclient) (Version: 4.10.9473 - SoftEther VPN Project) Steam (HKLM\...\Steam) (Version: 2.10.91.91 - Valve Corporation) SumatraPDF 3.0 (HKLM\...\SumatraPDF) (Version: 3.0 - Krzysztof Kowalczyk) Temp File Cleaner (HKLM\...\Temp File Cleaner) (Version: 4.4.0 - Addpcs, LLC) User Profile Hive Cleanup Service (HKLM\...\{7D15B945-2725-4443-AB3F-D900556612FE}) (Version: 1.6.36 - Microsoft Corporation) VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN) Voipwise (HKLM\...\Voipwise_is1) (Version: 4.14 build 745 - Finarea S.A. Switzerland) WebFldrs XP (Version: 9.50.7523 - Microsoft Corporation) Hidden Win32DiskImager version 0.9.5 (HKLM\...\{D074CE74-912A-4AD3-A0BF-3937D9D01F17}_is1) (Version: 0.9.5 - ImageWriter Developers) WinRAR 5.11 (32-bit) (HKLM\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH) WinTools.net Premium version 14.0 (HKLM\...\{AA9A6236-EE61-41B7-A7EC-5F4496409D55}_is1) (Version: 14.0 - WinTools Software Engineering, Ltd.) Xara 3D Maker 7 (HKLM\...\MAGIX_MSI_Xara3D7) (Version: 7.0.0.415 - Xara Group Ltd) Xara 3D Maker 7 (Version: 7.0.0.415 - Xara Group Ltd) Hidden Xara Web Designer 10 Premium (HKLM\...\MX.{31EA478F-B78B-415D-9811-94F5E226C73A}) (Version: 10.1.3.35257 - Xara Group Ltd) Xara Web Designer 10 Premium (Version: 10.1.3.35257 - Xara Group Ltd) Hidden Your Uninstaller! 7 (HKLM\...\YU2010_is1) (Version: 7.5.2013.2 - URSoft, Inc.) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) ==================== Restore Points ========================= 17-12-2014 14:54:24 System Checkpoint 19-12-2014 02:29:50 System Checkpoint 20-12-2014 02:43:07 System Checkpoint 28-12-2014 18:21:44 System Checkpoint 29-12-2014 20:25:16 System Checkpoint 30-12-2014 22:11:31 System Checkpoint 31-12-2014 07:05:29 Removed Virtual Machine Network Services Driver 01-01-2015 21:52:01 System Checkpoint 03-01-2015 03:22:12 Installed Minecraft 03-01-2015 13:11:57 Installed CrashPlan 04-01-2015 13:16:02 System Checkpoint 05-01-2015 00:48:23 Removed Minecraft 05-01-2015 00:51:41 Removed CrashPlan ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2008-04-14 14:00 - 2008-04-14 14:00 - 00000734 ____A E:\WINDOWS\system32\Drivers\etc\hosts 127.0.0.1 localhost ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) Task: E:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe Task: E:\WINDOWS\Tasks\Anvi AD Blocker Ultimate.job => E:\Program Files\Anvisoft\Anvi AD Blocker Ultimate\adblocker2.exe Task: E:\WINDOWS\Tasks\FlingSevenDays.job => E:\Program Files\NCH Software\Fling\fling.exe Task: E:\WINDOWS\Tasks\GlaryInitialize 5.job => E:\Program Files\Glary Utilities 5\Initialize.exe Task: E:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => E:\Program Files\Google\Update\GoogleUpdate.exe Task: E:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => E:\Program Files\Google\Update\GoogleUpdate.exe Task: E:\WINDOWS\Tasks\User_Feed_Synchronization-{28E14D98-3938-4F39-A46A-0C98F66DE9A8}.job => E:\WINDOWS\system32\msfeedssync.exe ==================== Loaded Modules (whitelisted) ============= 2014-09-03 19:47 - 2014-09-03 19:47 - 00094208 _____ () E:\Program Files\NCH Software\Fling\fldll.dll 2014-08-13 16:09 - 2014-08-13 16:09 - 00035328 _____ () E:\Program Files\FileZilla FTP Client\fzshellext.dll 2014-05-24 18:41 - 2014-05-24 18:41 - 00091648 _____ () E:\Program Files\FileZilla FTP Client\libgcc_s_sjlj-1.dll 2014-05-24 18:41 - 2014-05-24 18:41 - 00892416 _____ () E:\Program Files\FileZilla FTP Client\libstdc++-6.dll 2013-08-22 15:39 - 2013-08-22 15:39 - 01046016 _____ () E:\Program Files\Localphone Ltd\Localphone\Localphone_mod.exe 2014-09-25 09:29 - 2014-09-25 09:29 - 01967616 _____ () E:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Kies.UI\c8570e2cce957aa089060ce810aec717\Kies.UI.ni.dll 2014-09-25 09:29 - 2014-09-25 09:29 - 00079360 _____ () E:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Kies.MVVM\d57780faf2868d5a0157ba787d05caf5\Kies.MVVM.ni.dll 2014-09-25 09:29 - 2014-09-25 09:29 - 00189952 _____ () E:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Kies.Common.DeviceS#\4a4528625f7778e70997dd97a5c62d5f\Kies.Common.DeviceServiceLib.Interface.ni.dll 2014-09-25 09:31 - 2014-09-25 09:31 - 00363008 _____ () E:\WINDOWS\assembly\NativeImages_v4.0.30319_32\DevicePhoto\cf1d72955a588b1310c5b5bc5eb8e293\DevicePhoto.ni.dll 2014-09-25 09:31 - 2014-09-25 09:31 - 00296960 _____ () E:\WINDOWS\assembly\NativeImages_v4.0.30319_32\DeviceVideo\78df13b8986e93a645f3d561a42b2ac2\DeviceVideo.ni.dll 2014-09-25 09:31 - 2014-09-25 09:31 - 00613376 _____ () E:\WINDOWS\assembly\NativeImages_v4.0.30319_32\DevicePodcast\a82eeeb032294884e498eff1fcf14c9d\DevicePodcast.ni.dll 2014-09-25 09:31 - 2014-09-25 09:31 - 00307200 _____ () E:\WINDOWS\assembly\NativeImages_v4.0.30319_32\DummyStorePlugin\ff9f65cb1cbd9cf0938ee8d507541d88\DummyStorePlugin.ni.dll 2014-09-25 09:31 - 2014-09-25 09:31 - 14994944 _____ () E:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Kies.Theme\7e48e15df434ee8b79b38730bc6a39f1\Kies.Theme.ni.dll 2014-09-25 09:30 - 2014-09-25 09:30 - 00583168 _____ () E:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Kies.Common.DeviceS#\5a9202b7484c6c8b358d6e72ea178086\Kies.Common.DeviceServiceLib.FileService.ni.dll 2014-09-25 09:29 - 2014-09-25 09:29 - 00046592 _____ () E:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Kies.Common.DeviceS#\626bf1dc8c37911ae8d26fbec00ca29c\Kies.Common.DeviceServiceLib.FirmwareUpdate.FirmwareUpdateAgentHelper.ni.dll 2014-09-25 09:30 - 2014-09-25 09:30 - 01005056 _____ () E:\WINDOWS\assembly\NativeImages_v4.0.30319_32\DeviceCommonLib\6b145c04f8df85e5f4c1e8b626c1094d\DeviceCommonLib.ni.dll 2014-09-25 09:30 - 2014-09-25 09:30 - 00232448 _____ () E:\WINDOWS\assembly\NativeImages_v4.0.30319_32\ASF_cSharpAPI\a22bd0576d0a8ed359f8dd1e3116e43d\ASF_cSharpAPI.ni.dll 2014-12-09 22:09 - 2014-12-09 22:09 - 00186760 _____ () E:\Program Files\Photodex\ProShow Gold\ScsiAccess.exe 2008-04-14 14:00 - 2008-04-14 14:00 - 00059904 _____ () E:\WINDOWS\system32\devenum.dll 2008-04-14 14:00 - 2008-04-14 14:00 - 00014336 _____ () E:\WINDOWS\system32\msdmo.dll 2014-12-31 07:07 - 2014-12-06 03:50 - 09009480 _____ () E:\Program Files\Google\Chrome\Application\39.0.2171.95\pdf.dll 2014-12-31 07:07 - 2014-12-06 03:50 - 01677128 _____ () E:\Program Files\Google\Chrome\Application\39.0.2171.95\ffmpegsumo.dll 2014-12-31 07:07 - 2014-12-06 03:50 - 14913352 _____ () E:\Program Files\Google\Chrome\Application\39.0.2171.95\PepperFlash\pepflashplayer.dll 2014-12-31 07:45 - 2014-02-10 12:44 - 04592128 _____ () E:\Documents and Settings\Admin\Local Settings\Application Data\Google\Chrome\User Data\SwiftShader\3.2.6.45159\libglesv2.dll 2014-12-31 07:45 - 2014-02-10 12:44 - 00112128 _____ () E:\Documents and Settings\Admin\Local Settings\Application Data\Google\Chrome\User Data\SwiftShader\3.2.6.45159\libegl.dll ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) AlternateDataStreams: E:\Documents and Settings\All Users\Application Data\TEMP:1CE11B51 ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SMPCHelper => ""="" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\tvnserver => ""="" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver" ==================== EXE Association (whitelisted) ============= (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== MSCONFIG/TASK MANAGER disabled items ========= (Currently there is no automatic fix for this section.) ========================= Accounts: ========================== Admin (S-1-5-21-117609710-776561741-1417001333-1003 - Administrator - Enabled) => %SystemDrive%\Documents and Settings\Admin Administrator (S-1-5-21-117609710-776561741-1417001333-500 - Administrator - Enabled) => %SystemDrive%\Documents and Settings\Administrator ASPNET (S-1-5-21-117609710-776561741-1417001333-1004 - Limited - Enabled) Guest (S-1-5-21-117609710-776561741-1417001333-501 - Limited - Disabled) HelpAssistant (S-1-5-21-117609710-776561741-1417001333-1000 - Limited - Disabled) SUPPORT_388945a0 (S-1-5-21-117609710-776561741-1417001333-1002 - Limited - Disabled) ==================== Faulty Device Manager Devices ============= Name: Description: Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. Name: VPN Client Adapter - VPN Description: VPN Client Adapter - VPN Class Guid: {4D36E972-E325-11CE-BFC1-08002BE10318} Manufacturer: SoftEther VPN Project Service: Neo_VPN Problem: : A driver (service) for this device has been disabled. An alternate driver may be providing this functionality (Code 32) Resolution: The start type for this driver is set to disabled in the registry. Uninstall the driver from Device Manager, and then scan for new hardware to install the driver again. If this does not work, you might have to change the device start type parameter in the registry. ==================== Event log errors: ========================= Application errors: ================== Error: (01/05/2015 02:29:27 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application xara_web_designer_10_premium_32bit_en-gb_setup.exe, version 3.5.5262.0, faulting module xara_web_designer_10_premium_32bit_en-gb_setup.exe, version 3.5.5262.0, fault address 0x00146580. Processing media-specific event for [xara_web_designer_10_premium_32bit_en-gb_setup.exe!ws!] Error: (01/05/2015 02:26:25 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application xara_web_designer_9_premium_32bit_en-gb_setup.exe, version 3.4.4879.0, faulting module xara_web_designer_9_premium_32bit_en-gb_setup.exe, version 3.4.4879.0, fault address 0x000dde3d. Processing media-specific event for [xara_web_designer_9_premium_32bit_en-gb_setup.exe!ws!] Error: (12/29/2014 07:55:01 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application okayfreedomclient.exe, version 1.4.1.11192, faulting module okayfreedomclient.exe, version 1.4.1.11192, fault address 0x00031970. Processing media-specific event for [okayfreedomclient.exe!ws!] Error: (12/29/2014 07:21:46 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application svchost.exe, version 5.1.2600.5512, faulting module netman.dll, version 5.1.2600.5512, fault address 0x0000c6bd. Processing media-specific event for [svchost.exe!ws!] Error: (12/29/2014 07:13:59 PM) (Source: MsiInstaller) (EventID: 11706) (User: UNKNOWN-8383362) Description: Product: ESET NOD32 Antivirus -- Грешка 1706. Инсталационен пакет за продукт ESET NOD32 Antivirus не може да се намери. Опитайте отново да инсталирате, като използвате валидно копие на инсталационен пакет 'NUP48B7.msi'. Error: (12/29/2014 07:08:15 PM) (Source: MsiInstaller) (EventID: 11706) (User: UNKNOWN-8383362) Description: Product: ESET NOD32 Antivirus -- Грешка 1706. Инсталационен пакет за продукт ESET NOD32 Antivirus не може да се намери. Опитайте отново да инсталирате, като използвате валидно копие на инсталационен пакет 'NUP48B7.msi'. Error: (12/29/2014 02:42:38 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application okayfreedomclient.exe, version 1.4.0.11115, faulting module okayfreedomclient.exe, version 1.4.0.11115, fault address 0x00225651. Processing media-specific event for [okayfreedomclient.exe!ws!] Error: (12/01/2014 03:42:39 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application skype.exe, version 6.22.81.105, faulting module skype.exe, version 6.22.81.105, fault address 0x0019a76a. Processing media-specific event for [skype.exe!ws!] Error: (11/30/2014 01:54:54 AM) (Source: MsiInstaller) (EventID: 11260) (User: UNKNOWN-8383362) Description: Продукт: Skype™ 6.21 -- Грешка 1260. Windows cannot open this program because it has been prevented by a software restriction policy. For more information, open Event Viewer or contact your system administrator. (NULL)(NULL)(NULL)(NULL) Error: (11/29/2014 00:20:54 PM) (Source: MsiInstaller) (EventID: 11260) (User: UNKNOWN-8383362) Description: Продукт: Skype™ 6.21 -- Грешка 1260. Windows cannot open this program because it has been prevented by a software restriction policy. For more information, open Event Viewer or contact your system administrator. (NULL)(NULL)(NULL)(NULL) System errors: ============= Error: (01/04/2015 03:52:35 AM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: The CrashPlan Backup Service service terminated unexpectedly. It has done this 1 time(s). Error: (12/29/2014 08:32:59 PM) (Source: Dhcp) (EventID: 1002) (User: ) Description: The IP address lease 192.168.1.101 for the Network Card with network address 90E6BAE23CE5 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). Error: (12/29/2014 07:24:32 PM) (Source: Service Control Manager) (EventID: 7024) (User: ) Description: The Background Intelligent Transfer Service service terminated with service-specific error 2147500037 (0x80004005). Error: (12/29/2014 07:24:31 PM) (Source: Service Control Manager) (EventID: 7032) (User: ) Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Management Instrumentation service, but this action failed with the following error: %%1056 Error: (12/29/2014 07:22:50 PM) (Source: Service Control Manager) (EventID: 7032) (User: ) Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Management Instrumentation service, but this action failed with the following error: %%1056 Error: (12/29/2014 02:17:41 AM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: The ESET Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service. Error: (12/28/2014 07:06:02 PM) (Source: Dhcp) (EventID: 1000) (User: ) Description: Your computer has lost the lease to its IP address 192.168.1.100 on the Network Card with network address 90E6BAE23CE5. Error: (12/28/2014 06:07:14 PM) (Source: Print) (EventID: 54) (User: NT AUTHORITY) Description: Document D:\Разписание Автобуси.pdf was corrupted and has been deleted. The associated driver is: Generic / Text Only. Error: (12/20/2014 01:05:10 AM) (Source: WPDMTPDriver) (EventID: 15300) (User: ) Description: MTP WPD Driver has failed to start. Error 0x8007001f. Error: (12/19/2014 02:13:51 AM) (Source: Dhcp) (EventID: 1002) (User: ) Description: The IP address lease 192.168.1.100 for the Network Card with network address 90E6BAE23CE5 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). Microsoft Office Sessions: ========================= Error: (01/05/2015 02:29:27 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: xara_web_designer_10_premium_32bit_en-gb_setup.exe3.5.5262.0xara_web_designer_10_premium_32bit_en-gb_setup.exe3.5.5262.000146580 Error: (01/05/2015 02:26:25 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: xara_web_designer_9_premium_32bit_en-gb_setup.exe3.4.4879.0xara_web_designer_9_premium_32bit_en-gb_setup.exe3.4.4879.0000dde3d Error: (12/29/2014 07:55:01 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: okayfreedomclient.exe1.4.1.11192okayfreedomclient.exe1.4.1.1119200031970 Error: (12/29/2014 07:21:46 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: svchost.exe5.1.2600.5512netman.dll5.1.2600.55120000c6bd Error: (12/29/2014 07:13:59 PM) (Source: MsiInstaller) (EventID: 11706) (User: UNKNOWN-8383362) Description: Product: ESET NOD32 Antivirus -- Грешка 1706. Инсталационен пакет за продукт ESET NOD32 Antivirus не може да се намери. Опитайте отново да инсталирате, като използвате валидно копие на инсталационен пакет 'NUP48B7.msi'.(NULL)(NULL)(NULL)(NULL) Error: (12/29/2014 07:08:15 PM) (Source: MsiInstaller) (EventID: 11706) (User: UNKNOWN-8383362) Description: Product: ESET NOD32 Antivirus -- Грешка 1706. Инсталационен пакет за продукт ESET NOD32 Antivirus не може да се намери. Опитайте отново да инсталирате, като използвате валидно копие на инсталационен пакет 'NUP48B7.msi'.(NULL)(NULL)(NULL)(NULL) Error: (12/29/2014 02:42:38 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: okayfreedomclient.exe1.4.0.11115okayfreedomclient.exe1.4.0.1111500225651 Error: (12/01/2014 03:42:39 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: skype.exe6.22.81.105skype.exe6.22.81.1050019a76a Error: (11/30/2014 01:54:54 AM) (Source: MsiInstaller) (EventID: 11260) (User: UNKNOWN-8383362) Description: Продукт: Skype™ 6.21 -- Грешка 1260. Windows cannot open this program because it has been prevented by a software restriction policy. For more information, open Event Viewer or contact your system administrator. (NULL)(NULL)(NULL)(NULL) Error: (11/29/2014 00:20:54 PM) (Source: MsiInstaller) (EventID: 11260) (User: UNKNOWN-8383362) Description: Продукт: Skype™ 6.21 -- Грешка 1260. Windows cannot open this program because it has been prevented by a software restriction policy. For more information, open Event Viewer or contact your system administrator. (NULL)(NULL)(NULL)(NULL) ==================== Memory info =========================== Processor: Intel® Celeron® CPU E3300 @ 2.50GHz Percentage of memory in use: 73% Total physical RAM: 3062.11 MB Available physical RAM: 815.31 MB Total Pagefile: 4948.18 MB Available Pagefile: 2488.16 MB Total Virtual: 2047.88 MB Available Virtual: 1928.16 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:55.1 GB) (Free:26.47 GB) NTFS ==>[Drive with boot components (Windows XP)] Drive d: () (Fixed) (Total:48.83 GB) (Free:29.87 GB) NTFS Drive e: () (Fixed) (Total:15.27 GB) (Free:1.2 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 153.4 GB) (Disk ID: 00000001) Partition 1: (Not Active) - (Size=29.8 GB) - (Type=83) Partition 2: (Not Active) - (Size=53.2 GB) - (Type=OF Extended) Partition 3: (Active) - (Size=55.1 GB) - (Type=07 NTFS) Partition 4: (Not Active) - (Size=15.3 GB) - (Type=07 NTFS) ==================== End Of Log ============================
  24. Здравейте, от 1 година и нещо сигурно лаптопът ми вече не работи така както работеше преди. Имам следната машина : Dell XPS 1645 снимка 1 / снимка 2. Вярно, че вече е на 4г и малко, ама с тази конфигурация мисля, че трябва да си върви като пушка все още (ползвам Windows 7 SP1 EN (MSDN-TechNet) [12.05.2011 New ISO files] - чиста версия от замунда). В какво се изразява бавенето. Малко е сложно, но ще се опитам да го обесня. Често лагва за секунда като мърдам икона от десктопа, бави при всякакви действия - отваряне на My Computer, папки, кликане по разни опции или сайтове. Случвало ми се е (не знам от какво се дължи), пускам филм и след няколко минути започва да насича през няколко секунди. Рестартирам, спирам всичко което върви, спирам нета и пак.Пробвам с KMPlayer, BSPlayer, VLC, + още 1/2. Не съм гледал логовете, които събрах дали имат информация за драйвовете ми, но не мисля, че е от тях. Защото всеки път като го преинсталирам, първо инсталирам основните за да работи машината и после с програми като "Driver Genius" намирам нови версии на всички драйвери (внимавам и какво инсталирам, защото по някога предлага разни неща, които са ненужни). Последният път, тъй като не можах да открия работеща кракната версия на горепосочената програма, ползвах още 1-2 + онлайн сайт, който прави същото и което не успявах да изтегля, го търсех по версия на драйвера в google и намерих почти всички до последни версии, като изключим някакви части от драйверите за chipset-а, тъй като не успях, моите бяха много стари и update-нах някои от тях, но не успях всички. Когато го преинсталирам, се държи доста по-добре. Смених му пастата на процесора с някаква доста хубава уж (10-12лв струваше), но това беше преди година и нещо, сега трябва да я сменям пак. Защото като цяло лаптопа има проблем с температурата. Ако не правя почти нищо, държи 60 градуса. Забелязал съм, че като вдигне 75+ и започва да работи по бавно, но това е нормално и гледам да не го държа дълго време на 80 градуса, защото не е хубаво. Тук имам един въпрос, освен пастата на процесора, има ли паста на видеото, която се сменя? Не знам, дали ще има голяма разлика, ако се разглоби целият и се почисти, защото аз чистя само под задният капак - вентилатор, радиатор и пастата както споменах вече. Работя в ИТ сферата и принципно се пазя доста добре да не пипна нещо. Процесорът не се товари излишно, ако забие на 20/20+ процента, повечето пъти нещо е забило, защото аз му давам постоянно Sleep и след рестарт се оправя. Рам паметта си ползва нормално около 60/70%. Понякога работи доста добре, сега примерно уж става. Имам чувството, че като зареди всичко в паметта си ли не знам и работи по-добре. Но като цяло няма нищо общо с това, което беше преди. И това се случи изведнъж си спомням, мислех че като го преинсталирам ще се оправи ама вече не е същият, знам че остарява ама с тези спецификации не мисля, че трябва да създава все още проблеми, рано е! Правил съм му всевъзможни тестове на хардуера с Hirens.BootCD.14.0 и с Dell Online Tools. Хард диска, има известно количество "сиви" сектори, с по-висок response, но нямах никакви критични. Рам-а ми не намира никакви грешки по-нея. Видео показва ОК, процесора показва ОК. Не знам, чудя си да не би да има бъгави драйвери, ама аз всеки път гледам да ги обновявам, за този модел малко трудно се намира всичко up to date, което ти трябва ама уж горе долу се справям. Последно е преинсталиран преди 1 година, сега скоро пак мисля да го правя, просто нямам време сега. Не знам, дали е заразен с нещо ама вие ще видите. Като цяло това ми е проблемът, надявам се да съм го обяснил добре и да съм дал подробности, които могат да ви помогнат. Ако имате някакви други въпроси, питайте. Не разполагам с компакт диск за операционната система. Ето нужните логове и файлове: Единственото, в което съм сигурен, повтавям се, но лаптопа определено не работи толкова бързо, колкото трябва да работи. Дори да се окаже, че не е заразен, може все пак да се опитате да ми помогнете за да го "оправя". Мога да направя какво кажете, имам опит и ще се справя. Само ми трябват съвети и стъпки... Благодаря ви предварително! Addition.txt Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-01-2015 Ran by Sevi (administrator) on SEVI-PC on 06-01-2015 13:23:28 Running from C:\Users\Sevi\Downloads Loaded Profile: Sevi (Available profiles: Sevi) Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: English (United States) Internet Explorer Version 8 (Default browser: Chrome) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2015\vsserv.exe (AMD) C:\Windows\System32\atiesrxx.exe (IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\stacsv64.exe (Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\AESTSr64.exe (Broadcom Corporation) C:\Program Files\Broadcom\MgmtAgent\BrcmMgmtAgent.exe (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe (AMD) C:\Windows\System32\atieclxx.exe (Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (StarWind Software) C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (ClientConnect Ltd.) C:\Program Files (x86)\Tbccint\ToolbarService\ToolbarService.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe (Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2015\updatesrv.exe (VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe (Intel® Corporation) C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe (Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe (Red Bend Ltd.) C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe (Logitech, Inc.) C:\Program Files\Logitech\FlowScroll\KhalScroll.exe (Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2015\bdagent.exe (AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2015\bdwtxag.exe (Spotify Ltd) C:\Users\Sevi\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2015\antispam32\bdwtxapps.exe (Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe () C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe (Intel® Corporation) C:\Program Files\Intel\WiMAX\Bin\WiMAXCU.exe (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe (AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe (Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (uWebb Software) E:\instal\RealTemp CPU\RealTemp.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [synTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2097960 2010-04-22] (Synaptics Incorporated) HKLM\...\Run: [intelWirelessWiMAX] => C:\Program Files\Intel\WiMAX\Bin\WiMAXCU.exe [1437696 2009-09-16] (Intel® Corporation) HKLM\...\Run: [iAStorIcon] => C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [287592 2014-04-24] (Intel Corporation) HKLM\...\Run: [sysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [444416 2009-06-29] (IDT, Inc.) HKLM\...\Run: [LogiScrollApp] => C:\Program Files\Logitech\FlowScroll\KhalScroll.exe [166680 2012-02-08] (Logitech, Inc.) HKLM\...\Run: [bdagent] => C:\Program Files\Bitdefender\Bitdefender 2015\bdagent.exe [1686480 2014-12-18] (Bitdefender) HKLM-x32\...\Run: [startCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767200 2014-04-17] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation) HKU\S-1-5-21-3981290476-163095377-932653693-1000\...\Run: [HydraVisionDesktopManager] => C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [1967616 2014-04-17] (AMD) HKU\S-1-5-21-3981290476-163095377-932653693-1000\...\Run: [] => [X] HKU\S-1-5-21-3981290476-163095377-932653693-1000\...\Run: [bitdefender Wallet Agent] => C:\Program Files\Bitdefender\Bitdefender 2015\bdwtxag.exe [790880 2014-12-18] (Bitdefender) HKU\S-1-5-21-3981290476-163095377-932653693-1000\...\Run: [spotify Web Helper] => C:\Users\Sevi\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1514040 2014-12-01] (Spotify Ltd) HKU\S-1-5-21-3981290476-163095377-932653693-1000\...\MountPoints2: {3c1b39ee-7406-11e4-868a-c44619f712e3} - H:\LG_PC_Programs.exe Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = HKU\S-1-5-21-3981290476-163095377-932653693-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKU\S-1-5-21-3981290476-163095377-932653693-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp URLSearchHook: HKLM-x32 - BS Player ControlBar B Toolbar - {31264a33-a653-46c4-af49-1232c59a7da5} - C:\Users\Sevi\AppData\LocalLow\BS_Player_ControlBar_B\prxtbBS_P.dll (ClientConnect Ltd.) URLSearchHook: HKU\S-1-5-21-3981290476-163095377-932653693-1000 - BS Player ControlBar B Toolbar - {31264a33-a653-46c4-af49-1232c59a7da5} - C:\Users\Sevi\AppData\LocalLow\BS_Player_ControlBar_B\prxtbBS_P.dll (ClientConnect Ltd.) StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKU\S-1-5-21-3981290476-163095377-932653693-1000 -> {4A54C3F9-60BE-4043-9C41-D15135B3043A} URL = http://trovi.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3329621&CUI=UN10073048019830656&UM=4 BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Logitech Flow Scroll -> {E11DB59D-5008-42ff-9069-535843BC0BE1} -> C:\Program Files\Logitech\FlowScroll\LogiSmooth.dll (Logitech, Inc.) BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: BS Player ControlBar B Toolbar -> {31264a33-a653-46c4-af49-1232c59a7da5} -> C:\Users\Sevi\AppData\LocalLow\BS_Player_ControlBar_B\prxtbBS_P.dll (ClientConnect Ltd.) BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: Logitech Flow Scroll -> {E11DB59D-5008-42ff-9069-535843BC0BE1} -> C:\Program Files\Logitech\FlowScroll\32-bit\LogiSmooth.dll (Logitech, Inc.) Toolbar: HKLM - Bitdefender Wallet - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender 2015\pmbxie.dll (Bitdefender) Toolbar: HKLM-x32 - BS Player ControlBar B Toolbar - {31264a33-a653-46c4-af49-1232c59a7da5} - C:\Users\Sevi\AppData\LocalLow\BS_Player_ControlBar_B\prxtbBS_P.dll (ClientConnect Ltd.) Toolbar: HKLM-x32 - Bitdefender Wallet - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender 2015\Antispam32\pmbxie.dll (Bitdefender) Tcpip\Parameters: [DhcpNameServer] 212.39.90.42 8.8.8.8 Tcpip\..\Interfaces\{9C778036-EB12-4176-A2FA-BB78F8EA0FEB}: [NameServer] 156.154.70.25,156.154.71.25 Tcpip\..\Interfaces\{DBC04094-1912-4E1A-A560-D99B8213A79E}: [NameServer] 156.154.70.25,156.154.71.25 FireFox: ======== FF ProfilePath: C:\Users\Sevi\AppData\Roaming\Mozilla\Firefox\Profiles\z58sx735.default FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll () FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll () FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @nokia.com/EnablerPlugin -> C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( ) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll (Nullsoft, Inc.) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\911bg.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\diribg.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\pe-bg.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\portalbgdict.xml FF Extension: BS Player ControlBar B - C:\Users\Sevi\AppData\Roaming\Mozilla\Firefox\Profiles\z58sx735.default\Extensions\{31264a33-a653-46c4-af49-1232c59a7da5} [2014-09-16] FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt FF HKLM-x32\...\Firefox\Extensions: [{5D3F3872-91E9-4d59-AD9F-AA174A3145DD}] - C:\Program Files\Logitech\FlowScroll\LogiSmoothFirefoxExt FF Extension: Logitech Flow Scroll - C:\Program Files\Logitech\FlowScroll\LogiSmoothFirefoxExt [2014-08-18] FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files\Bitdefender\Bitdefender 2015\antispam32\bdwteff FF Extension: Bitdefender Wallet - C:\Program Files\Bitdefender\Bitdefender 2015\antispam32\bdwteff [2014-09-18] Chrome: ======= CHR Profile: C:\Users\Sevi\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Документи) - C:\Users\Sevi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-08-16] CHR Extension: (Google Диск) - C:\Users\Sevi\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-16] CHR Extension: (YouTube) - C:\Users\Sevi\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-08-16] CHR Extension: (Adblock за Youtube™) - C:\Users\Sevi\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmedhionkhpnakcndndgjdbohmhepckk [2014-09-21] CHR Extension: (Google Търсене) - C:\Users\Sevi\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-08-16] CHR Extension: (Logitech Flow Scroll) - C:\Users\Sevi\AppData\Local\Google\Chrome\User Data\Default\Extensions\geooogfhpjdpeiphckpbgkhpbeobcaoi [2014-08-18] CHR Extension: (Google Wallet) - C:\Users\Sevi\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-16] CHR Extension: (Gmail) - C:\Users\Sevi\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-16] CHR HKLM-x32\...\Chrome\Extension: [fabcmochhfpldjekobfaaggijgohadih] - No Path CHR HKLM-x32\...\Chrome\Extension: [geooogfhpjdpeiphckpbgkhpbeobcaoi] - C:\ProgramData\Logitech\LogiSmoothChromeExt.crx [2014-08-18] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\AESTSr64.exe [89600 2009-03-02] (Andrea Electronics Corporation) R2 BrcmMgmtAgent; C:\Program Files\Broadcom\MgmtAgent\BrcmMgmtAgent.exe [204288 2012-08-02] (Broadcom Corporation) [File not signed] R2 DMAgent; C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe [403456 2009-09-15] (Red Bend Ltd.) [File not signed] R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2014-04-24] (Intel Corporation) S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-07-17] () R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [186056 2013-10-16] (Sandboxie Holdings, LLC) R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\STacSV64.exe [240128 2009-06-29] (IDT, Inc.) R2 StarWindServiceAE; C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [370688 2009-12-23] (StarWind Software) [File not signed] R2 TBSrv; C:\Program Files (x86)\Tbccint\ToolbarService\ToolbarService.exe [350528 2014-04-10] (ClientConnect Ltd.) R2 UPDATESRV; C:\Program Files\Bitdefender\Bitdefender 2015\updatesrv.exe [67320 2014-11-13] (Bitdefender) R2 VMwareHostd; C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe [14407384 2014-06-12] () R2 vsserv; C:\Program Files\Bitdefender\Bitdefender 2015\vsserv.exe [1545376 2014-12-18] (Bitdefender) R2 WiMAXAppSrv; C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe [907264 2009-09-15] (Intel® Corporation) [File not signed] R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3377904 2013-07-17] (Intel® Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R0 amdkmafd; C:\Windows\System32\DRIVERS\amdkmafd.sys [21600 2013-03-14] (Advanced Micro Devices, Inc.) S3 andnetadb; C:\Windows\System32\Drivers\lgandnetadb.sys [31744 2014-03-28] (Google Inc) S3 AndnetBus; C:\Windows\System32\DRIVERS\lgandnetbus64.sys [19456 2014-05-08] (LG Electronics Inc.) S3 AndNetDiag; C:\Windows\System32\DRIVERS\lgandnetdiag64.sys [29184 2014-03-28] (LG Electronics Inc.) S3 ANDNetModem; C:\Windows\System32\DRIVERS\lgandnetmodem64.sys [36352 2014-03-28] (LG Electronics Inc.) R0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [1288472 2014-11-13] (BitDefender) S3 avchv; C:\Windows\System32\DRIVERS\avchv.sys [263032 2014-11-13] (BitDefender) S3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [647752 2014-09-18] (BitDefender) R1 bdfwfpf; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [107080 2012-10-29] (BitDefender LLC) S3 BDSandBox; C:\Windows\system32\drivers\bdsandbox.sys [82824 2014-12-18] (BitDefender SRL) R0 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [155912 2014-12-18] (BitDefender LLC) R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2014-04-24] (Intel Corporation) R0 MxEFUF; C:\Windows\System32\DRIVERS\MxEFUF64.sys [157696 2011-10-20] (Matrox Graphics Inc.) R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [200552 2013-10-16] (Sandboxie Holdings, LLC) R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [45296 2014-07-28] (Synaptics Incorporated) R0 sptd; C:\Windows\System32\Drivers\sptd.sys [503352 2014-08-18] () [File not signed] R0 trufos; C:\Windows\System32\DRIVERS\trufos.sys [452040 2014-11-13] (BitDefender S.R.L.) R0 vsock; C:\Windows\System32\drivers\vsock.sys [73296 2013-10-08] (VMware, Inc.) R2 vstor2-mntapi20-shared; C:\Windows\SysWow64\drivers\vstor2-mntapi20-shared.sys [33872 2013-02-22] (VMware, Inc.) R3 WinRing0_1_2_0; E:\instal\RealTemp CPU\WinRing0x64.sys [14544 2008-07-26] (OpenLibSys.org) R3 ZCLDRV; C:\Windows\System32\DRIVERS\ZclDrv64.sys [71680 2013-06-27] (TechnoScope Co., Ltd.) U3 ad72e05o; C:\Windows\System32\Drivers\ad72e05o.sys [0 ] (Intel Corporation) S3 cpudrv64; \??\C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys [X] S3 cpuz136; \??\C:\Users\Sevi\AppData\Local\Temp\cpuz136\cpuz136_x64.sys [X] S3 VGPU; System32\drivers\rdvgkmd.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-06 13:23 - 2015-01-06 13:24 - 00020526 _____ () C:\Users\Sevi\Downloads\FRST.txt 2015-01-06 13:23 - 2015-01-06 13:23 - 00000000 ____D () C:\FRST 2015-01-06 13:22 - 2015-01-06 13:22 - 02123776 _____ (Farbar) C:\Users\Sevi\Downloads\FRST64.exe 2015-01-05 02:45 - 2015-01-05 02:45 - 00001043 _____ () C:\Users\Sevi\Desktop\DiskCheckup.lnk 2015-01-05 02:45 - 2015-01-05 02:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DiskCheckup 2015-01-05 02:45 - 2015-01-05 02:45 - 00000000 ____D () C:\Program Files (x86)\DiskCheckup 2015-01-05 02:44 - 2015-01-05 02:44 - 01316496 _____ (PassMark Software ) C:\Users\Sevi\Downloads\diskcheckup.exe 2014-12-28 18:43 - 2014-12-28 18:43 - 00028867 _____ () C:\Users\Sevi\Downloads\the.equalizer.2014.bdrip.x264-sparks(subsunacs.net).rar 2014-12-28 18:42 - 2014-12-28 18:42 - 00030776 _____ () C:\Users\Sevi\Downloads\The.Equalizer.2014.720p.BRRip.x264.AAC-NESMEURED.torrent 2014-12-28 16:06 - 2014-12-28 16:42 - 00000000 ____D () C:\Users\Sevi\Desktop\Maceo Plex 2014-12-28 16:02 - 2014-12-28 16:03 - 98439121 _____ () C:\Users\Sevi\Downloads\Снимки_свалени_от_AirDroid.zip 2014-12-28 16:00 - 2014-12-28 16:16 - 2197545190 _____ () C:\Users\Sevi\Downloads\camera-multi.zip 2014-12-26 02:25 - 2014-12-26 02:25 - 00033850 _____ () C:\Users\Sevi\Downloads\Gone.Girl.2014.720p.BluRay.x264-DAA.mkv.torrent 2014-12-18 14:40 - 2014-12-18 14:40 - 00000000 ____D () C:\Users\Sevi\Desktop\songs 2014-12-18 03:04 - 2014-12-18 03:04 - 00155912 _____ (BitDefender LLC) C:\Windows\system32\Drivers\gzflt.sys 2014-12-18 03:03 - 2014-12-18 03:03 - 00084336 _____ (BitDefender SRL) C:\Windows\system32\bdsandboxuiskin.dll 2014-12-18 03:03 - 2014-12-18 03:03 - 00033360 _____ (BitDefender SRL) C:\Windows\system32\bdsandboxuh.dll 2014-12-10 04:10 - 2014-12-10 04:10 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-12-07 17:59 - 2015-01-05 04:14 - 00000000 ____D () C:\Users\Sevi\Desktop\Instagram 2014-12-07 17:59 - 2014-12-07 18:00 - 00000000 ____D () C:\Users\Sevi\Desktop\Viber Images 2014-12-07 17:57 - 2014-12-07 17:58 - 00000000 ____D () C:\Users\Sevi\Desktop\100MSDCF 2014-12-07 17:37 - 2014-12-07 17:37 - 00000000 ____D () C:\Users\Sevi\Desktop\Camera ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-06 13:16 - 2014-08-18 04:48 - 00000000 ____D () C:\Users\Sevi\AppData\Roaming\Skype 2015-01-06 12:34 - 2014-08-16 19:15 - 00348448 _____ () C:\Windows\WindowsUpdate.log 2015-01-05 04:16 - 2014-11-27 18:44 - 00000000 ____D () C:\Users\Sevi\Desktop\Wondershare_MobileTrans_4.2.0.Keygen.tPORt 2015-01-05 03:41 - 2014-08-16 20:22 - 00000998 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-01-05 02:28 - 2014-08-16 20:22 - 00000994 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-01-01 17:22 - 2014-10-29 18:21 - 00000000 ___RD () C:\Program Files (x86)\Skype 2015-01-01 17:22 - 2014-08-16 22:23 - 00000000 ____D () C:\ProgramData\Skype 2014-12-29 03:50 - 2014-12-01 13:31 - 00000000 ____D () C:\Users\Sevi\AppData\Roaming\Spotify 2014-12-28 23:24 - 2014-08-16 20:38 - 00000000 ____D () C:\Users\Sevi\AppData\Roaming\uTorrent 2014-12-28 16:41 - 2014-08-18 05:05 - 00000000 ____D () C:\Users\Sevi\AppData\Roaming\vlc 2014-12-28 15:59 - 2009-07-14 07:13 - 00787326 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-12-28 15:58 - 2009-07-14 06:45 - 00026352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-12-28 15:58 - 2009-07-14 06:45 - 00026352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-12-28 15:51 - 2014-08-18 14:13 - 00000000 ____D () C:\ProgramData\VMware 2014-12-28 15:51 - 2014-08-17 02:28 - 00000050 _____ () C:\Windows\system32\SupplicantTest.log 2014-12-28 15:50 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-12-28 15:50 - 2009-07-14 06:51 - 00046215 _____ () C:\Windows\setupact.log 2014-12-25 12:01 - 2014-08-20 01:08 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-12-25 12:01 - 2014-08-20 01:08 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-12-25 12:01 - 2014-08-18 05:16 - 00000000 ____D () C:\Users\Sevi\AppData\Local\Adobe 2014-12-19 11:30 - 2014-12-01 13:32 - 00000000 ____D () C:\Users\Sevi\AppData\Local\Spotify 2014-12-19 10:59 - 2014-09-30 01:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-12-19 10:59 - 2010-11-21 05:47 - 00034850 _____ () C:\Windows\PFRO.log 2014-12-18 03:02 - 2014-09-18 01:16 - 00082824 _____ (BitDefender SRL) C:\Windows\system32\Drivers\bdsandbox.sys 2014-12-18 03:01 - 2014-08-16 20:35 - 00074000 _____ (BitDefender SRL) C:\Windows\system32\bdsandboxuiskin32.dll 2014-12-09 03:28 - 2009-07-14 06:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk Some content of TEMP: ==================== C:\Users\Sevi\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-12-25 00:40 ==================== End Of Log ============================
  25. Здравейте преди известно време системата ми Windos xp3 proffesional 2002/Procesor AMD Athlon™ 64x2 Dual core 4200+ 2.21GXC. RAM 1GB. Видео Карта NVIDIA Geoforce 8400GS 512MB бе инфектирана с вируси.Бяха премахнати с помоща на Maware Bytes Avast Free SuperAntiSpyware. Обаче продължи да работи доста бавно и мудно. Реших да го занеса за преинсталация.Обаче уви след преинсталацията продължава да работи мудно.Компютъра е преинсталиран от Специалист.Но имам съмнения ,че някоя от гадинките може да се преместила в дял (/D) и да продължава да бави системата. Файла е качен в dox,bg, защото е прекалено голям и не ми позволява да го постна целия!!! FRST.txt Addition.txt
×
×
  • Добави ново...