Браузърите ме пренасочват в harmful сайтове

26 юни 201610 г.

Здравейте,

Компютърът ми е заразен. При отваряне на прозорец в браузъра и след опит за влизане в дадено url - ме пренасочва в други сайтове, пример: http://spaces.slimspots.com/

Изтеглих Malwarbatyes(trial), сканирах и не откри нищо. Изтеглих и F-Secure SAFE(сканирах и той не откри нищо)

Прилагам логове от FRST, Addition, Shortcut.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 20-06-2016 01
Ran by ASdffg$ (administrator) on SMACK (26-06-2016 10:43:37)
Running from C:\Users\Танер\Downloads
Loaded Profiles: ASdffg$ & MSSQL$SQLEXPRESS (Available Profiles: ASdffg$ & MSSQL$SQLEXPRESS)
Platform: Windows 8.1 Pro (Update) (X64) Language: English (United Kingdom)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Advanced Micro Devices) C:\Program Files\AMD\{920DEC42-4CA5-4d1d-9487-67BE645CDDFC}\amdacpusrsvc.exe
(F-Secure Corporation) C:\Program Files (x86)\F-Secure\SAFE\fshoster32.exe
(F-Secure Corporation) C:\Program Files (x86)\F-Secure\SAFE\fshoster32.exe
(F-Secure Corporation) C:\Program Files (x86)\F-Secure\SAFE\apps\CCF_Reputation\fsorsp.exe
(Maxthon) C:\Program Files (x86)\Maxthon\Modules\Service\Update\MaxthonUpdateSvc.exe
(F-Secure Corporation) C:\Program Files (x86)\F-Secure\SAFE\apps\ComputerSecurity\Anti-Virus\fsgk32.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL12.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(F-Secure Corporation) C:\Program Files (x86)\F-Secure\SAFE\apps\ComputerSecurity\Common\FSMA32.EXE
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(F-Secure Corporation) C:\Program Files (x86)\F-Secure\SAFE\apps\ComputerSecurity\Common\FSHDLL64.EXE
(F-Secure Corporation) C:\Program Files (x86)\F-Secure\SAFE\apps\ComputerSecurity\Anti-Virus\fssm32.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(AMD) C:\Windows\System32\atieclxx.exe
(F-Secure Corporation) C:\Program Files (x86)\F-Secure\SAFE\fshoster32.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Logitech Inc.) C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe
() C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
(Raptr, Inc) C:\Program Files (x86)\Raptr Inc\Raptr\raptr.exe
(Raptr, Inc) C:\Program Files (x86)\Raptr Inc\Raptr\raptr_im.exe
(Raptr Inc.) C:\Program Files (x86)\Raptr Inc\Raptr\raptr_ep64.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
() C:\Program Files\OBS\OBS.exe
(Maxthon International ltd.) C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe
(Maxthon International ltd.) C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe
(Maxthon International ltd.) C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe
(ManyCam LLC) C:\Program Files (x86)\ManyCam\Bin\ManyCam.exe
(Maxthon International ltd.) C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe
(Maxthon International ltd.) C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe
(Maxthon International ltd.) C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [StartCN] => C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe [5006536 2016-03-21] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Raptr] => C:\Program Files (x86)\Raptr Inc\Raptr\raptrstub.exe [58640 2016-04-27] (Raptr, Inc)
HKLM-x32\...\Run: [LWS] => C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [204136 2012-09-13] (Logitech Inc.)
HKU\S-1-5-21-148641092-2717288511-1045065011-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [53130368 2016-05-17] (Skype Technologies S.A.)
GroupPolicyScripts: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 54.186.51.153 8.8.8.8
Tcpip\..\Interfaces\{B65BAC82-DBE6-4534-8974-1348BEF30C7A}: [DhcpNameServer] 54.186.51.153 8.8.8.8

Internet Explorer:
==================
URLSearchHook: [S-1-5-80-3880006512-4290199581-1648723128-3569869737-3631323133] ATTENTION => Default URLSearchHook is missing
BHO: Browsing Protection by F-Secure -> {45BBE08D-81C5-4A67-AF20-B2A077C67747} -> C:\Program Files (x86)\F-Secure\SAFE\apps\CCF_Scanning\bin\browser\install\fs_ie_https\fs_ie_https64.dll [2016-05-20] (F-Secure Corporation)
BHO-x32: Microsoft Web Test Recorder 12.0 Helper -> {432dd630-7e03-4c97-9d62-b99f52df4fc2} -> C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll [2013-10-05] (Microsoft Corporation)
BHO-x32: Browsing Protection by F-Secure -> {45BBE08D-81C5-4A67-AF20-B2A077C67747} -> C:\Program Files (x86)\F-Secure\SAFE\apps\CCF_Scanning\bin\browser\install\fs_ie_https\fs_ie_https.dll [2016-05-20] (F-Secure Corporation)
Handler: qvp - {4BA78E3D-CA25-4BFF-B8F0-8A3359E4B520} - C:\Program Files\QlikView\QvProtocol\qvp.dll [2015-11-30] (QlikTech International AB)
Handler-x32: qvp - {4BA78E3D-CA25-4BFF-B8F0-8A3359E4B520} - C:\Program Files (x86)\QlikView\QvProtocol\qvp.dll [2015-11-30] (QlikTech International AB)

FireFox:
========
FF ProfilePath: C:\Users\Танер\AppData\Roaming\Mozilla\Firefox\Profiles\e3efm7hq.default
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll [2013-05-13] ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Extension: Video AdBlock - C:\Users\Танер\AppData\Roaming\Mozilla\Firefox\Profiles\e3efm7hq.default\extensions\{068e178c-61a9-4a63-b74f-87404a6f5ea1} [2016-01-27]
FF Extension: Adblock Plus - C:\Users\Танер\AppData\Roaming\Mozilla\Firefox\Profiles\e3efm7hq.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-04-28]
FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Program Files (x86)\F-Secure\SAFE\apps\CCF_Scanning\bin\browser\install\fs_firefox_https\fs_firefox_https.xpi
FF Extension: Browsing Protection by F-Secure - C:\Program Files (x86)\F-Secure\SAFE\apps\CCF_Scanning\bin\browser\install\fs_firefox_https\fs_firefox_https.xpi [2016-05-20]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files (x86)\F-Secure\SAFE\apps\CCF_Scanning\bin\browser\install\fs_firefox_https\fs_firefox_https.xpi

Chrome:
=======
CHR Profile: C:\Users\Танер\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Презентации) - C:\Users\Танер\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-10-18]
CHR Extension: (Google Документи) - C:\Users\Танер\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-10-18]
CHR Extension: (Google Диск) - C:\Users\Танер\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-21]
CHR Extension: (Video AdBlock for Chrome) - C:\Users\Танер\AppData\Local\Google\Chrome\User Data\Default\Extensions\bknbnapaddjdnbilpmlacdkjdkjmbjhd [2016-01-28]
CHR Extension: (YouTube) - C:\Users\Танер\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-18]
CHR Extension: (Adblock Plus) - C:\Users\Танер\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-06-16]
CHR Extension: (Google Търсене) - C:\Users\Танер\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27]
CHR Extension: (Електронни таблици от Google) - C:\Users\Танер\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-10-18]
CHR Extension: (Google Документи офлайн) - C:\Users\Танер\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-17]
CHR Extension: (Browsing Protection by F-Secure) - C:\Users\Танер\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmjjnhpacphpjmnnlnccpfmhkcloaade [2016-06-19]
CHR Extension: (Плащания в уеб магазина на Chrome) - C:\Users\Танер\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-02]
CHR Extension: (Gmail) - C:\Users\Танер\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-10-18]
CHR HKU\S-1-5-21-148641092-2717288511-1045065011-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [bknbnapaddjdnbilpmlacdkjdkjmbjhd] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [bknbnapaddjdnbilpmlacdkjdkjmbjhd] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [jmjjnhpacphpjmnnlnccpfmhkcloaade] - C:/Program Files (x86)/F-Secure/SAFE/apps/CCF_Scanning/bin/browser/install/fs_chrome_https/fs_chrome_https.crx [2016-05-20]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 amdacpusrsvc; C:\Program Files\AMD\{920DEC42-4CA5-4d1d-9487-67BE645CDDFC}\amdacpusrsvc.exe [121856 2016-03-21] (Advanced Micro Devices) [File not signed]
S3 c2wts; C:\Program Files\Windows Identity Foundation\v3.5\c2wtshost.exe [5632 2016-02-06] (Microsoft Corporation)
R2 fshoster; C:\Program Files (x86)\F-Secure\SAFE\fshoster32.exe [190944 2016-05-31] (F-Secure Corporation)
R3 FSMA; C:\Program Files (x86)\F-Secure\SAFE\apps\ComputerSecurity\Common\FSMA32.EXE [218080 2016-06-01] (F-Secure Corporation)
R2 fsnethoster; C:\Program Files (x86)\F-Secure\SAFE\fshoster32.exe [190944 2016-05-31] (F-Secure Corporation)
R2 FSORSPClient; C:\Program Files (x86)\F-Secure\SAFE\apps\CCF_Reputation\fsorsp.exe [62432 2016-05-20] (F-Secure Corporation)
S3 fussvc; C:\Program Files (x86)\Windows Kits\8.1\App Certification Kit\fussvc.exe [142336 2013-08-22] (Microsoft Corporation) [File not signed]
R2 MaxthonUpdateSvc; C:\Program Files (x86)\Maxthon\Modules\Service\Update\MaxthonUpdateSvc.exe [1872808 2015-11-27] (Maxthon)
R2 MSSQL$SQLEXPRESS; C:\Program Files (x86)\Microsoft SQL Server\MSSQL12.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [197824 2014-02-21] (Microsoft Corporation)
S4 SQLAgent$SQLEXPRESS; C:\Program Files (x86)\Microsoft SQL Server\MSSQL12.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [454848 2014-02-21] (Microsoft Corporation)
S3 Te.Service; C:\Program Files (x86)\Windows Kits\8.1\Testing\Runtimes\TAEF\Wex.Services.exe [119808 2013-08-22] (Microsoft Corporation) [File not signed]
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [6889232 2015-12-14] (TeamViewer GmbH)
S3 VsEtwService120; C:\Program Files\Microsoft Visual Studio 12.0\Common7\Packages\Debugger\Services\VsEtwService.exe [87728 2013-10-05] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 amdacpksd; C:\Windows\system32\drivers\amdacpksd.sys [296648 2016-03-21] (Advanced Micro Devices)
S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [23240 2016-03-21] (Advanced Micro Devices, Inc.)
R2 AODDriver4.3; C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [111128 2016-03-07] (Advanced Micro Devices)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
R3 F-Secure Gatekeeper; C:\Program Files (x86)\F-Secure\SAFE\apps\ComputerSecurity\Anti-Virus\minifilter\FSgk.sys [226512 2016-06-19] (F-Secure Corporation)
R1 F-Secure HIPS; C:\Program Files (x86)\F-Secure\SAFE\apps\ComputerSecurity\HIPS\drivers\fshs.sys [106696 2016-06-19] (F-Secure Corporation)
R0 fsbts; C:\Windows\System32\Drivers\fsbts.sys [75448 2016-06-19] ()
R3 fsni; C:\Program Files (x86)\F-Secure\SAFE\apps\CCF_Scanning\bin\fsni64.sys [97832 2015-11-09] (F-Secure Corporation)
S3 mcaudrv_simple; C:\Windows\system32\drivers\mcaudrv_x64.sys [35960 2014-12-29] (Visicom Media Inc.)
R3 SensorsSimulatorDriver; C:\Windows\system32\DRIVERS\WUDFRd.sys [226304 2014-11-22] (Microsoft Corporation)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]

========================== Drivers MD5 =======================

C:\Windows\System32\drivers\1394ohci.sys E1832BD9FD7E0FC2DC9FA5935DE3E8C1
C:\Windows\System32\drivers\3ware.sys AD508A1A46EC21B740AB31C28EFDFDB1
C:\Windows\System32\drivers\ACPI.sys E796AE43DDD1844281DB4D57294D17C0
C:\Windows\System32\Drivers\acpiex.sys AC8279D229398BCF05C3154ADCA86813
C:\Windows\System32\drivers\acpipagr.sys A8970D9BF23CD309E0403978A1B58F3F
C:\Windows\System32\drivers\acpipmi.sys 111A89C99C5B4F1A7BCE5F643DD86F65
C:\Windows\System32\drivers\acpitime.sys 5758387D68A20AE7D3245011B07E36E7
C:\Windows\System32\drivers\ADP80XX.SYS 7C1FDF1B48298CBA7CE4BDD4978951AD
C:\Windows\system32\drivers\afd.sys A460C3AF3755A2A79A3C8EFE72E147B5
C:\Windows\System32\drivers\agp440.sys 7DFAEBA9AD62D20102B576D5CAC45EC8
C:\Windows\System32\DRIVERS\ahcache.sys FE14D249D39368CA62D8DA6BC94AC694
C:\Windows\system32\drivers\amdacpksd.sys 67D7C6E359B36D3DE92974AD74B933AD
C:\Windows\System32\drivers\amdk8.sys 7589DE749DB6F71A68489DCE04158729
C:\Windows\System32\drivers\amdkmafd.sys 66CD2F9A6AD1B720E448053B5CE6F3A4
C:\Windows\system32\DRIVERS\atikmdag.sys 1890CDF2ECAE766E4A7185E4DBBF9EE1
C:\Windows\system32\DRIVERS\atikmpag.sys 1FE14B9C86B8C17F741BE4619CD2E421
C:\Windows\System32\drivers\amdppm.sys B46D2D89AFF8A9490FA8C98C7A5616E3
C:\Windows\System32\drivers\amdsata.sys D2BF2F94A47D332814910FD47C6BBCD2
C:\Windows\System32\drivers\amdsbs.sys A8E04943C7BBA7219AA50400272C3C6E
C:\Windows\System32\drivers\amdxata.sys CEA5F4F27CFC08E3A44D576811B35F50
C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys C3D487827E48CC5EC17994FEC5BDFF87
C:\Windows\system32\drivers\appid.sys 415DD71628795197F7AFC176CBADC74E
C:\Windows\System32\drivers\arcsas.sys 65045784366F7EC5FB4E71BCF923187B
C:\Windows\System32\drivers\atapi.sys 74B14192CF79A72F7536B27CB8814FBD
C:\Windows\system32\drivers\AtihdWB6.sys E8F807F0179406A4700BB8C949ED4453
C:\Windows\System32\drivers\bxvbda.sys A4A73F631FE2AA2826FBE4A399B04DEF
C:\Windows\System32\drivers\BasicDisplay.sys 8CC7F7E4AFCBA605921B137ED7992C68
C:\Windows\System32\drivers\BasicRender.sys 38A82F4EE8C416A6744B6D30381ED768
C:\Windows\System32\drivers\bcmfn2.sys C1ABB0F7E3BEA48A0417BDF6FF14AB21
C:\Windows\System32\Drivers\Beep.sys EC19013E4CF87609534165DF897274D6
C:\Windows\System32\DRIVERS\bowser.sys 6B4FFFDDC618FCF64473CAA86E305697
C:\Windows\System32\drivers\BthAvrcpTg.sys A8F23D453A424FF4DE04989C4727ECC7
C:\Windows\System32\drivers\bthhfenum.sys 272A62B660A48AEF366F8A1836CED19F
C:\Windows\System32\drivers\BthHFHid.sys 71FE2A48E4C93DDB9798C024880B6C07
C:\Windows\System32\drivers\bthmodem.sys EF4B9E7C9AD88C00C18A12B0D22D1894
C:\Windows\System32\DRIVERS\cdfs.sys 2FA6510E33F7DEFEC03658B74101A9B9
C:\Windows\System32\drivers\cdrom.sys C6796EA22B513E3457514D92DCDB1A3D
C:\Windows\System32\drivers\circlass.sys BE9936EDD3267FAAFF94A7835867F00B
C:\Windows\System32\drivers\CLFS.sys 8EB7E70C2D348FE2476A2E3F2D585E3D
C:\Windows\System32\drivers\CmBatt.sys EF6EF85DADC3184A10D8F2F7159973CB
C:\Windows\System32\Drivers\cng.sys 1F20A2F59B7F979B39CBFA602E0D1F8E
C:\Windows\System32\drivers\CompositeBus.sys 03AAED827C36F35D70900558B8274905
C:\Windows\System32\drivers\condrv.sys A1FF7DFBFBE164CF92603C651D304DD2
C:\Windows\System32\drivers\csc.sys 9DBC32A45CFA67074432D2AF6C2832B6
C:\Windows\System32\drivers\dam.sys 315BA4BC19316D72B2E037534E048B93
C:\Windows\System32\Drivers\dfsc.sys A03F362C5557E238CBFA914689C77248
C:\Windows\System32\drivers\disk.sys 8B1E62881D5AC68E673CD94B136B34AC
C:\Windows\System32\drivers\dmvsc.sys EB70A894708D1BC176AFD690FF06085F
C:\Windows\system32\drivers\drmkaud.sys 00C594D5A1DBD22AD8B2902B9F6EFF94
C:\Windows\System32\drivers\dxgkrnl.sys F74B839FA0F4E6060CA1DA6B8DA17941
C:\Windows\System32\drivers\evbda.sys 114BCFDF367FF37C3F1B0A96AF542E4D
C:\Windows\System32\drivers\EhStorClass.sys 43531A5993380CC5113242C29D265FD9
C:\Windows\System32\drivers\EhStorTcgDrv.sys 6F8E738A9505A388B1157FDDE7B3101B
C:\Windows\System32\drivers\errdev.sys DFFFAE1442BA4076E18EED5E406FA0D3
C:\Windows\System32\Drivers\exfat.sys 7729D294A555C7AEB281ED8E4D0E01E4
C:\Program Files (x86)\F-Secure\SAFE\apps\ComputerSecurity\Anti-Virus\minifilter\FSgk.sys 66B5D5200E6B417DC25C948A3671F942
C:\Program Files (x86)\F-Secure\SAFE\apps\ComputerSecurity\HIPS\drivers\fshs.sys EEB01B86F8973429B9867A4BCF3D35B0
C:\Windows\System32\Drivers\fastfat.sys 7C4E0D5900B2A1D11EDD626D6DDB937B
C:\Windows\System32\drivers\fdc.sys 5D8402613E778B3BD45E687A8372710B
C:\Windows\System32\drivers\fileinfo.sys BCFD8B149B3ADF92D0DB1E909CAF0265
C:\Windows\System32\drivers\filetrace.sys A1A66C4FDAFD6B0289523232AFB7D8AF
C:\Windows\System32\drivers\flpydisk.sys BE743083CF7063C486A4398E3AEFE59A
C:\Windows\System32\drivers\fltmgr.sys C1FB505A73FA2E9019D32444AB33B75A
C:\Windows\System32\Drivers\fsbts.sys 2F215CB2FCA090B0910A23D15131D099
C:\Windows\System32\drivers\FsDepends.sys A7C31B168F371E8E6796219F23E354DB
C:\Program Files (x86)\F-Secure\SAFE\apps\CCF_Scanning\bin\fsni64.sys F0CF8AF05E9F160DC5EA3F1E1E6D3015
C:\Windows\System32\Drivers\Fs_Rec.sys 09F460AFEDCA03F3BF6E07D1CCC9AC42
C:\Windows\System32\DRIVERS\fvevol.sys F152D55E497E12256290C43B31C7D0CE
C:\Windows\System32\drivers\fxppm.sys 9591D0B9351ED489EAFD9D1CE52A8015
C:\Windows\System32\drivers\gagp30kx.sys FC3EF65EE20D39F8749C2218DBA681CA
C:\Windows\System32\drivers\vmgencounter.sys 0BF5CAD281E25F1418E5B8875DC5ADD1
C:\Windows\System32\Drivers\msgpioclx.sys 8DF1254093B5C354CE725EB6B9B0DE19
C:\Windows\system32\drivers\HdAudio.sys 56F69F7C25FB67C970997D7066DBC593
C:\Windows\System32\drivers\HDAudBus.sys D4B7ED39C7900384D9E5C1283F1E7926
C:\Windows\System32\drivers\HidBatt.sys 10A70BC1871CD955D85CD88372724906
C:\Windows\System32\drivers\hidbth.sys 42F88B57CAE42FC10059C887B3FCFCEA
C:\Windows\System32\drivers\hidi2c.sys C241A8BAFBBFC90176EA0F5240EACC17
C:\Windows\System32\drivers\hidir.sys 9BDDEE26255421017E161CCB9D5EDA95
C:\Windows\System32\drivers\hidusb.sys 8DB8EAB9D0C6A5DF0BDCADEA239220B4
C:\Windows\System32\drivers\HpSAMD.sys A6AACEA4C785789BDA5912AD1FEDA80D
C:\Windows\System32\drivers\HTTP.sys E87A6D3B8FECD5B93BC0CFBB48C27970
C:\Windows\System32\drivers\hwpolicy.sys 90656C0B3864804B090434EFC582404F
C:\Windows\System32\drivers\hyperkbd.sys 6D6F9E3BF0484967E52F7E846BFF1CA1
C:\Windows\system32\DRIVERS\HyperVideo.sys 907C870F8C31F8DDD6F090857B46AB25
C:\Windows\System32\drivers\i8042prt.sys 49EE0AE9E5B64FFBBD06D55C4984B598
C:\Windows\System32\drivers\iaLPSSi_GPIO.sys 5D90E32E36CE5D4C535D17CE08AEAF05
C:\Windows\System32\drivers\iaLPSSi_I2C.sys DD05E7E80F52ADE9AEB292819920F32C
C:\Windows\System32\drivers\iaStorAV.sys 08BFE413B0B4AA8DFA4B5684CE06D3DC
C:\Windows\System32\drivers\iaStorV.sys A2200C3033FA4EF249FC096A7A7D02A2
C:\Windows\System32\drivers\intelide.sys 4E448FCFFD00E8D657CD9E48D3E47157
C:\Windows\System32\drivers\intelpep.sys A770340FC02B999EF0DE6C2A6BC8437C
C:\Windows\System32\drivers\intelppm.sys 47E74A8E53C7C24DCE38311E1451C1D9
C:\Windows\System32\DRIVERS\ipfltdrv.sys 9DB76D7F9E4E53EFE5DD8C53DE837514
C:\Windows\System32\drivers\IPMIDrv.sys C800DCD904016B2BF6AB541083770A3A
C:\Windows\System32\drivers\ipnat.sys B7342B3C58E91107F6E946A93D9D4EFD
C:\Windows\System32\drivers\irenum.sys AE44C526AB5F8A487D941CEB57B10C97
C:\Windows\System32\drivers\isapnp.sys 8AFEEA3955AA43616A60F133B1D25F21
C:\Windows\System32\drivers\msiscsi.sys D90AB68D0FAC9F357F663670FDBB511E
C:\Windows\System32\drivers\kbdclass.sys 5917AFE4A3F695A54B99C1849C8207FE
C:\Windows\System32\drivers\kbdhid.sys 8CD840A062F6BDF41DDE3ACB96164B72
C:\Windows\System32\drivers\kbldfltr.sys DB7A09BC90DF20F44F16F8B0F9ED3491
C:\Windows\system32\DRIVERS\kdnic.sys 813871C7D402A05F2E3A7075F9584A05
C:\Windows\System32\Drivers\ksecdd.sys 4E829B18D5BAEC29893792A3C671A847
C:\Windows\System32\Drivers\ksecpkg.sys 38BED40B100C6A844C3DB1AEE2F0C6CF
C:\Windows\system32\drivers\ksthunk.sys 11AFB527AA370B1DAFD5C36F35F6D45F
C:\Windows\system32\DRIVERS\lltdio.sys C09010B3680860131631F53E8FE7BAD8
C:\Windows\System32\drivers\lsi_sas.sys C755AE4635457AA2A11F79C0DF857ABC
C:\Windows\System32\drivers\lsi_sas2.sys ADAC09CBE7A2040B7F68B5E5C9A75141
C:\Windows\System32\drivers\lsi_sas3.sys 04D1274BB9BBCCF12BD12374002AA191
C:\Windows\System32\drivers\lsi_sss.sys 327469EEF3833D0C584B7E88A76AEC0C
C:\Windows\system32\drivers\luafv.sys DDEE191AB32DFC22C6465002ECDF5EE4
C:\Windows\system32\DRIVERS\lvrs64.sys A0A527569856B9814E8920F52EBB67F5
C:\Windows\system32\DRIVERS\lvuvc64.sys 415E344294D1C0D04627B29146F68481
C:\Windows\system32\DRIVERS\ManyCam_x64.sys D33E2B74CF8B3A652BF0A9FBD068E87A
C:\Windows\system32\drivers\mcaudrv_x64.sys 7382E4A888A7D4333DFF8A30B6850EE9
C:\Windows\System32\drivers\megasas.sys EB5C03A070F30D64A6DF80E53B22F53F
C:\Windows\System32\drivers\megasr.sys F6F13533196DE7A582D422B0241E4363
C:\Windows\System32\drivers\modem.sys 8B38C44F69259987C95135C9627E2378
C:\Windows\System32\drivers\monitor.sys 601589000CC90F0DF8DA2CC254A3CCC9
C:\Windows\System32\drivers\mouclass.sys 08374E4E5B8914DE6067CBA99F61E930
C:\Windows\System32\drivers\mouhid.sys 5FCBAB60598AE119E02B4C27DE6B99EA
C:\Windows\System32\drivers\mountmgr.sys 9A788037D768809DFD677F4BA08A224A
C:\Windows\System32\drivers\mpsdrv.sys 6FC047578785B0435F4E2660946D1ADC
C:\Windows\system32\drivers\mrxdav.sys D2AC8F07995CE6CD18848C129435B481
C:\Windows\System32\DRIVERS\mrxsmb.sys 5DCD41F62F71519D2A46D41F60C69B0C
C:\Windows\System32\DRIVERS\mrxsmb10.sys D7C9BC4D37BF08C7DD436A0A5F321668
C:\Windows\System32\DRIVERS\mrxsmb20.sys FE219A7107C4BC3BBC35D6CDC281612C
C:\Windows\system32\DRIVERS\bridge.sys F3C060444777A59FC63D920719E43CCD
C:\Windows\System32\Drivers\Msfs.sys D13329FBF8345B28AB30F44CC247DC08
C:\Windows\System32\drivers\msgpiowin32.sys C6B474E46F9E543B875981ED3FFE6ADD
C:\Windows\System32\drivers\mshidkmdf.sys 65C92EB9D08DB5C69F28C7FFD4E84E31
C:\Windows\System32\drivers\mshidumdf.sys 52299F086AC2DAFD100DD5DC4A8614BA
C:\Windows\System32\drivers\msisadrv.sys 36D92AF3343C3A3E57FEF11C449AEA4C
C:\Windows\system32\drivers\MSKSSRV.sys A9BBBD2BAE6142253B9195E949AC2E8D
C:\Windows\system32\DRIVERS\mslldp.sys 51B3AC0560848CD6D65AC2033E293113
C:\Windows\system32\drivers\MSPCLOCK.sys 7B2128EB875DCBC006E6A913211006D6
C:\Windows\system32\drivers\MSPQM.sys 1E88171579B218115C7A772F8DE04BD8
C:\Windows\System32\Drivers\MsRPC.sys BBE2A455053E63BECBF42C2F9B21FAE0
C:\Windows\System32\drivers\mssmbios.sys 8D6B7D515C5CBCDB75B928A0B73C3C5E
C:\Windows\system32\drivers\MSTEE.sys 115019AE01E0EB9C048530D2928AB4A2
C:\Windows\System32\drivers\MTConfig.sys 96D604A35070360F0DD4A7A8AF410B5E
C:\Windows\System32\Drivers\mup.sys 619CA29326B82372621DB2C0964D8365
C:\Windows\System32\drivers\mvumis.sys B8C35C94DCB2DFEAF03BB42131F2F77F
C:\Windows\system32\DRIVERS\nwifi.sys 008F7CED69FD5B30CBDE1E03C6F36A27
C:\Windows\System32\drivers\ndis.sys 97DC5967F65503213FD1F1B3E4A6F983
C:\Windows\system32\DRIVERS\ndiscap.sys 8CECC8DA55F3274181FD1EA28AD76664
C:\Windows\system32\DRIVERS\NdisImPlatform.sys 269882812E9A68FFF1AFE1283D428322
C:\Windows\system32\DRIVERS\ndistapi.sys 82821F4EEC776B4CF11695A38F3ABA46
C:\Windows\system32\DRIVERS\ndisuio.sys B832B35055BA2B7B4181861FF94D8E59
C:\Windows\System32\drivers\NdisVirtualBus.sys 1F58E48EF75F34C35D8E93A0DC535CFE
C:\Windows\system32\DRIVERS\ndiswan.sys DEC29080202D4F9F17F55E18BCFCC41A
C:\Windows\system32\DRIVERS\ndiswan.sys DEC29080202D4F9F17F55E18BCFCC41A
C:\Windows\System32\Drivers\NDProxy.sys DDD7F92A83F74D1476B71FBA9530A8DC
C:\Windows\System32\drivers\Ndu.sys 3083926D1CC5B56EA0786527B557DD1B
C:\Windows\System32\DRIVERS\netbios.sys 42FF4975D032CAE558AE4BB8448F6E5A
C:\Windows\System32\DRIVERS\netbt.sys 9DC17B7D9D84C37C102D379FCC7D4942
C:\Windows\System32\drivers\netvsc63.sys D4DCE03870314D3354F3501F9DDD4123
C:\Windows\System32\Drivers\Npfs.sys 8F44A2F57C9F1A19AC9C6288C10FB351
C:\Windows\System32\drivers\npsvctrig.sys CBDB4F0871C88DF930FC0E8588CA67FC
C:\Windows\System32\drivers\nsiproxy.sys 0E046FF5823B95326D10CF1B4AF23541
C:\Windows\System32\Drivers\Ntfs.sys 9980B262DBE439AE6BDC91AA985F19EE
C:\Windows\System32\Drivers\Null.sys EF1B290FC9F0E47CC0B537292BEE5904
C:\Windows\System32\drivers\nvraid.sys BC6B5942AFF25EBAF62DE43C3807EDF8
C:\Windows\System32\drivers\nvstor.sys 1F43ABFFAC3D6CA356851D517392966E
C:\Windows\System32\drivers\nv_agp.sys 6934A936A7369DFE37B7DBA93F5E5E49
C:\Windows\System32\drivers\parport.sys 764B1121867B2D9B31C491668AC72B2B
C:\Windows\System32\drivers\partmgr.sys BAFF6122CFC9F95CA175AD8C348179A4
C:\Windows\System32\drivers\pci.sys 91ED124E261EA8FAA1C0FFDF2A71B0C4
C:\Windows\System32\drivers\pciide.sys 346E38FCC6859A727DD28AFAD1F0AFF4
C:\Windows\System32\drivers\pcmcia.sys 4D3BDCC1C7B40C9D7B6AD990E6DEC397
C:\Windows\System32\drivers\pcw.sys BF28771D1436C88BE1D297D3098B0F7D
C:\Windows\System32\drivers\pdc.sys 24A8DFC07E4BAF29AEA26E383D4CC886
C:\Windows\System32\drivers\peauth.sys 0ECEE590F2E2EF969FB74A6FC583A1E6
C:\Windows\System32\drivers\processr.sys ECD373F9571C745894367CC2635EA44F
C:\Windows\system32\DRIVERS\pacer.sys FC0141B4A5AD6D637D883C1A89FC45C5
C:\Windows\system32\drivers\qwavedrv.sys 83868EB2924E6BC21A54337C65D614D1
C:\Windows\System32\DRIVERS\rasacd.sys B337B1F1E82A83E20A1743E008E25C0F
C:\Windows\system32\DRIVERS\raspppoe.sys 5247F308C4103CDC4FE12AE1D235800A
C:\Windows\System32\DRIVERS\rdbss.sys A1A5E79C0D1352AFDC08328A623DA051
C:\Windows\System32\drivers\rdpbus.sys 6B21EBF892CD8CACB71669B35AB5DE32
C:\Windows\System32\drivers\rdpdr.sys 680C1DAE268B6FB67FA21B389A8B79EF
C:\Windows\System32\drivers\rdpvideominiport.sys BC8A79C625568DDB7DCA49D0C2741A64
C:\Windows\System32\drivers\rdyboost.sys A26AEC49F318FEE141DDDB2C5F99B3E6
C:\Windows\System32\Drivers\ReFS.sys 615DFD97DEA56CE1C3A52185A3038FF8
C:\Windows\system32\DRIVERS\rspndr.sys 2D05A5508F4685412F2B89E8C2189ABC
C:\Windows\system32\DRIVERS\Rt630x64.sys 19764658C1468C2C0CEF133D28414A6B
C:\Windows\System32\drivers\vms3cap.sys 1A063730F221B2746FF00457AE17E4F0
C:\Windows\System32\drivers\sbp2port.sys C624A1B32211C3166EDB3F4AB02A30B7
C:\Windows\System32\DRIVERS\scfilter.sys 13BEA6C882D4D877A5A85CA149C86BC1
C:\Windows\System32\drivers\sdbus.sys C54B6B2170BF628FD42F799A66956D75
C:\Windows\System32\drivers\sdstor.sys 0B1E929D11A8E358106955603FAC65E8
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\WUDFRd.sys D7B4859227B02BCC1055B279A63C937F
C:\Windows\System32\drivers\SerCx.sys DB2FF24CE0BDD15FE75870AFE312BA89
C:\Windows\System32\drivers\SerCx2.sys 0044B31F93946D5D41982314381FE431
C:\Windows\System32\drivers\serenum.sys 3CD600C089C1251BEEB4CD4CD5164F9E
C:\Windows\System32\drivers\serial.sys D864381BC9C725FAB01D94C060660166
C:\Windows\System32\drivers\sermouse.sys 148195AE95D9BC7375A08846439FDAC1
C:\Windows\System32\drivers\sfloppy.sys 472B7A5AC181C050888DB454663DD764
C:\Windows\System32\drivers\SiSRaid2.sys 2F518D13DD6F3053837FE606F1A2EA1F
C:\Windows\System32\drivers\sisraid4.sys 1AC9A200A9C49C4508F04AAFFCA34A3F
C:\Windows\System32\drivers\spaceport.sys B45AE0970B2D66CCE756DE6989E23EEC
C:\Windows\System32\drivers\SpbCx.sys F337BE11071818FC3F5DC2940B6BDE34
C:\Windows\System32\DRIVERS\srv.sys 69DC128CF54009A686E0F0C57E2BA0DC
C:\Windows\System32\DRIVERS\srv2.sys CED8576CD925E83ABEB14F65EA205C29
C:\Windows\System32\DRIVERS\srvnet.sys 4396587119D8F4B72561ED24666E7567
C:\Windows\System32\drivers\stexstor.sys 366DEA74BBA65B362BCCFC6FC2ADFD8B
C:\Windows\System32\drivers\storahci.sys 0ED2E318ABB68C1A35A8B8038BDB4C90
C:\Windows\System32\drivers\vmstorfl.sys 8B9486B64E5FC17FB9CC04CA10B77A34
C:\Windows\System32\drivers\stornvme.sys 6B06E2D11E604BE2B1A406C4CB3B90DE
C:\Windows\System32\drivers\storvsc.sys 548759755BC73DAD663250239D7E0B9F
C:\Windows\System32\drivers\storvsp.sys 7D123389FCD97D84881BA9C07012BA0C
C:\Windows\System32\drivers\swenum.sys 65454187E0F8B6C0DCECB0287D06EC43
C:\Windows\System32\drivers\tcpip.sys 1C8560E3A37A9D4F25B7769C3E3D4163
C:\Windows\system32\DRIVERS\tcpip.sys 1C8560E3A37A9D4F25B7769C3E3D4163
C:\Windows\System32\drivers\tcpipreg.sys 41CF802064F72E55F50CA0A221FD36D4
C:\Windows\system32\DRIVERS\tdx.sys E0BD2D83875464FEEEB242CBA8B7E073
C:\Windows\System32\drivers\terminpt.sys 232D185D2337F141311D0CF1983E1431
C:\Windows\system32\drivers\tpm.sys 80A2FC1A089A71F2DBE5D8394FFB009F
C:\Windows\System32\drivers\tsusbflt.sys BF8F54CA37E9C9D6582C31C5761F8C93
C:\Windows\System32\drivers\TsUsbGD.sys 20185BEB7512EDE4EFECDFA148AC9F99
C:\Windows\system32\DRIVERS\tunnel.sys E85916632CD3B9E9B546968DB950BF42
C:\Windows\System32\drivers\uagp35.sys F6EEAD052943B5A3104C1405BB856C54
C:\Windows\System32\drivers\uaspstor.sys FE6067B1FD4E63650C667B33D080565B
C:\Windows\System32\drivers\ucx01000.sys 807F8CF3E973305FC435C61CBBEE2A49
C:\Windows\System32\DRIVERS\udfs.sys C61EAF8E1E4B2F62BA4FDF457440B2C6
C:\Windows\System32\drivers\UEFI.sys 9578691F297E1B1F519970FE6D47CB21
C:\Windows\System32\drivers\uliagpkx.sys 5EAB5117DDB24FC4D39E6FFFCF1837B9
C:\Windows\System32\drivers\umbus.sys DA34C39A18E60E7C3FA0630566408034
C:\Windows\System32\drivers\umpass.sys AE8294875E5446E359B1E8035D40C05E
C:\Windows\system32\drivers\usbaudio.sys DF355EB0199198728027962DCFCDE5FB
C:\Windows\System32\drivers\usbccgp.sys FF78D053A05E5A394F4E3C1816CC65A8
C:\Windows\System32\drivers\usbcir.sys 0139248F6B95CF0D837B5B46A2722D40
C:\Windows\System32\drivers\usbehci.sys C996CBEF922B5653A01E3F50DDCE2F86
C:\Windows\System32\drivers\usbhub.sys CD81683F4553677B9BF5163A922153EB
C:\Windows\System32\drivers\UsbHub3.sys 5C90D5379B53590FBB24BBAD4FA682EE
C:\Windows\System32\drivers\usbohci.sys A0F0484C97D6441ED6A75D7426ECCC9E
C:\Windows\System32\drivers\usbprint.sys 4D655E3B684BE9B0F7FFD8A2935C348C
C:\Windows\System32\drivers\USBSTOR.SYS 9D168BFA334D47BE404367EB58D4E130
C:\Windows\System32\drivers\usbuhci.sys FC974B03C8B87455F44F734C8F31A3C8
C:\Windows\System32\Drivers\usbvideo.sys 5C8F604F6DC74177CDD8372D7B1ADFF0
C:\Windows\System32\drivers\USBXHCI.SYS 44603DA5A87FB491EF59C889EBBB4DDB
C:\Windows\System32\drivers\vdrvroot.sys FEB26E3B8345A7E8D62F945C4AE86562
C:\Windows\System32\drivers\VerifierExt.sys A026EDEAA5EECAE0B08E2748B616D4BD
C:\Windows\System32\drivers\vhdmp.sys 34CAF69BF4166AB40BFF0ED068FF6F91
C:\Windows\System32\drivers\viaide.sys 06D38968028E9AB19DE9B618C7B6D199
C:\Windows\System32\drivers\Vid.sys 3CE922E34DB12D9F3C0EA856BC09687C
C:\Windows\System32\drivers\vmbus.sys 511AD3FF957A0127E6BD336FF6F89C38
C:\Windows\System32\drivers\VMBusHID.sys DA40BEA0A863CE768C940CA9723BF81F
C:\Windows\System32\drivers\vmbusr.sys 68F8C26DEA2D42E8DEC0778943433C80
C:\Windows\System32\drivers\volmgr.sys 436E1A724E7E683F6B612D3D58F04241
C:\Windows\System32\drivers\volmgrx.sys CCB9E901F7254BF96D28EB1B0E5329B7
C:\Windows\System32\drivers\volsnap.sys 17F7B0F2298D97F4B6C7A69511033D3D
C:\Windows\System32\drivers\vpci.sys DAC438FB5FF85A9E72806E2341D5D732
C:\Windows\System32\drivers\vpcivsp.sys BEE38B3B44364E01BF28640EE8B5617E
C:\Windows\System32\drivers\vsmraid.sys 4539F45F9F4C9757A86A56C949421E07
C:\Windows\System32\drivers\vstxraid.sys 0849B7260F26FE05EA56DED0672E2F4B
C:\Windows\System32\drivers\vwifibus.sys BE970C369E43B509C1EDA2B8FA7CECB0
C:\Windows\System32\drivers\wacompen.sys 0910AB9ED404C1434E2D0376C2AD5D8B
C:\Windows\system32\drivers\WdBoot.sys 81285DDC994F03379DB46419300B2DCB
C:\Windows\System32\drivers\Wdf01000.sys CB6C63FF8342B467E2EF76E98D5B934D
C:\Windows\system32\drivers\WdFilter.sys 26B8FED3F3B85F5F0C4BD03FD00B9941
C:\Windows\System32\Drivers\WdNisDrv.sys CE67080F00E0AF32755096CEA6430ABA
C:\Windows\System32\DRIVERS\wfplwfs.sys 715ABA3DD164D06457A2A3C92F6EA9D5
C:\Windows\System32\drivers\wimmount.sys 5F66B7BB330AA80067FC66149A692620
C:\Windows\system32\DRIVERS\WinUsb.sys 3AF1FA17F1C4ACBDB660D8F98B1A9C13
C:\Windows\System32\drivers\wmiacpi.sys 2834D9D3B4F554A39C72F00EA3F0E128
C:\Windows\System32\Drivers\Wof.sys 7FC5667DF73D4B04AA457CC3A4180E09
C:\Windows\System32\DRIVERS\wpcfltr.sys A2468CC3509394A33C4C32F99563D845
C:\Windows\System32\drivers\WpdUpFltr.sys 9F2904B55F6CECCD1A8D986B5CE2609A
C:\Windows\system32\drivers\ws2ifsl.sys AE072B0339D0A18E455DC21666CAD572
C:\Windows\System32\drivers\WudfPf.sys 481286719402E4BAEFEA0604AB1B5113
C:\Windows\System32\drivers\WUDFRd.sys D7B4859227B02BCC1055B279A63C937F
C:\Windows\system32\DRIVERS\WUDFRd.sys D7B4859227B02BCC1055B279A63C937F
C:\Windows\system32\DRIVERS\WUDFRd.sys D7B4859227B02BCC1055B279A63C937F
C:\Windows\system32\DRIVERS\WUDFRd.sys D7B4859227B02BCC1055B279A63C937F

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== Three Months Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-06-26 10:43 - 2016-06-26 10:43 - 00034742 _____ C:\Users\Танер\Downloads\FRST.txt
2016-06-26 10:43 - 2016-06-26 10:43 - 00000000 ____D C:\FRST
2016-06-26 10:42 - 2016-06-26 10:42 - 02387456 _____ (Farbar) C:\Users\Танер\Downloads\FRST64.exe
2016-06-24 19:10 - 2016-06-24 19:10 - 00000000 ____D C:\Users\Танер\AppData\Roaming\PlaysTV
2016-06-19 20:37 - 2016-06-19 20:37 - 00000000 ____D C:\Windows\system32\appmgmt
2016-06-19 18:32 - 2016-06-19 18:35 - 00075448 _____ C:\Windows\system32\Drivers\fsbts.sys
2016-06-19 18:30 - 2016-06-19 18:30 - 00863712 _____ (F-Secure Corporation) C:\Users\Танер\Downloads\F-Secure-Safe-Network-Installer_11crxfzama6v3_.exe
2016-06-19 18:30 - 2016-06-19 18:30 - 00002146 _____ C:\Users\Public\Desktop\F-Secure SAFE.lnk
2016-06-19 18:30 - 2016-06-19 18:30 - 00000000 ____D C:\Windows\System32\Tasks\F-Secure
2016-06-19 18:30 - 2016-06-19 18:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\F-Secure
2016-06-19 18:30 - 2016-06-19 18:30 - 00000000 ____D C:\Program Files (x86)\F-Secure
2016-06-19 18:23 - 2016-06-19 20:59 - 00000000 ____D C:\Users\Танер\AppData\Local\FSDART
2016-06-19 18:23 - 2016-06-19 18:23 - 00524248 _____ (F-Secure Corporation) C:\Users\Танер\Downloads\F-SecureOnlineScanner.exe
2016-06-19 18:06 - 2016-06-19 18:06 - 22851472 _____ (Malwarebytes ) C:\Users\Танер\Downloads\mbam-setup-2.2.1.1043(1).exe
2016-06-14 20:19 - 2016-06-03 20:11 - 00472576 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2016-06-14 20:19 - 2016-06-03 16:38 - 01413120 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2016-06-14 20:19 - 2016-06-02 20:51 - 00050352 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2016-06-14 20:19 - 2016-05-29 18:04 - 01204224 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2016-06-14 20:19 - 2016-05-29 18:04 - 00569856 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2016-06-14 20:19 - 2016-05-29 18:04 - 00544256 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2016-06-14 20:19 - 2016-05-29 18:04 - 00276480 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2016-06-14 20:19 - 2016-05-29 18:04 - 00265216 _____ (Microsoft Corporation) C:\Windows\system32\centel.dll
2016-06-14 20:19 - 2016-05-29 18:04 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2016-06-14 20:19 - 2016-05-21 20:28 - 25802752 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-06-14 20:19 - 2016-05-18 08:31 - 00372568 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2016-06-14 20:19 - 2016-05-18 08:31 - 00315224 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2016-06-14 20:19 - 2016-05-17 00:13 - 00563016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2016-06-14 20:19 - 2016-05-17 00:13 - 00397224 _____ (Microsoft Corporation) C:\Windows\system32\bcryptprimitives.dll
2016-06-14 20:19 - 2016-05-17 00:13 - 00340872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcryptprimitives.dll
2016-06-14 20:19 - 2016-05-17 00:13 - 00178008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2016-06-14 20:19 - 2016-05-14 02:09 - 04169216 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-06-14 20:19 - 2016-05-14 02:07 - 00675328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2016-06-14 20:19 - 2016-05-14 02:07 - 00416768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2016-06-14 20:19 - 2016-05-14 02:06 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2016-06-14 20:19 - 2016-05-14 02:04 - 00044032 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2016-06-14 20:19 - 2016-05-14 01:34 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2016-06-14 20:19 - 2016-05-14 01:19 - 00035840 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2016-06-14 20:19 - 2016-05-14 00:58 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2016-06-14 20:19 - 2016-05-12 21:38 - 00135336 _____ (Microsoft Corporation) C:\Windows\system32\gpapi.dll
2016-06-14 20:19 - 2016-05-12 20:43 - 00115704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gpapi.dll
2016-06-14 20:19 - 2016-05-12 19:24 - 00678912 _____ (Microsoft Corporation) C:\Windows\system32\gpprefcl.dll
2016-06-14 20:19 - 2016-05-12 19:17 - 00331776 _____ (Microsoft Corporation) C:\Windows\system32\polstore.dll
2016-06-14 20:19 - 2016-05-12 19:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\gpscript.dll
2016-06-14 20:19 - 2016-05-12 19:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\FwRemoteSvr.dll
2016-06-14 20:19 - 2016-05-12 19:07 - 01360896 _____ (Microsoft Corporation) C:\Windows\system32\gpsvc.dll
2016-06-14 20:19 - 2016-05-12 18:59 - 00398848 _____ (Microsoft Corporation) C:\Windows\system32\IPSECSVC.DLL
2016-06-14 20:19 - 2016-05-12 18:48 - 00580096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gpprefcl.dll
2016-06-14 20:19 - 2016-05-12 18:43 - 00291328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\polstore.dll
2016-06-14 20:19 - 2016-05-12 18:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gpscript.dll
2016-06-14 20:19 - 2016-05-12 18:37 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FwRemoteSvr.dll
2016-06-14 20:19 - 2016-05-10 00:35 - 07075328 _____ (Microsoft Corporation) C:\Windows\system32\glcndFilter.dll
2016-06-14 20:19 - 2016-05-09 23:56 - 05270016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\glcndFilter.dll
2016-06-14 20:19 - 2016-05-09 23:45 - 07793152 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Data.Pdf.dll
2016-06-14 20:19 - 2016-05-09 23:23 - 05265920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Data.Pdf.dll
2016-06-14 20:19 - 2016-05-06 18:45 - 00748544 _____ (Microsoft Corporation) C:\Windows\system32\StructuredQuery.dll
2016-06-14 20:19 - 2016-05-06 18:23 - 00503808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\StructuredQuery.dll
2016-06-14 20:19 - 2016-04-14 18:25 - 02778624 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2016-06-14 20:19 - 2016-04-14 18:11 - 02464768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2016-06-14 20:19 - 2016-04-12 18:46 - 14467584 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2016-06-14 20:19 - 2016-04-12 18:30 - 12879872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2016-06-14 20:19 - 2016-01-31 22:17 - 00118624 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2016-06-14 20:19 - 2016-01-31 21:07 - 00110080 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2016-06-14 20:19 - 2016-01-31 20:42 - 03320832 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2016-06-14 20:19 - 2016-01-31 20:14 - 03607040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2016-06-14 20:18 - 2016-05-21 19:57 - 20341248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-06-14 20:18 - 2016-05-21 01:09 - 00572416 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-06-14 20:18 - 2016-05-21 01:08 - 02895360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-06-14 20:18 - 2016-05-21 01:02 - 06051328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-06-14 20:18 - 2016-05-21 00:57 - 00497664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2016-06-14 20:18 - 2016-05-21 00:55 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2016-06-14 20:18 - 2016-05-21 00:54 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-06-14 20:18 - 2016-05-21 00:50 - 02287104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2016-06-14 20:18 - 2016-05-21 00:44 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2016-06-14 20:18 - 2016-05-21 00:29 - 13815808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-06-14 20:18 - 2016-05-21 00:27 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2016-06-14 20:18 - 2016-05-21 00:25 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2016-06-14 20:18 - 2016-05-21 00:25 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2016-06-14 20:18 - 2016-05-21 00:21 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2016-06-14 20:18 - 2016-05-21 00:21 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2016-06-14 20:18 - 2016-05-21 00:19 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2016-06-14 20:18 - 2016-05-21 00:16 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2016-06-14 20:18 - 2016-05-21 00:14 - 04610048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-06-14 20:18 - 2016-05-21 00:12 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2016-06-14 20:18 - 2016-05-21 00:11 - 15420928 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-06-14 20:18 - 2016-05-21 00:11 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2016-06-14 20:18 - 2016-05-21 00:09 - 00693248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2016-06-14 20:18 - 2016-05-21 00:09 - 00379392 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2016-06-14 20:18 - 2016-05-21 00:08 - 02055680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2016-06-14 20:18 - 2016-05-21 00:08 - 00806400 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-06-14 20:18 - 2016-05-21 00:06 - 02131968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-06-14 20:18 - 2016-05-20 23:46 - 02597888 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-06-14 20:18 - 2016-05-20 23:42 - 02121216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2016-06-14 20:18 - 2016-05-20 23:38 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-06-14 20:18 - 2016-05-20 23:38 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2016-06-14 20:18 - 2016-05-20 23:34 - 01544192 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-06-14 20:18 - 2016-05-20 23:23 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2016-06-14 20:18 - 2016-05-19 02:15 - 01379040 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2016-06-14 20:18 - 2016-05-18 23:35 - 01097216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2016-06-14 20:18 - 2016-05-14 23:01 - 00363104 _____ (Microsoft Corporation) C:\Windows\system32\ws2_32.dll
2016-06-14 20:18 - 2016-05-14 23:01 - 00320720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ws2_32.dll
2016-06-14 20:18 - 2016-05-14 02:07 - 00281088 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbt.sys
2016-06-14 20:18 - 2016-05-14 00:58 - 00339456 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2016-06-14 20:18 - 2016-05-14 00:45 - 00802816 _____ (Microsoft Corporation) C:\Windows\system32\winhttp.dll
2016-06-14 20:18 - 2016-05-14 00:35 - 00286208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2016-06-14 20:18 - 2016-05-14 00:26 - 00631808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winhttp.dll
2016-06-12 16:09 - 2016-06-17 22:41 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-05-25 21:16 - 2016-05-25 21:17 - 00000000 ____D C:\Users\Танер\Downloads\Deadpool.2016.BRRip.XviD-ETRG
2016-05-25 21:16 - 2016-05-25 21:16 - 00031761 _____ C:\Users\Танер\Downloads\deadpool.2016.720p.bluray.x264-sparks(subsunacs.net).rar
2016-05-25 21:15 - 2016-05-25 21:15 - 00014758 _____ C:\Users\Танер\Downloads\Deadpool.2016.BRRip.XviD-ETRG.torrent
2016-05-25 20:14 - 2016-05-25 20:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vulkan 1.0.3.1
2016-05-25 20:14 - 2016-05-25 20:14 - 00000000 ____D C:\Program Files (x86)\VulkanRT
2016-05-25 20:14 - 2016-05-25 20:14 - 00000000 ____D C:\Program Files (x86)\AMD
2016-05-25 20:14 - 2016-02-16 02:27 - 00125720 _____ C:\Windows\SysWOW64\vulkan-1.dll
2016-05-25 20:14 - 2016-02-16 02:26 - 00126232 _____ C:\Windows\system32\vulkan-1.dll
2016-05-25 20:14 - 2016-02-16 02:25 - 00045848 _____ C:\Windows\system32\vulkaninfo.exe
2016-05-25 20:14 - 2016-02-16 02:25 - 00042264 _____ C:\Windows\SysWOW64\vulkaninfo.exe
2016-05-22 16:18 - 2016-05-22 16:18 - 00008192 _____ C:\Windows\system32\config\userdiff
2016-05-18 21:28 - 2016-05-18 21:28 - 00879750 _____ C:\Users\Танер\Downloads\CRM Systems.pdf
2016-05-10 21:51 - 2016-04-07 00:13 - 00137976 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2016-05-10 21:51 - 2016-04-06 21:20 - 00201728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2016-05-10 21:51 - 2016-04-06 21:19 - 00401920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2016-05-10 21:51 - 2016-04-06 21:19 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2016-05-10 21:51 - 2016-04-06 20:49 - 00120384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2016-05-10 21:51 - 2016-04-06 19:57 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2016-05-10 21:51 - 2016-04-06 19:52 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2016-05-10 21:51 - 2016-04-06 18:48 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2016-05-10 21:50 - 2016-04-22 22:14 - 00725504 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2016-05-10 21:50 - 2016-04-22 21:52 - 00330752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2016-05-10 21:49 - 2016-04-10 10:48 - 00738096 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2016-05-10 21:49 - 2016-04-10 10:48 - 00613624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2016-05-10 21:49 - 2016-03-31 09:50 - 01307328 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2016-05-10 21:49 - 2016-03-31 06:40 - 00747520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2016-05-10 21:49 - 2016-03-29 04:42 - 07446368 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2016-05-10 21:49 - 2016-03-12 03:49 - 02466136 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2016-05-10 21:49 - 2016-03-12 03:47 - 00160160 _____ (Microsoft Corporation) C:\Windows\system32\IPHLPAPI.DLL
2016-05-10 21:49 - 2016-03-12 03:47 - 00121912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IPHLPAPI.DLL
2016-05-10 21:49 - 2016-03-10 19:55 - 00510976 _____ (Microsoft Corporation) C:\Windows\system32\webio.dll
2016-05-10 21:49 - 2016-03-10 19:42 - 00413696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webio.dll
2016-05-10 21:49 - 2016-02-27 21:28 - 00131584 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2016-05-10 21:49 - 2016-02-27 20:57 - 03273728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpcore.dll
2016-05-10 21:49 - 2016-02-27 20:19 - 03820544 _____ (Microsoft Corporation) C:\Windows\system32\rdpcore.dll
2016-05-10 21:49 - 2016-02-27 19:32 - 03547648 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2016-05-10 21:48 - 2016-04-11 09:21 - 00074584 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\volmgr.sys
2016-05-10 21:48 - 2016-04-10 08:37 - 01549144 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2016-05-10 21:48 - 2016-04-10 07:21 - 01763376 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2016-05-10 21:48 - 2016-04-10 07:21 - 01489088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2016-05-10 21:48 - 2016-04-10 00:58 - 00534016 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.dll
2016-05-10 21:48 - 2016-04-10 00:50 - 00375296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.dll
2016-05-10 21:48 - 2016-03-16 04:58 - 00442712 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2016-05-10 21:48 - 2016-03-16 04:58 - 00332632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2016-05-10 21:48 - 2016-03-14 19:50 - 00316760 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2016-05-10 21:48 - 2016-03-10 20:03 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\dsparse.dll
2016-05-10 21:48 - 2016-03-10 19:52 - 00186880 _____ (Microsoft Corporation) C:\Windows\system32\dpapisrv.dll
2016-05-10 21:48 - 2016-03-10 19:48 - 00024064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dsparse.dll
2016-05-10 21:48 - 2016-03-05 20:44 - 00148480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shacct.dll
2016-05-10 21:48 - 2016-03-05 20:04 - 00192512 _____ (Microsoft Corporation) C:\Windows\system32\shacct.dll
2016-04-23 06:38 - 2016-04-23 06:38 - 00092255 _____ C:\Users\Танер\Downloads\lect_06.pdf
2016-04-16 18:31 - 2016-04-16 18:31 - 101875656 _____ (Lenovo Group Limited ) C:\Users\Танер\Downloads\wwe3038e.exe
2016-04-16 14:20 - 2016-05-22 13:09 - 00003813 _____ C:\Windows\diagwrn.xml
2016-04-16 14:20 - 2016-05-22 13:09 - 00003813 _____ C:\Windows\diagerr.xml
2016-04-13 07:23 - 2016-03-28 16:21 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2016-04-13 07:23 - 2016-03-11 17:48 - 00833024 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll
2016-04-13 07:23 - 2016-03-10 20:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\samlib.dll
2016-04-13 07:23 - 2016-03-10 19:48 - 00064512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\samlib.dll
2016-04-13 07:23 - 2016-03-03 19:47 - 02345472 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2016-04-13 07:23 - 2016-03-03 19:33 - 01556992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2016-04-13 07:23 - 2016-03-03 04:39 - 01661576 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2016-04-13 07:23 - 2016-03-03 04:39 - 01212248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2016-04-13 07:23 - 2016-02-05 17:46 - 01455104 _____ (Microsoft Corporation) C:\Windows\system32\VSSVC.exe
2016-04-13 07:23 - 2016-02-02 21:16 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rasl2tp.sys
2016-04-13 07:23 - 2016-02-02 20:51 - 00162304 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2016-04-13 07:23 - 2016-02-02 20:19 - 00144384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll
2016-04-13 07:23 - 2016-02-02 20:01 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\WsmAgent.dll
2016-04-13 07:23 - 2016-02-02 19:51 - 02609152 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2016-04-13 07:23 - 2016-02-02 19:48 - 00285184 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2016-04-13 07:23 - 2016-02-02 19:46 - 00026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAgent.dll
2016-04-13 07:23 - 2016-02-02 19:41 - 02170880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2016-04-13 07:23 - 2016-02-02 19:39 - 00236032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll
2016-04-13 07:23 - 2016-01-27 18:18 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2016-04-13 07:23 - 2016-01-21 22:35 - 00952928 _____ (Microsoft Corporation) C:\Windows\system32\mfmp4srcsnk.dll
2016-04-13 07:23 - 2016-01-21 21:42 - 00786152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmp4srcsnk.dll
2016-04-13 07:22 - 2016-03-10 22:17 - 01133752 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2016-04-13 07:22 - 2016-03-10 20:48 - 00862720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2016-04-13 07:22 - 2016-03-10 20:43 - 00161280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msorcl32.dll
2016-04-13 07:22 - 2016-03-10 19:55 - 00166400 _____ (Microsoft Corporation) C:\Windows\system32\mtxoci.dll
2016-04-13 07:22 - 2016-03-10 19:42 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mtxoci.dll
2016-04-13 07:22 - 2016-02-09 04:31 - 22365472 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2016-04-13 07:22 - 2016-02-09 04:31 - 19794896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2016-04-13 07:22 - 2016-02-09 04:31 - 02757616 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2016-04-13 07:22 - 2016-02-09 04:31 - 02412576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2016-04-13 07:22 - 2016-02-09 04:31 - 00273264 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsAdminFlows.exe
2016-04-13 07:22 - 2016-02-08 23:55 - 02712576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2016-04-13 07:22 - 2016-02-08 23:15 - 02551808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\themecpl.dll
2016-04-13 07:22 - 2016-02-08 23:02 - 01197056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usercpl.dll
2016-04-13 07:22 - 2016-02-08 22:43 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSyncHost.exe
2016-04-13 07:22 - 2016-02-08 22:40 - 00539648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hgcpl.dll
2016-04-13 07:22 - 2016-02-08 22:39 - 00305152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\stobject.dll
2016-04-13 07:22 - 2016-02-08 22:37 - 00141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingMonitor.dll
2016-04-13 07:22 - 2016-02-08 22:35 - 00954880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.appcore.dll
2016-04-13 07:22 - 2016-02-08 22:34 - 00667648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSyncCore.dll
2016-04-13 07:22 - 2016-02-08 22:33 - 00520192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSync.dll
2016-04-13 07:22 - 2016-02-08 21:50 - 03120640 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2016-04-13 07:22 - 2016-02-08 20:55 - 02592256 _____ (Microsoft Corporation) C:\Windows\system32\themecpl.dll
2016-04-13 07:22 - 2016-02-08 20:33 - 01278464 _____ (Microsoft Corporation) C:\Windows\system32\usercpl.dll
2016-04-13 07:22 - 2016-02-08 20:02 - 00653824 _____ (Microsoft Corporation) C:\Windows\system32\SettingSyncHost.exe
2016-04-13 07:22 - 2016-02-08 20:00 - 00599552 _____ (Microsoft Corporation) C:\Windows\system32\hgcpl.dll
2016-04-13 07:22 - 2016-02-08 19:58 - 00336384 _____ (Microsoft Corporation) C:\Windows\system32\stobject.dll
2016-04-13 07:22 - 2016-02-08 19:55 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\SettingMonitor.dll
2016-04-13 07:22 - 2016-02-08 19:53 - 02171904 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsAdminFlowUI.dll
2016-04-13 07:22 - 2016-02-08 19:53 - 01348096 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentServer.dll
2016-04-13 07:22 - 2016-02-08 19:50 - 01220096 _____ (Microsoft Corporation) C:\Windows\system32\twinui.appcore.dll
2016-04-13 07:22 - 2016-02-08 19:50 - 00841728 _____ (Microsoft Corporation) C:\Windows\system32\SettingSyncCore.dll
2016-04-13 07:22 - 2016-02-08 19:48 - 00655872 _____ (Microsoft Corporation) C:\Windows\system32\SettingSync.dll
2016-04-13 07:22 - 2016-02-08 19:47 - 02819584 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers.dll
2016-04-13 07:22 - 2016-02-08 19:44 - 00955392 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentExtensions.dll
2016-04-13 07:22 - 2016-02-03 18:14 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\IPMIDrv.sys
2016-04-13 07:22 - 2016-02-03 18:11 - 01673728 _____ (Microsoft Corporation) C:\Windows\system32\workfolderssvc.dll
2016-04-13 07:22 - 2016-02-02 20:15 - 00787456 _____ (Microsoft Corporation) C:\Windows\system32\WorkfoldersControl.dll
2016-04-13 07:22 - 2016-01-26 22:15 - 00072024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vpci.sys
2016-04-13 07:22 - 2016-01-26 17:48 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vpcivsp.sys
2016-04-13 07:22 - 2016-01-22 08:22 - 02487296 _____ (Microsoft Corporation) C:\Windows\system32\storagewmi.dll
2016-04-13 07:22 - 2016-01-22 08:11 - 01482240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\storagewmi.dll
2016-04-13 07:22 - 2016-01-21 01:40 - 00099672 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\disk.sys
2016-04-13 07:22 - 2014-11-08 05:38 - 00166912 _____ (Microsoft Corporation) C:\Windows\system32\AppxAllUserStore.dll
2016-04-13 07:22 - 2014-11-08 05:17 - 00143360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppxAllUserStore.dll
2016-04-13 07:21 - 2016-05-10 21:47 - 01737088 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2016-04-13 07:21 - 2016-05-10 21:47 - 01663184 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2016-04-13 07:21 - 2016-05-10 21:47 - 01523208 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2016-04-13 07:21 - 2016-05-10 21:47 - 01501488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2016-04-13 07:21 - 2016-05-10 21:47 - 01490120 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2016-04-13 07:21 - 2016-05-10 21:47 - 01358952 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2016-04-13 07:21 - 2016-05-10 21:47 - 00246784 _____ (Microsoft Corporation) C:\Windows\system32\microsoft-windows-system-events.dll
2016-04-13 07:21 - 2016-03-03 19:13 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\basesrv.dll
2016-04-13 07:21 - 2016-02-05 22:07 - 00378712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2016-04-13 07:21 - 2016-02-05 18:11 - 00845312 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL
2016-04-13 07:21 - 2016-02-05 18:11 - 00422400 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2016-04-13 07:21 - 2016-02-05 18:07 - 00272384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2016-04-13 07:21 - 2016-02-05 18:02 - 01083904 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2016-04-13 07:21 - 2016-02-04 21:07 - 00222720 _____ (Microsoft Corporation) C:\Windows\system32\dhcpsapi.dll
2016-04-13 07:21 - 2016-02-04 20:35 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dhcpsapi.dll
2016-04-13 07:21 - 2016-02-04 19:23 - 00713216 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2016-04-13 07:21 - 2016-02-04 19:22 - 00561664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2016-04-13 07:21 - 2016-02-02 20:18 - 01574912 _____ (Microsoft Corporation) C:\Windows\system32\wbengine.exe
2016-04-13 07:20 - 2016-02-07 02:05 - 00551256 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\vhdmp.sys
2016-04-13 07:20 - 2016-01-31 20:17 - 00779264 _____ (Microsoft Corporation) C:\Windows\system32\WindowsAnytimeUpgradeui.exe
2016-04-02 23:19 - 2016-05-23 15:36 - 00000000 ____D C:\Users\Танер\AppData\Local\CrashDumps
2016-04-02 16:30 - 2016-04-02 16:30 - 134765514 _____ C:\Users\Танер\Downloads\Horny_Couple_From_Belgium_Part_2_Now_Girls_Only.mp4
2016-04-02 16:28 - 2016-04-02 16:28 - 25386518 _____ C:\Users\Танер\Downloads\Horny_Couple_From_Belgium_Part_1.mp4
2016-04-02 13:56 - 2016-04-02 13:56 - 00000000 ____D C:\Users\Танер\AppData\Roaming\TechSmith
2016-04-02 13:55 - 2016-04-02 13:55 - 00000000 ____D C:\Users\Танер\Documents\Camtasia Studio
2016-04-02 13:55 - 2016-04-02 13:55 - 00000000 ____D C:\Users\Танер\AppData\Local\TechSmith
2016-04-02 13:51 - 2016-04-02 13:53 - 263998976 _____ C:\Users\Танер\Downloads\camtasia.msi

==================== Three Months Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-06-26 10:41 - 2015-09-24 23:12 - 00000000 ____D C:\Users\Танер\AppData\Roaming\Skype
2016-06-26 10:33 - 2015-10-18 22:12 - 00001018 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-06-26 10:15 - 2015-09-25 08:46 - 00000000 ____D C:\Users\Танер\AppData\Roaming\OBS
2016-06-26 10:08 - 2015-09-25 12:11 - 00000000 ____D C:\Users\Танер\AppData\Roaming\vlc
2016-06-25 20:33 - 2015-10-18 22:12 - 00001014 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-06-25 19:10 - 2015-12-05 14:21 - 00000000 ____D C:\Users\Танер\AppData\Roaming\Raptr
2016-06-25 13:46 - 2015-09-24 21:27 - 03830784 ___SH C:\Users\Танер\Desktop\Thumbs.db
2016-06-24 19:30 - 2015-09-24 19:59 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-148641092-2717288511-1045065011-1001
2016-06-23 21:36 - 2015-12-05 14:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Gaming Evolved
2016-06-23 01:37 - 2016-01-03 20:24 - 00075776 ___SH C:\Users\Танер\Downloads\Thumbs.db
2016-06-22 19:30 - 2014-11-22 04:00 - 01053900 _____ C:\Windows\system32\PerfStringBackup.INI
2016-06-22 19:30 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\Inf
2016-06-19 20:59 - 2015-09-24 19:59 - 00065536 _____ C:\Windows\system32\spu_storage.bin
2016-06-19 20:59 - 2013-08-22 17:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-06-19 20:59 - 2013-08-22 16:25 - 00262144 ___SH C:\Windows\system32\config\BBI
2016-06-19 20:37 - 2015-09-24 19:51 - 00000000 ____D C:\Users\Танер
2016-06-19 18:42 - 2016-02-25 21:16 - 00000000 ____D C:\Users\Танер\AppData\Local\F-Secure
2016-06-19 18:32 - 2016-02-25 21:16 - 00000000 ____D C:\ProgramData\F-Secure
2016-06-19 13:50 - 2013-08-22 18:36 - 00000000 ___HD C:\Program Files\WindowsApps
2016-06-19 13:50 - 2013-08-22 18:36 - 00000000 ____D C:\Windows\AppReadiness
2016-06-18 18:07 - 2013-08-22 18:36 - 00000000 ____D C:\Windows\rescache
2016-06-18 10:46 - 2016-03-06 06:59 - 00085504 ___SH C:\Users\Танер\Documents\Thumbs.db
2016-06-18 08:34 - 2015-10-18 22:12 - 00002213 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-06-18 08:34 - 2015-10-18 22:12 - 00002201 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-06-17 22:41 - 2015-09-24 22:21 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-06-17 22:41 - 2013-08-22 17:44 - 00404568 _____ C:\Windows\system32\FNTCACHE.DAT
2016-06-17 09:57 - 2015-09-27 00:45 - 00000000 ____D C:\Windows\system32\appraiser
2016-06-17 09:57 - 2013-08-22 18:36 - 00000000 ___RD C:\Windows\ToastData
2016-06-17 09:57 - 2013-08-22 18:36 - 00000000 ____D C:\Windows\SysWOW64\en-GB
2016-06-17 09:57 - 2013-08-22 18:36 - 00000000 ____D C:\Windows\system32\en-GB
2016-06-16 20:47 - 2013-08-22 18:20 - 00000000 ____D C:\Windows\CbsTemp
2016-06-16 20:46 - 2015-09-26 15:01 - 00000000 ____D C:\Windows\system32\MRT
2016-06-16 20:44 - 2015-09-26 15:01 - 142482544 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-06-15 23:40 - 2015-09-26 13:28 - 00484008 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2016-06-14 20:13 - 2014-11-22 08:20 - 00828408 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-06-14 20:13 - 2014-11-22 08:20 - 00176632 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-06-05 00:17 - 2016-02-06 19:04 - 00000000 ____D C:\Users\MSSQL$SQLEXPRESS

Some files in TEMP:
====================
C:\Users\Танер\AppData\Local\Temp\AMDCleanupUtility.exe
C:\Users\Танер\AppData\Local\Temp\Cleanup.dll
C:\Users\Танер\AppData\Local\Temp\ddu.exe
C:\Users\Танер\AppData\Local\Temp\difxapi.dll
C:\Users\Танер\AppData\Local\Temp\ghptwvlc.dll
C:\Users\Танер\AppData\Local\Temp\msvcm80.dll
C:\Users\Танер\AppData\Local\Temp\msvcp80.dll
C:\Users\Танер\AppData\Local\Temp\msvcr80.dll
C:\Users\Танер\AppData\Local\Temp\playstv_patch.exe
C:\Users\Танер\AppData\Local\Temp\radeon-crimson-15.11-minimalsetup.exe
C:\Users\Танер\AppData\Local\Temp\raptrpatch.exe
C:\Users\Танер\AppData\Local\Temp\raptr_stub.exe
C:\Users\Танер\AppData\Local\Temp\SkypeSetup.exe

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

==================== BCD ================================

Windows Boot Manager
--------------------
identifier              {bootmgr}
device                  partition=\Device\HarddiskVolume1
description             Windows Boot Manager
locale                  en-GB
inherit                 {globalsettings}
integrityservices       Enable
default                 {current}
resumeobject            {d751bc51-62f4-11e5-913a-f11166dae7a8}
displayorder            {current}
toolsdisplayorder       {memdiag}
timeout                 30

Windows Boot Loader
-------------------
identifier              {current}
device                  partition=C:
path                    \Windows\system32\winload.exe
description             Windows 8.1
locale                  en-GB
inherit                 {bootloadersettings}
recoverysequence        {d751bc53-62f4-11e5-913a-f11166dae7a8}
integrityservices       Enable
volumebandid            1
recoveryenabled         Yes
allowedinmemorysettings 0x15000075
osdevice                partition=C:
systemroot              \Windows
resumeobject            {d751bc51-62f4-11e5-913a-f11166dae7a8}
nx                      OptIn
bootmenupolicy          Standard
useplatformclock        Yes

Windows Boot Loader
-------------------
identifier              {d751bc53-62f4-11e5-913a-f11166dae7a8}
device                  ramdisk=[C:]\Recovery\WindowsRE\Winre.wim,{d751bc54-62f4-11e5-913a-f11166dae7a8}
path                    \windows\system32\winload.exe
description             Windows Recovery Environment
locale                  en-GB
inherit                 {bootloadersettings}
displaymessage          Recovery
displaymessageoverride Recovery
osdevice                ramdisk=[C:]\Recovery\WindowsRE\Winre.wim,{d751bc54-62f4-11e5-913a-f11166dae7a8}
systemroot              \windows
nx                      OptIn
bootmenupolicy          Standard
winpe                   Yes

Resume from Hibernate
---------------------
identifier              {d751bc51-62f4-11e5-913a-f11166dae7a8}
device                  partition=C:
path                    \Windows\system32\winresume.exe
description             Windows Resume Application
locale                  en-GB
inherit                 {resumeloadersettings}
recoverysequence        {d751bc53-62f4-11e5-913a-f11166dae7a8}
recoveryenabled         Yes
allowedinmemorysettings 0x15000075
filedevice              partition=C:
filepath                \hiberfil.sys
bootmenupolicy          Standard
debugoptionenabled      No

Windows Memory Tester
---------------------
identifier              {memdiag}
device                  partition=\Device\HarddiskVolume1
path                    \boot\memtest.exe
description             Windows Memory Diagnostic
locale                  en-GB
inherit                 {globalsettings}
badmemoryaccess         Yes

EMS Settings
------------
identifier {emssettings}
bootems No

Debugger Settings
-----------------
identifier              {dbgsettings}
debugtype               Serial
debugport               1
baudrate                115200

RAM Defects
-----------
identifier {badmemory}

Global Settings
---------------
identifier              {globalsettings}
inherit                 {dbgsettings}
                        {emssettings}
                        {badmemory}

Boot Loader Settings
--------------------
identifier              {bootloadersettings}
inherit                 {globalsettings}
                        {hypervisorsettings}

Hypervisor Settings
-------------------
identifier              {hypervisorsettings}
hypervisordebugtype     Serial
hypervisordebugport     1
hypervisorbaudrate      115200

Resume Loader Settings
----------------------
identifier {resumeloadersettings}
inherit {globalsettings}

Device options
--------------
identifier              {d751bc54-62f4-11e5-913a-f11166dae7a8}
description             Windows Recovery
ramdisksdidevice        partition=C:
ramdisksdipath          \Recovery\WindowsRE\boot.sdi

LastRegBack: 2016-06-23 20:59

==================== End of FRST.txt ============================

Благодаря предварително!

Shortcut.txt

Addition.txt

26 юни 201610 г.

Здравейте,

В кой браузър се появява проблема, защото логовете са чисти и активни зарази не се наблюдават?

27 юни 201610 г.

Автор

Здравейте,

В абсолютно всички браузъри ме пренасочва - Mozilla, Chrome, Maxthon... тези ползвам.

27 юни 201610 г.

Изтеглете fixlist.txt и го запазете на десктопа.
Стартирайте FRST.exe и натиснете бутона Fix веднъж!
След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.

Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

След това пишете дали има подобрение.

Поздрави!

27 юни 201610 г.

Автор

Здравейте,

Прилагам Fixlog. Накрая леко крашна и не съм сигурен дали си изпълни цялата работа, надявам се да е. Допълнително ще пиша дали има подобрение.

Fixlog.txt

Редактирано 27 юни 201610 г. от joax (преглед на промените)

27 юни 201610 г.

Не се е изпълнил целия. В notepad запазете следната информация с името fixlist.txt и повторете стъпките и публикувайте новия fixlog.txt

Цитат

start
cmd: bitsadmin /reset /allusers
cmd: netsh winsock reset catalog
cmd: ipconfig /flushdns
RemoveProxy:
EmptyTemp:
end

Поздрави!

27 юни 201610 г.

Автор

Прилагам новия Fixlog, който се replace-на в/у стария. Този път се изискваше рестарт и го направих.

Edit: За съжаление отново ме пренасочва в тези сайтове

Fixlog.txt

Редактирано 27 юни 201610 г. от joax (преглед на промените)

28 юни 201610 г.

Странно...логовете са чисти, гледам не използвате рутер, чийто настройки може да са похитени, почистихме DNS кеша, който може да е бил отровен, почистихме някои нежелани добавки към Mozilla Firefox и Google Chrome, почистихме временните файлове и прокси настройките, почистихме едно съмнително IP в настройките, както и групови политики...Не остават много опции. Да сканираме с още няколко инструмента и ако не се получи трябва или да възстановите настройките на браузърите по подразбиране или направо да прекъснете синхронизациите на браузърите с облака и след това да деинсталирате браузърите с програма като GeekUninstaller и да изтриете всички остатъци от тях и след това да ги инсталирате наново.

СТЪПКА 1

Изтеглете и стартирайте AdwCleaner.exe.
Натиснете бутона Scan.
AdwCleaner ще започне да проверява компютъра.
След като проверката приключи натиснете бутона Clean.
Програмата ще затвори всички излишни процеси и след почистването ще иска да рестартира машината. Съгласете се.
Ще се появи автоматично лог файл с името (AdwCleaner[S1].txt и AdwCleaner[С1].txt) в C:\Adwcleaner
Публикувайте съдържанието на AdwCleaner[С1].txt в следващия си коментар.

СТЪПКА 2

Моля изтеглете Junkware Removal Tool на вашия десктоп.

Спрете временно работата на защитните програми. Вижте тук ако се затруднявате как.
Стартирайте инструмента JRT.exe
Ще се отвори ДОС прозорец. Затворете излишните приложения и всички браузъри и изчакайте проверката да завърши.
Натиснете което и да е копче от клавиатурата.
Ще се появи лог файл (който можете да намерите и ръчно на десктопа с името JRT.txt).
Моля копирайте съдържанието на лог файла в следващия си пост.

СТЪПКА 3

Моля изтеглете ZHPcleaner и я запазете на вашия десктоп.

Стартирайте ZHPCleaner с десен клик върху файла и изберете от контекстното меню "Run as administrator"
Кликнете върху за да се съгласите с лицензионното споразумение.
Изберете бутона .
Браузърите ще бъдат затворени автоматично.
След края на проверката натиснете бутона Report
Ще се създаде лог файл на десктопа. Публикувайте лог файла в следващия си коментар.

Поздрави!

28 юни 201610 г.

Имам нова информация по случая, но първо изпълнете стъпките. Възможно е да имате от новите зарази, които заразяват браузърите през WMI. Ще проверим и това после.

28 юни 201610 г.

Автор

Здравейте,

Прилагам логове. Ще следя дали има подобрение и ще пиша допълнително. Последната програма изтри ManyCam от компютъра ми (преди това съм сигурен, че нямах никакви проблеми с тази програма, но е възможно да се е заразила?)

Поздрави!

28 юни 201610 г.

Здравейте,

Не бях инструктирал да триете неща на своя глава със ZHPCleaner! Сега ще трябва да си преинсталирате ManyCam тъй като е била изтрита по погрешка, ако я използвате.

Колкото до логовете те до голяма степен бяха чисти всичките. За да проверим и последната теория за WMI зараза направете следното и яко няма такава щеше ще се наложи да възстановите настройките на браузърите по подразбиране или да прекъснете синхронизацията им с облака и направо да ги деинсталирате напълно с GeekUninstaller като премахнете всички остатъци (не важи за вградения в Windows Internet Explorer) и да ги инсталирате отново.

В търсачката на Windows въведете wbemtest.exe => кликнете с десен бутон върху файла wbemtest.exe => Run as administrator

Кликнете на бутона Connect и в прозореца на NameSpace поставете следната информация => root\subscription и отново кликнете на бутона Connect

Сега вече сложете отметка пред Enable All Privileges и кликнете на бутона Enum Instances

В новопоявилия се прозорец въведете ActiveScriptEventConsumer и натиснете бутона ОК

Ако списъка, който се появи е празен значи няма и WMI зараза в системата. Ако в списъка има редове с името ASEC го изберете с левия бутон на мишката и изберете бутона Delete

Повече информация по темата:

http://www.bleepingcomputer.com/news/security/yeabests-cc-a-fileless-infection-using-wmi-to-hijack-your-browser/

Повече информация за WMI заразите има в тази статия от TrendMicro:

http://la.trendmicro.com/media/misc/understanding-wmi-malware-research-paper-en.pdf

Поздрави!

29 юни 201610 г.

Автор

Здравейте,

Нищо не излезна от списъка. Ще пробвам да ги деинсталирам с GeekUninstaller, а за Internet Explorer как стои въпросът?

29 юни 201610 г.

Изчакайте малко с деинсталацията да изчистим още малко варианти.

Преди тази стъпка е добре да запазите отметките, паролите и други важни настройки, които имате в Google Chrome, защото ще възстановим настройките му по подразбиране (все едно сме го преинсталирали);

Изтеглете ZOEK (by Smeenk) и да го запишете на вашия работен плот
Временно деактивирайте вашата антивирусна и антишпионска защита - инструкции при необходимост ще намерите тук

Щракнете с десния бутон върху тази икона и изберете Run as Administrator, за да стартирате инструмента.
Изчакайте търпеливо, докато се появи главната конзола (може да отнеме минута или две).

В главния прозорец, моля поставете в следния скрипт:

Цитат

createsrpoint;
IEDefaults;
FFDefaults;
CHRDefaults;
autoclean;

Уверете се, че опцията Scan All Users е маркирана.
Натиснете Run Script и изчакайте. Сканирането може да отнеме няколко минути.
Когато сканирането приключи, ще се отвори лог файл с име zoek-results.
Ако е необходимо рестартиране, той ще се отвори след това.
Копирайте съдържанието му в следващия си отговор.

Пишете след това дали проблема остава.

29 юни 201610 г.

Автор

Здравейте,

Пуснах скрипта в Zoek, но той продължава повече от час.. това нормално ли е? В момента имам следния input:

Zoek.exe v5.0.0.1 Updated 31-December-2015
Tool run by ASdffg$ on ба 29.06.2016 Ј. at 22:20:34,99.
Microsoft Windows 8.1 Pro 6.3.9600 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\03C2~1\Desktop\zoek.exe [Scan all users] [Script inserted]

===== Runcheck 22:21:17,26 =====

--- Create Environment Variables 22:21:18,29
--- Create System Restore Point 22:21:24,00
--- Checking Input 22:21:35,57
--- AU AppData Check 22:21:54,40
--- Remove From Windows Installer 22:21:55,73
--- Empty Folders Check 22:23:48,80
--- Registry HKLM Software Check 22:23:48,81
--- IE Startpage Check 22:24:07,01
--- Program Files DB Check 22:24:20,05
--- C:\Users\Default\AppData\ DB Check 22:25:06,09
--- C:\Users\Default User\AppData\ DB Check 22:25:06,09
--- C:\Users\MSSQL$SQLEXPRESS\AppData\ DB Check 22:25:06,09
--- C:\Users\03C2~1\AppData\ DB Check 22:25:06,09
--- C:\Windows\SysNative\config\systemprofile\AppData\ DB Check 22:25:06,09
--- C:\Windows\sysWoW64\config\systemprofile\AppData\ DB Check 22:25:06,09
--- C:\Windows\serviceprofiles\networkservice\AppData\ DB Check 22:25:06,09
--- C:\Windows\serviceprofiles\Localservice\AppData\ DB Check 22:25:06,09
--- C:\Users\03C2~1 DB Check 22:27:45,53
--- C:\PROGRA~3 DB Check 22:28:03,28
--- C:\Users\Default\AppData\Local DB Check 22:28:13,46
--- C:\Users\Default User\AppData\Local DB Check 22:28:13,46
--- C:\Users\MSSQL$SQLEXPRESS\AppData\Local DB Check 22:28:13,46
--- C:\Users\03C2~1\AppData\Local DB Check 22:28:13,46
--- C:\Windows\SysNative\config\systemprofile\AppData\Local DB Check 22:28:13,46
--- C:\Windows\sysWoW64\config\systemprofile\AppData\Local DB Check 22:28:13,46
--- C:\Windows\serviceprofiles\networkservice\AppData\Local DB Check 22:28:13,46
--- C:\Windows\serviceprofiles\Localservice\AppData\Local DB Check 22:28:13,46
--- C:\ProgramData\Microsoft\Windows\Start Menu\Programs DB Check 22:30:03,11
--- C:\Users\03C2~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs DB Check 22:30:13,67
--- Tasks DB Check 22:30:20,40
--- Downloads DB Check 22:30:24,88
--- C:\Users\03C2~1\AppData\LocalLow DB Check 22:30:28,93
--- C:\Windows\SysNative\config\systemprofile\AppData\LocalLow DB Check 22:30:28,93
--- C:\Windows\sysWoW64\config\systemprofile\AppData\LocalLow DB Check 22:30:28,93
--- C:\Windows\serviceprofiles\networkservice\AppData\LocalLow DB Check 22:30:28,93
--- C:\Windows\serviceprofiles\Localservice\AppData\LocalLow DB Check 22:30:28,93
--- Tasks2 DB Check 22:31:16,49
--- Documents DB Check 22:31:50,37
--- C:\Users\03C2~1\AppData\Roaming\Mozilla\Firefox\Profiles\e3efm7hq.default DB Check 22:31:59,14
--- C:\Users\Public\Desktop DB Check 22:32:01,68
--- C:\Users\03C2~1\Desktop DB Check 22:32:06,91
--- Services DB Check 22:32:14,74
--- FF prefs.js DB Check 22:32:45,84
--- Del by CLSID 22:33:24,49
--- Delete Services 22:35:26,67
--- Firefox Fix 22:35:28,34
--- Delete files\folders 22:35:29,28
--- Create Backups 22:35:29,37
--- Firefox Extensions 22:35:48,73

Edit:

Не се отвори автоматично лог, но го потърсих в C:\ и има създаден такъв, прикачен е. За съжаление отново проблемът си остава ;(

zoek-results.log

Редактирано 29 юни 201610 г. от joax (преглед на промените)

30 юни 201610 г.

Скрипта не се е изпълнил целия. Спрете защитата на антивирусната си програма и го пуснете пак и изчакайте да се изпълни целия. Ако трябва го пуснете през нощта.

2 юли 201610 г.

Автор

Здравейте,

Този път мисля изпълних целия скрипт, защото ми поиска reboot и след това се отвор zoek-results автоматично.

С ужас разбрах,че лаптопът на родителите ми е заразен със същия вирус, а нямам представа как е станало. Аз не го ползвам, а те го ползват единствено за facebook и сърфиране. Интересното е, че при тях също излизат прозорци като се опитам да влезна в някое url - абсолютно същите спам страници и съобщения от сорта на "Желаете ли да инсталирате HD Audio" и някакви подобни, на които не можеш да откажа. Единственият начин е да ги спра през Task Manager-a., но така убивам и браузъра.

Прикачвам лог-а.

Edit: за жалост проблемът си остава!

Поздрави!

zoek-results.txt

Редактирано 2 юли 201610 г. от joax (преглед на промените)

3 юли 201610 г.

Здравейте,

Извинявам се за забавения отговор, но имах ангажименти. Аз все още не вярвам проблема да се дължи на зловреден софтуер, защото всички логове са чисти и все щеше да изскочи нещо (освен ако не сте хванали някоя супер нова зараза). Нека да проверим за рууткити, защото често освен adware-а, рууткитите също имат способността да пренасочват браузърите.

Системата вързана ли е към рутер? Не видях такова нещо в логовете, но все пак да попитам.

Моля изтеглете последната версия на TDSSKiller оттук и я запазете на вашия декстоп.

Стартирайте TDSSKiller.exe за да стартирате приложението. След това кликнете върху бутона Change parameters.
Сложете всички отметки включително и пред Loaded Modules.

Необходим е рестарт за осъществяване на промените. Направете го!
TDSSKiller ще стартира автоматично след рестарта. Важно е да се отбележи, че вашия компютър може да изглежда по-бавен, на моменти неизползваем и с по-ниска производителност. Това е нормално и ще трае само един рестарт. Дайте му достатъчно време да зареди приложенията стартиращи с Операционната Система във фонов режим.
След това натиснете Change parameters в TDSSKiller отново.
Сложете всички отметки (този път рестарт не се изисква).
Натиснете бутона Start Scan.
Проверката не би трябвало да отмене повече от 5 minutes.
Ако подозрителен обект бъде засечен, действието по подразбиране ще бъде Skip, кликнете върху Continue.
Ако зловредни обекти бъдат намерени, тогава от падащото меню ще имате три възможности.
Бъдете сигурни, че избраното действие е Cure и натиснете върху Continue > Рестартирайте за да бъде завършена поправката.

Забележка: Ако Cure бутона не е наличен от възможностите, тогава моля изберете Skip бутона, не избирайте Delete освен ако не сте инструктирани затова.
Лог файл ще бъде създаден в свободната директория на дял C:\ . Потърсете за лог с името "TDSSKiller.[Version]_[Date]_[Time]_log.txt" и копирайте съдържанието му в следващия си пост.

Ако и този лог излезе чист бих искал ако е възможно да осъществя отдалечен достъп с TeamViewer ако сте съгласни разбира се?

Поздрави!

3 юли 201610 г.

Автор

Здравейте,

Прилагам логове. На въпроса дали системата е вързана към рутер - имам рутер, който предава интернет чрез кабел на настолния ми компютър. Имаме и лаптоп, който го ползват родителите ми, той е заразен също.

Съгласен съм да направим сесия с TeamViewer, в случай, че не открием нищо и този път.

TDSSKiller.3.1.0.9_03.07.2016_22.27.29_log.txt

TDSSKiller.3.1.0.9_03.07.2016_22.24.28_log.txt

3 юли 201610 г.

Лог файла е чист. Системата за мен е чиста. Ако и двете системи ползват рутера е много вероятно неговите настройки да са похитени и той да е причината за пренасочването.

Направете резет на настройките на рутера и пишете дали проблема изчезва.

7 юли 201610 г.

Автор

Здравейте,

Направих ресет на настройките на рутера. Нулев ефект. Нямам идея какво става. Дори и да преинсталирам компютъра - сигурен съм, че няма да има ефект, защото и лаптопът се държи по същият начин.

Поздрави!

7 юли 201610 г.

Може би е добре да говорите и с доставчика си на интернет.

Положението е странно, защото обикновено при упорито пренасочване причината често са модифицирани настройки на IE с поставянето на перманентно прокси, което да се ползва и от останалите браузъри - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings

Пример за подобна тема => Внимание...не прилагайте нищо от предложеното там, защото се отнася до конкретната система.

Но при вас не видях такива индикации.

Другото остава да е от рутера. Въпреки резет-а това не го изключва от подозрение. Ако редица други настройки не са пипнати и дори ако не е сменена паролата по подразбиране, дори след резет на насторйките вируса, който е JS скрипт проверява за стандартни пароли и ако ги открие отново заразява настройките на рутера и след резет, ефекта е нулев. Понякога се налага дори обновяване на firmware-a на самото устройство. Проверете и тези неща. Ако проблема остава, тогава ще е добре ако може да осъществим сесия с TeamViewer през уикенда за да видим какво е положението. Щом и другата машина се държи по този начин това определено ме насочва към рутера.

Поздрави!

10 юли 201610 г.

Автор

Проблемът изчезна след като смених паролата на рутера и деинсталирах браузъра Maxthon (понеже имах съмнения в него, cloud browser е).

10 юли 201610 г.

Проблема е бил в рутера, както казах. Няма как Maxthon да е бил причината за проблема и в другите браузъри и на другата система... На лаптопа проблема изчезна също предполагам сега?

11 юли 201610 г.

Автор

Здравейте,

Да, мисля, че изчезна. Поразрових се в нета и нямаше проблеми, родителите ми също не са се оплакали.

Добре дошли!

Браузърите ме пренасочват в harmful сайтове

Featured Replies

Архивирана тема

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)