Вирус проблем с Yea Desktop

22 април 20179 г.

Здравейте, имам нужда от помощ! Теглих заразен крак с вируси и инсталирах програми с йероглифи. Една от тях беше Yea Desktop. След това сканирах с Malwarebytes и тя откри над 1500 заплахи. Сканирах и с други програми, но струва ми се нещата не изглеждат добре. Ето резултата:

Addition 2.txt

22 април 20179 г.

Здравейте,

А къде е другия лог файл - FRST.txt?

Поздрави!

22 април 20179 г.

Автор

Извинявам се. Ето:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 22-04-2017 01
Ran by VTB (administrator) on VTB-PC (23-04-2017 00:01:58)
Running from C:\Users\VTB\Desktop
Loaded Profiles: VTB (Available Profiles: VTB)
Platform: Microsoft Windows 7 Ultimate Service Pack 1 (X86) Language: Български (България)
Internet Explorer Version 9 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(ABBYY Production LLC) C:\Program Files\ABBYY FineReader 12\NetworkLicenseServer.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Compal Electronics, Inc.) C:\Program Files\Wireless Select Switch\WLSS.exe
() C:\Windows\tsnp2std.exe
(Sonix) C:\Windows\vsnp2std.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(DT Soft Ltd) C:\Program Files\DAEMON Tools Lite\DTLite.exe
(BitTorrent Inc.) C:\Users\VTB\AppData\Roaming\uTorrent\uTorrent.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(BitTorrent Inc.) C:\Users\VTB\AppData\Roaming\uTorrent\updates\3.5.0_43580\utorrentie.exe
(BitTorrent Inc.) C:\Users\VTB\AppData\Roaming\uTorrent\updates\3.5.0_43580\utorrentie.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1002984 2016-11-14] (Microsoft Corporation)
HKLM\...\Run: [NeroFilterCheck] => C:\Windows\system32\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh)
HKLM\...\Run: [WLSS] => C:\Program Files\Wireless Select Switch\WLSS.exe [189736 2007-08-10] (Compal Electronics, Inc.)
HKLM\...\Run: [tsnp2std] => C:\Windows\tsnp2std.exe [110592 2006-01-06] ()
HKLM\...\Run: [snp2std] => C:\Windows\vsnp2std.exe [344064 2006-01-06] (Sonix)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2780112 2017-01-20] (Malwarebytes)
HKU\S-1-5-21-2291805700-3923089709-3695025833-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files\DAEMON Tools Lite\DTLite.exe [357696 2010-04-01] (DT Soft Ltd)
HKU\S-1-5-21-2291805700-3923089709-3695025833-1000\...\Run: [uTorrent] => C:\Users\VTB\AppData\Roaming\uTorrent\uTorrent.exe [2144448 2017-04-12] (BitTorrent Inc.)
HKU\S-1-5-21-2291805700-3923089709-3695025833-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [50609792 2016-01-19] (Skype Technologies S.A.)
HKU\S-1-5-21-2291805700-3923089709-3695025833-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [6628056 2016-01-15] (Piriform Ltd)
HKU\S-1-5-21-2291805700-3923089709-3695025833-1000\...\MountPoints2: {57db2e36-ce0f-11e3-8801-001b38791474} - G:\AutoRun.exe
HKU\S-1-5-21-2291805700-3923089709-3695025833-1000\...\MountPoints2: {57db2e4a-ce0f-11e3-8801-001b38791474} - G:\AutoRun.exe
HKU\S-1-5-21-2291805700-3923089709-3695025833-1000\...\MountPoints2: {59e747cd-2f70-11e5-9afb-001b38791474} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL G:\Install.bat
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 0.0.0.0
Tcpip\..\Interfaces\{A2822287-723E-4E3D-82CE-DC080348D07D}: [DhcpNameServer] 192.168.1.1 0.0.0.0

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: C:\Users\VTB\AppData\Roaming\Mozilla\Firefox\Profiles\a9nvgmro.default-1492816599870 [2017-04-23]
FF Extension: (Disable TLS Certificate Transparency) - C:\Users\VTB\AppData\Roaming\Mozilla\Firefox\Profiles\a9nvgmro.default-1492816599870\features\{95307fc3-7ebd-4a4e-9e57-36789c357280}\[email protected] [2017-04-22]
FF Extension: (Disable Prefetch) - C:\Users\VTB\AppData\Roaming\Mozilla\Firefox\Profiles\a9nvgmro.default-1492816599870\features\{95307fc3-7ebd-4a4e-9e57-36789c357280}\[email protected] [2017-04-22]
FF Extension: (Site Deployment Checker) - C:\Program Files\Mozilla Firefox\browser\features\[email protected] [2017-04-01] [not signed]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_25_0_0_148.dll [2017-04-11] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.33.3\npGoogleUpdate3.dll [2017-04-21] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.33.3\npGoogleUpdate3.dll [2017-04-21] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.8 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2013-12-21] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFFICE.DLL [2003-07-15] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2013-12-21] (Adobe Systems Inc.)

Chrome:
=======
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 ABBYY.Licensing.FineReader.Professional.12.0; C:\Program Files\ABBYY FineReader 12\NetworkLicenseServer.exe [925904 2014-01-23] (ABBYY Production LLC)
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [3303888 2017-01-20] (Malwarebytes)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [103696 2016-11-14] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [280864 2016-11-14] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 cryptfd; C:\Windows\System32\drivers\cryptfd.sys [176552 2017-03-03] ()
R0 EMSC; C:\Windows\System32\DRIVERS\EMSC.SYS [9856 2007-03-14] ()
R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae.sys [59904 2017-03-22] ()
S3 gdrv; C:\Windows\gdrv.sys [15600 2013-10-20] (Windows (R) 2000 DDK provider)
S3 hitmanpro37; C:\Windows\system32\drivers\hitmanpro37.sys [35992 2015-03-13] ()
R2 MBAMChameleon; C:\Windows\system32\drivers\MBAMChameleon.sys [161216 2017-04-21] (Malwarebytes)
R3 MBAMFarflt; C:\Windows\system32\drivers\farflt.sys [96704 2017-04-22] (Malwarebytes)
R3 MBAMProtection; C:\Windows\system32\drivers\mbam.sys [39360 2017-04-22] (Malwarebytes)
R0 MBAMSwissArmy; C:\Windows\System32\drivers\MBAMSwissArmy.sys [220088 2017-04-22] (Malwarebytes)
R3 MBAMWebProtection; C:\Windows\system32\drivers\mwac.sys [64288 2017-04-22] (Malwarebytes)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [252808 2016-08-25] (Microsoft Corporation)
S3 SNP2STD; C:\Windows\System32\DRIVERS\snp2sxp.sys [10305664 2006-05-13] () [File not signed]
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2013-09-23] () [File not signed]
U3 amcf7c9f; C:\Windows\system32\Drivers\amcf7c9f.sys [0 ] (Microsoft Corporation) <==== ATTENTION (zero byte File/Folder)
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X]
S3 huawei_cdcacm; system32\DRIVERS\ew_jucdcacm.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-04-23 00:01 - 2017-04-23 00:04 - 00009968 _____ C:\Users\VTB\Desktop\FRST.txt
2017-04-22 23:59 - 2017-04-22 23:59 - 00000000 ____D C:\Users\VTB\Downloads\FRST-OlderVersion
2017-04-22 02:35 - 2017-04-22 02:35 - 00023930 _____ C:\Users\VTB\Desktop\Addition 2.txt
2017-04-22 02:16 - 2017-04-22 02:16 - 00000000 ____D C:\Users\VTB\Desktop\Стари данни Firefox
2017-04-22 01:49 - 2017-04-22 01:49 - 00000000 ____D C:\Windows\tracing
2017-04-21 23:08 - 2017-04-21 23:08 - 00009697 _____ C:\Users\VTB\Desktop\ZHPCleaner.txt
2017-04-21 22:49 - 2017-04-21 23:08 - 00000000 ____D C:\Users\VTB\AppData\Roaming\ZHP
2017-04-21 22:49 - 2017-04-21 22:49 - 00000826 _____ C:\Users\VTB\Desktop\ZHPCleaner.lnk
2017-04-21 22:49 - 2017-04-21 22:49 - 00000000 ____D C:\Users\VTB\AppData\Local\ZHP
2017-04-21 22:47 - 2017-04-21 22:47 - 02761728 _____ C:\Users\VTB\Downloads\ZHPCleaner.exe
2017-04-21 22:24 - 2017-04-21 22:25 - 00001214 _____ C:\Users\VTB\Desktop\JRT.txt
2017-04-21 22:16 - 2017-04-21 22:16 - 01663672 _____ (Malwarebytes) C:\Users\VTB\Downloads\JRT(1).exe
2017-04-21 22:05 - 2017-04-21 22:05 - 00024938 _____ C:\Users\VTB\Desktop\ф,и.txt
2017-04-21 22:00 - 2017-04-22 02:29 - 00023927 _____ C:\Users\VTB\Downloads\Addition.txt
2017-04-21 21:57 - 2017-04-22 02:29 - 00071434 _____ C:\Users\VTB\Downloads\FRST.txt
2017-04-21 21:55 - 2017-04-23 00:01 - 00000000 ____D C:\FRST
2017-04-21 21:53 - 2017-04-22 23:59 - 01767424 _____ (Farbar) C:\Users\VTB\Desktop\FRST.exe
2017-04-21 21:06 - 2017-04-21 21:06 - 01663672 _____ (Malwarebytes) C:\Users\VTB\Downloads\JRT.exe
2017-04-21 20:59 - 2017-04-21 20:59 - 00018785 _____ C:\Users\VTB\Desktop\AdwCleaner[C0].txt
2017-04-21 20:31 - 2017-04-21 20:52 - 00000000 ____D C:\AdwCleaner
2017-04-21 20:29 - 2017-04-21 20:30 - 04089296 _____ C:\Users\VTB\Downloads\adwcleaner_6.045.exe
2017-04-21 19:36 - 2017-04-21 19:36 - 00347762 _____ C:\Users\VTB\Desktop\111.txt
2017-04-21 18:47 - 2016-07-22 17:51 - 00123904 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2017-04-21 18:47 - 2016-02-03 20:59 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS
2017-04-21 18:47 - 2015-01-09 05:48 - 00635904 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll
2017-04-21 18:47 - 2015-01-09 05:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll
2017-04-21 18:47 - 2015-01-09 05:48 - 00027136 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll
2017-04-21 18:47 - 2013-07-03 06:36 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2017-04-21 18:47 - 2013-07-03 06:36 - 00025728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2017-04-21 18:46 - 2016-05-11 18:19 - 00363520 _____ (Microsoft Corporation) C:\Windows\system32\StructuredQuery.dll
2017-04-21 18:46 - 2015-01-29 06:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2017-04-21 18:46 - 2013-10-04 04:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2017-04-21 18:46 - 2013-10-04 04:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2017-04-21 18:46 - 2012-07-04 22:45 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\RNDISMP.sys
2017-04-21 18:44 - 2015-07-10 20:34 - 03221504 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2017-04-21 18:44 - 2015-07-10 20:34 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2017-04-21 18:44 - 2015-07-10 20:33 - 00131584 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2017-04-21 18:44 - 2013-02-12 06:32 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usb8023.sys
2017-04-21 18:43 - 2016-04-14 18:33 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2017-04-21 18:41 - 2016-02-09 12:50 - 00021504 _____ (Microsoft Corporation) C:\Windows\system32\seclogon.dll
2017-04-21 18:41 - 2016-02-02 21:48 - 00376320 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2017-04-21 18:41 - 2015-11-11 21:39 - 01242624 _____ (Microsoft Corporation) C:\Windows\system32\comsvcs.dll
2017-04-21 18:41 - 2015-11-11 21:39 - 00487936 _____ (Microsoft Corporation) C:\Windows\system32\catsrvut.dll
2017-04-21 18:41 - 2015-08-27 20:58 - 01391104 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2017-04-21 18:40 - 2015-08-27 20:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2017-04-21 18:30 - 2016-04-09 09:54 - 01011712 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2017-04-21 18:30 - 2016-03-16 21:28 - 00176128 _____ (Microsoft Corporation) C:\Windows\system32\msorcl32.dll
2017-04-21 18:30 - 2016-03-16 21:28 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\mtxoci.dll
2017-04-21 18:30 - 2015-07-09 20:42 - 00179712 _____ (Microsoft Corporation) C:\Windows\system32\notepad.exe
2017-04-21 18:30 - 2015-07-09 20:42 - 00179712 _____ (Microsoft Corporation) C:\Windows\notepad.exe
2017-04-21 18:30 - 2013-10-30 05:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2017-04-21 18:30 - 2013-01-24 07:47 - 00196328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fvevol.sys
2017-04-21 18:30 - 2012-11-02 08:11 - 00376832 _____ (Microsoft Corporation) C:\Windows\system32\dpnet.dll
2017-04-21 18:30 - 2011-06-16 07:33 - 00180224 _____ (Microsoft Corporation) C:\Windows\system32\xmllite.dll
2017-04-21 18:29 - 2016-03-18 01:30 - 00171008 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2017-04-21 18:29 - 2016-03-18 01:28 - 01414144 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2017-04-21 18:29 - 2016-03-18 01:26 - 00872448 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2017-04-21 18:29 - 2016-03-18 01:26 - 00294400 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 00:36 - 00271360 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2017-04-21 18:29 - 2016-03-18 00:29 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 00:29 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 00:29 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 00:29 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-04-21 18:29 - 2016-03-09 21:40 - 00316416 _____ (Microsoft Corporation) C:\Windows\system32\webio.dll
2017-04-21 18:29 - 2016-02-04 21:41 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\mfds.dll
2017-04-21 18:28 - 2015-08-05 20:41 - 00751104 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2017-04-21 18:28 - 2014-11-11 05:44 - 00186880 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll
2017-04-21 18:27 - 2016-06-25 22:53 - 00779776 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2017-04-21 18:27 - 2016-06-25 22:53 - 00297472 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.dll
2017-04-21 18:27 - 2016-06-25 22:53 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\inetpp.dll
2017-04-21 18:27 - 2016-06-25 22:42 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\wpnpinst.exe
2017-04-21 18:27 - 2016-06-25 22:41 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.exe
2017-04-21 18:27 - 2016-06-25 22:41 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\inetppui.dll
2017-04-21 18:07 - 2015-10-13 19:31 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2017-04-21 18:07 - 2015-10-13 19:31 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2017-04-21 18:07 - 2012-08-21 23:12 - 00245760 _____ (Microsoft Corporation) C:\Windows\system32\OxpsConverter.exe
2017-04-21 18:06 - 2016-02-12 21:39 - 02956288 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2017-04-21 18:06 - 2016-02-12 21:39 - 00174080 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2017-04-21 18:06 - 2016-02-12 21:26 - 00073728 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2017-04-21 18:06 - 2016-02-12 21:07 - 02062848 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2017-04-21 18:06 - 2016-02-12 21:06 - 00573440 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2017-04-21 18:06 - 2016-02-12 21:05 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2017-04-21 18:06 - 2016-02-12 21:05 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2017-04-21 18:06 - 2016-02-12 21:05 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2017-04-21 18:06 - 2016-02-12 21:05 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2017-04-21 18:06 - 2016-02-12 21:05 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2017-04-21 18:06 - 2016-02-12 21:05 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2017-04-21 18:06 - 2013-10-19 04:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2017-04-21 18:04 - 2014-03-04 12:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2017-04-21 18:04 - 2014-03-04 12:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2017-04-21 18:04 - 2014-03-04 12:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2017-04-21 18:04 - 2014-03-04 12:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2017-04-21 18:04 - 2014-03-04 12:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2017-04-21 18:04 - 2014-03-04 12:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2017-04-21 18:04 - 2014-03-04 12:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2017-04-21 17:56 - 2013-10-12 05:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2017-04-21 17:56 - 2013-10-12 05:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2017-04-21 17:56 - 2013-10-12 04:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2017-04-21 17:56 - 2013-10-12 04:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2017-04-21 17:55 - 2015-06-11 20:57 - 00919552 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2017-04-21 17:55 - 2015-06-11 20:15 - 00134656 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2017-04-21 17:55 - 2015-06-11 20:15 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2017-04-21 17:54 - 2016-05-12 18:18 - 00606720 _____ (Microsoft Corporation) C:\Windows\system32\gpsvc.dll
2017-04-21 17:54 - 2016-05-12 18:18 - 00591872 _____ (Microsoft Corporation) C:\Windows\system32\gpprefcl.dll
2017-04-21 17:54 - 2016-05-12 18:18 - 00351744 _____ (Microsoft Corporation) C:\Windows\system32\IPSECSVC.DLL
2017-04-21 17:54 - 2016-05-12 18:18 - 00274944 _____ (Microsoft Corporation) C:\Windows\system32\polstore.dll
2017-04-21 17:54 - 2016-05-12 18:18 - 00079360 _____ (Microsoft Corporation) C:\Windows\system32\gpapi.dll
2017-04-21 17:54 - 2016-05-12 18:18 - 00070144 _____ (Microsoft Corporation) C:\Windows\system32\winipsec.dll
2017-04-21 17:54 - 2016-05-12 18:18 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\FwRemoteSvr.dll
2017-04-21 17:54 - 2016-05-12 17:57 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\gpscript.dll
2017-04-21 17:54 - 2016-05-12 17:57 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\gpscript.exe
2017-04-21 17:54 - 2015-10-29 20:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2017-04-21 17:54 - 2015-10-29 20:49 - 00295936 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2017-04-21 17:54 - 2015-10-29 20:49 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2017-04-21 17:54 - 2015-10-29 20:49 - 00020992 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2017-04-21 17:52 - 2011-08-27 07:26 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\oleacc.dll
2017-04-21 17:47 - 2015-07-15 20:55 - 01159168 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll
2017-04-21 17:34 - 2016-03-09 21:34 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2017-04-21 17:33 - 2011-08-17 07:24 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\psisdecd.dll
2017-04-21 17:33 - 2011-08-17 07:19 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\psisrndr.ax
2017-04-21 17:32 - 2011-12-30 08:27 - 00478720 _____ (Microsoft Corporation) C:\Windows\system32\timedate.cpl
2017-04-21 17:31 - 2011-05-24 13:44 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\umpnpmgr.dll
2017-04-21 17:26 - 2015-10-13 07:50 - 00712640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2017-04-21 17:25 - 2013-05-10 06:20 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll
2017-04-21 17:19 - 2015-03-04 07:10 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
2017-04-21 17:19 - 2014-09-04 08:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2017-04-21 17:19 - 2014-01-28 05:07 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2017-04-21 17:19 - 2013-03-19 06:33 - 00040960 _____ (Microsoft Corporation) C:\Windows\system32\wwanprotdim.dll
2017-04-21 17:18 - 2013-05-13 06:08 - 00903168 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe
2017-04-21 17:18 - 2013-05-13 06:08 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll
2017-04-21 17:17 - 2015-11-03 21:55 - 00179712 _____ (Microsoft Corporation) C:\Windows\system32\els.dll
2017-04-21 16:47 - 2016-08-29 18:12 - 12880384 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2017-04-21 16:47 - 2016-08-29 18:12 - 01499648 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2017-04-21 16:47 - 2016-08-29 17:55 - 02972672 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2017-04-21 16:47 - 2015-04-11 06:07 - 00054656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\stream.sys
2017-04-21 16:47 - 2014-02-04 05:07 - 00234432 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2017-04-21 16:47 - 2014-02-04 05:07 - 00149440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2017-04-21 16:47 - 2014-02-04 05:07 - 00027072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2017-04-21 16:47 - 2014-02-04 05:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2017-04-21 16:44 - 2017-04-22 16:58 - 00096704 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
2017-04-21 16:42 - 2017-04-21 16:42 - 00001984 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-04-21 16:42 - 2017-04-21 16:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-04-21 16:42 - 2017-03-22 11:02 - 00059904 _____ C:\Windows\system32\Drivers\mbae.sys
2017-04-21 16:41 - 2017-04-21 16:41 - 00000000 ____D C:\Program Files\Malwarebytes
2017-04-21 16:38 - 2017-04-21 16:39 - 60107896 _____ (Malwarebytes ) C:\Users\VTB\Downloads\mb3-setup-consumer-3.0.6.1469-10103.exe
2017-04-21 16:12 - 2015-07-30 20:57 - 01171456 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2017-04-21 16:07 - 2016-03-16 02:53 - 00566272 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll
2017-04-21 16:06 - 2016-03-16 02:53 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\samlib.dll
2017-04-21 16:06 - 2012-10-03 19:42 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\netcorehc.dll
2017-04-21 16:06 - 2012-10-03 19:42 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\netevent.dll
2017-04-21 16:06 - 2012-10-03 19:40 - 00499712 _____ (Microsoft Corporation) C:\Windows\system32\iphlpsvc.dll
2017-04-21 16:06 - 2012-10-03 18:21 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpipreg.sys
2017-04-21 16:06 - 2011-05-04 07:34 - 01549312 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll
2017-04-21 16:06 - 2011-05-04 07:32 - 01401344 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll
2017-04-21 16:06 - 2011-05-04 07:32 - 00666624 _____ (Microsoft Corporation) C:\Windows\system32\mssvp.dll
2017-04-21 16:06 - 2011-05-04 07:32 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\mssph.dll
2017-04-21 16:06 - 2011-05-04 07:32 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\mssphtb.dll
2017-04-21 16:06 - 2011-05-04 07:32 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\msscntrs.dll
2017-04-21 16:06 - 2011-05-04 07:28 - 00427520 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe
2017-04-21 16:06 - 2011-05-04 07:28 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\SearchProtocolHost.exe
2017-04-21 16:06 - 2011-05-04 07:28 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\SearchFilterHost.exe
2017-04-21 16:05 - 2015-07-22 20:53 - 00635392 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2017-04-21 16:04 - 2014-06-18 04:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2017-04-21 16:01 - 2016-01-21 03:51 - 00057280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\disk.sys
2017-04-21 16:01 - 2015-07-09 20:42 - 01372160 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2017-04-21 16:01 - 2015-07-09 20:42 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll
2017-04-21 16:00 - 2016-01-22 09:04 - 00642048 _____ (Microsoft Corporation) C:\Windows\system32\CPFilters.dll
2017-04-21 16:00 - 2016-01-22 09:04 - 00535040 _____ (Microsoft Corporation) C:\Windows\system32\EncDec.dll
2017-04-21 12:26 - 2012-07-26 06:21 - 00196608 _____ (Microsoft Corporation) C:\Windows\system32\WUDFHost.exe
2017-04-21 12:26 - 2012-07-26 06:20 - 00613888 _____ (Microsoft Corporation) C:\Windows\system32\WUDFx.dll
2017-04-21 12:26 - 2012-07-26 06:20 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\WUDFPlatform.dll
2017-04-21 12:26 - 2012-07-26 06:20 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\WUDFSvc.dll
2017-04-21 12:26 - 2012-07-26 06:20 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\WUDFCoinstaller.dll
2017-04-21 12:26 - 2012-07-26 05:33 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFPf.sys
2017-04-21 12:26 - 2012-07-26 05:32 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFRd.sys
2017-04-21 12:26 - 2012-06-02 17:57 - 00000003 _____ C:\Windows\system32\Drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
2017-04-21 12:25 - 2012-03-01 08:46 - 00019824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fs_rec.sys
2017-04-21 12:25 - 2012-03-01 08:29 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\wmi.dll
2017-04-21 12:11 - 2016-08-12 19:21 - 00313856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2017-04-21 12:11 - 2016-08-12 19:21 - 00310784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2017-04-21 12:11 - 2016-08-12 19:21 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2017-04-21 12:10 - 2015-12-09 00:53 - 00509952 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2017-04-21 12:10 - 2015-04-18 05:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2017-04-21 12:10 - 2015-04-13 06:19 - 00259072 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2017-04-21 12:10 - 2014-10-25 04:32 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2017-04-21 12:10 - 2014-08-01 14:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2017-04-21 12:10 - 2012-12-07 15:26 - 00308736 _____ (Microsoft Corporation) C:\Windows\system32\Wpc.dll
2017-04-21 12:10 - 2012-12-07 15:20 - 02576384 _____ (Microsoft Corporation) C:\Windows\system32\gameux.dll
2017-04-21 12:10 - 2012-12-07 13:46 - 00055296 _____ (Microsoft) C:\Windows\system32\cero.rs
2017-04-21 12:10 - 2012-12-07 13:46 - 00051712 _____ (Microsoft) C:\Windows\system32\esrb.rs
2017-04-21 12:10 - 2012-12-07 13:46 - 00046592 _____ (Microsoft) C:\Windows\system32\fpb.rs
2017-04-21 12:10 - 2012-12-07 13:46 - 00045568 _____ (Microsoft) C:\Windows\system32\oflc-nz.rs
2017-04-21 12:10 - 2012-12-07 13:46 - 00044544 _____ (Microsoft) C:\Windows\system32\pegibbfc.rs
2017-04-21 12:10 - 2012-12-07 13:46 - 00043520 _____ (Microsoft) C:\Windows\system32\csrr.rs
2017-04-21 12:10 - 2012-12-07 13:46 - 00040960 _____ (Microsoft) C:\Windows\system32\cob-au.rs
2017-04-21 12:10 - 2012-12-07 13:46 - 00030720 _____ (Microsoft) C:\Windows\system32\usk.rs
2017-04-21 12:10 - 2012-12-07 13:46 - 00023552 _____ (Microsoft) C:\Windows\system32\oflc.rs
2017-04-21 12:10 - 2012-12-07 13:46 - 00021504 _____ (Microsoft) C:\Windows\system32\grb.rs
2017-04-21 12:10 - 2012-12-07 13:46 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi-pt.rs
2017-04-21 12:10 - 2012-12-07 13:46 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi-fi.rs
2017-04-21 12:10 - 2012-12-07 13:46 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi.rs
2017-04-21 12:10 - 2012-12-07 13:46 - 00015360 _____ (Microsoft) C:\Windows\system32\djctq.rs
2017-04-21 12:09 - 2014-04-05 05:25 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2017-04-21 12:09 - 2014-04-05 05:24 - 00187840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2017-04-21 12:09 - 2013-11-26 14:11 - 00240576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2017-04-21 12:09 - 2013-07-26 04:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2017-04-21 12:09 - 2012-10-09 20:40 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcore6.dll
2017-04-21 12:09 - 2012-10-09 20:40 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcsvc6.dll
2017-04-21 12:08 - 2017-01-05 20:46 - 00137960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2017-04-21 12:08 - 2017-01-05 20:46 - 00067304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2017-04-21 12:08 - 2017-01-05 20:43 - 01062912 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2017-04-21 12:08 - 2017-01-05 20:43 - 00655360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2017-04-21 12:08 - 2017-01-05 20:43 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2017-04-21 12:08 - 2017-01-05 20:43 - 00261120 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2017-04-21 12:08 - 2017-01-05 20:43 - 00254464 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2017-04-21 12:08 - 2017-01-05 20:43 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2017-04-21 12:08 - 2017-01-05 20:43 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2017-04-21 12:08 - 2017-01-05 20:43 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2017-04-21 12:08 - 2017-01-05 20:43 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2017-04-21 12:08 - 2017-01-05 20:43 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2017-04-21 12:08 - 2017-01-05 20:43 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2017-04-21 12:08 - 2017-01-05 20:43 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2017-04-21 12:08 - 2017-01-05 20:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2017-04-21 12:08 - 2017-01-05 20:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2017-04-21 12:08 - 2017-01-05 20:43 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2017-04-21 12:08 - 2017-01-05 20:42 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2017-04-21 12:08 - 2017-01-05 20:23 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2017-04-21 12:08 - 2017-01-05 20:19 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2017-04-21 12:08 - 2017-01-05 20:19 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2017-04-21 12:08 - 2017-01-05 20:19 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2017-04-21 12:08 - 2017-01-05 20:19 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2017-04-21 12:08 - 2017-01-05 20:19 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2017-04-21 12:08 - 2017-01-05 20:19 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2017-04-21 12:08 - 2016-11-20 19:19 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\hlink.dll
2017-04-21 12:08 - 2016-11-20 17:07 - 00373896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2017-04-21 12:08 - 2016-11-17 19:27 - 00250600 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2017-04-21 12:08 - 2016-11-10 19:19 - 00811520 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2017-04-21 12:08 - 2016-11-09 19:24 - 00105192 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2017-04-21 12:08 - 2016-11-09 19:17 - 02365440 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2017-04-21 12:08 - 2016-11-09 19:17 - 01806848 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2017-04-21 12:08 - 2016-11-09 19:17 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2017-04-21 12:08 - 2016-11-09 19:17 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2017-04-21 12:08 - 2016-11-09 19:17 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2017-04-21 12:08 - 2016-11-09 19:17 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2017-04-21 12:08 - 2016-11-09 18:55 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2017-04-21 12:08 - 2016-11-06 19:16 - 00306688 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2017-04-21 12:08 - 2016-11-06 18:55 - 02399744 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2017-04-21 12:08 - 2016-11-02 18:22 - 00308456 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2017-04-21 12:08 - 2016-11-02 18:16 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2017-04-21 12:08 - 2016-11-02 18:16 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2017-04-21 12:08 - 2016-11-02 18:16 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2017-04-21 12:08 - 2016-11-02 17:53 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2017-04-21 12:08 - 2016-10-27 18:20 - 00627712 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2017-04-21 12:08 - 2016-10-15 18:13 - 00741888 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2017-04-21 12:08 - 2016-10-15 18:13 - 00084480 _____ (Microsoft Corporation) C:\Windows\system32\INETRES.dll
2017-04-21 12:08 - 2016-10-11 18:24 - 04000488 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2017-04-21 12:08 - 2016-10-11 18:24 - 03944680 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2017-04-21 12:08 - 2016-10-11 18:21 - 01310528 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2017-04-21 12:08 - 2016-10-11 18:18 - 01027584 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10.IME
2017-04-21 12:08 - 2016-10-11 18:18 - 00829952 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2017-04-21 12:08 - 2016-10-11 18:18 - 00701440 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL
2017-04-21 12:08 - 2016-10-11 18:18 - 00644096 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2017-04-21 12:08 - 2016-10-11 18:18 - 00430080 _____ (Microsoft Corporation) C:\Windows\system32\imkr80.ime
2017-04-21 12:08 - 2016-10-11 18:18 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2017-04-21 12:08 - 2016-10-11 18:18 - 00202240 _____ (Microsoft Corporation) C:\Windows\system32\input.dll
2017-04-21 12:08 - 2016-10-11 18:18 - 00126976 _____ (Microsoft Corporation) C:\Windows\system32\tintlgnt.ime
2017-04-21 12:08 - 2016-10-11 18:18 - 00125952 _____ (Microsoft Corporation) C:\Windows\system32\quick.ime
2017-04-21 12:08 - 2016-10-11 18:18 - 00125952 _____ (Microsoft Corporation) C:\Windows\system32\qintlgnt.ime
2017-04-21 12:08 - 2016-10-11 18:18 - 00125952 _____ (Microsoft Corporation) C:\Windows\system32\phon.ime
2017-04-21 12:08 - 2016-10-11 18:18 - 00125952 _____ (Microsoft Corporation) C:\Windows\system32\cintlgnt.ime
2017-04-21 12:08 - 2016-10-11 18:18 - 00125952 _____ (Microsoft Corporation) C:\Windows\system32\chajei.ime
2017-04-21 12:08 - 2016-10-11 18:18 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\pintlgnt.ime
2017-04-21 12:08 - 2016-10-11 18:18 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\nlsbres.dll
2017-04-21 12:08 - 2016-10-11 18:18 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2017-04-21 12:08 - 2016-10-11 18:18 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2017-04-21 12:08 - 2016-10-11 18:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2017-04-21 12:08 - 2016-10-11 18:18 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2017-04-21 12:08 - 2016-10-11 18:18 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2017-04-21 12:08 - 2016-10-11 17:55 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2017-04-21 12:08 - 2016-10-11 17:55 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2017-04-21 12:08 - 2016-10-11 17:55 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2017-04-21 12:08 - 2016-10-11 17:55 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2017-04-21 12:08 - 2016-10-11 17:53 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2017-04-21 12:08 - 2016-10-11 17:53 - 00099328 _____ (Microsoft Corporation) C:\Windows\system32\UIAnimation.dll
2017-04-21 12:08 - 2016-10-11 17:51 - 00295936 _____ (Microsoft Corporation) C:\Windows\system32\bcdedit.exe
2017-04-21 12:08 - 2016-10-11 17:50 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2017-04-21 12:08 - 2016-10-11 16:18 - 00419648 _____ C:\Windows\system32\locale.nls
2017-04-21 12:08 - 2016-10-08 16:05 - 00534600 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2017-04-21 12:08 - 2016-10-07 18:12 - 02291712 _____ (Microsoft Corporation) C:\Windows\system32\MSVidCtl.dll
2017-04-21 12:08 - 2016-10-07 18:12 - 00581632 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2017-04-21 12:08 - 2016-10-07 18:12 - 00090624 _____ (Microsoft Corporation) C:\Windows\system32\olepro32.dll
2017-04-21 12:08 - 2016-10-07 18:12 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\asycfilt.dll
2017-04-21 12:08 - 2016-10-05 17:50 - 00068608 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bowser.sys
2017-04-21 12:08 - 2016-10-04 18:13 - 01176064 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2017-04-21 12:08 - 2016-10-04 18:13 - 00179200 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2017-04-21 12:08 - 2016-10-04 18:13 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2017-04-21 12:08 - 2016-10-04 18:13 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2017-04-21 12:08 - 2016-09-15 17:51 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2017-04-21 12:08 - 2016-09-12 23:49 - 01081856 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2017-04-21 12:08 - 2016-09-12 23:49 - 00812032 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2017-04-21 12:08 - 2016-09-12 23:49 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\adsmsext.dll
2017-04-21 12:08 - 2016-09-09 21:00 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2017-04-21 12:08 - 2016-09-08 23:34 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2017-04-21 12:08 - 2016-09-08 23:34 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2017-04-21 12:08 - 2016-09-08 17:49 - 00117248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2017-04-21 12:08 - 2016-09-08 17:49 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dfsc.sys
2017-04-21 12:08 - 2016-08-21 16:05 - 00935424 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2017-04-21 12:08 - 2016-08-12 19:47 - 12574208 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2017-04-21 12:08 - 2016-08-12 19:47 - 11410432 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2017-04-21 12:08 - 2016-08-12 19:31 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2017-04-21 12:08 - 2016-08-12 19:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2017-04-21 12:08 - 2016-08-12 19:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2017-04-21 12:08 - 2016-08-12 19:21 - 00437248 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2017-04-21 12:08 - 2016-08-06 18:15 - 01178112 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2017-04-21 12:08 - 2016-08-06 18:15 - 00249344 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2017-04-21 12:08 - 2016-08-06 18:15 - 00214016 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2017-04-21 12:08 - 2016-08-06 18:15 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2017-04-21 12:08 - 2016-08-06 18:15 - 00054272 _____ (Microsoft Corporation) C:\Windows\system32\WsmRes.dll
2017-04-21 12:08 - 2016-08-06 17:53 - 00199168 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
2017-04-21 12:08 - 2016-08-06 17:53 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wsmprovhost.exe
2017-04-21 12:08 - 2016-08-06 17:53 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\wsmplpxy.dll
2017-04-21 12:08 - 2016-06-14 18:25 - 00078568 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2017-04-21 12:08 - 2016-06-14 18:21 - 03209216 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 02136064 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 01329664 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 01005056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00988160 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00744960 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00617984 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00474624 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00442368 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00406016 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00374784 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00354816 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00265216 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00195072 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00157184 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00103424 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2017-04-21 12:08 - 2016-06-14 18:17 - 00593920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2017-04-21 12:08 - 2016-06-14 18:05 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2017-04-21 12:08 - 2016-06-14 18:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2017-04-21 12:08 - 2016-06-14 18:05 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2017-04-21 12:08 - 2016-06-14 18:00 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2017-04-21 12:08 - 2016-06-14 17:55 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
2017-04-21 12:08 - 2016-06-14 17:55 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
2017-04-21 12:08 - 2016-06-14 17:54 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
2017-04-21 12:08 - 2016-05-12 16:04 - 00249352 _____ (Microsoft Corporation) C:\Windows\system32\bcryptprimitives.dll
2017-04-21 12:08 - 2016-03-24 01:42 - 00409272 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2017-04-21 12:08 - 2016-03-24 01:39 - 00470704 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2017-04-21 12:06 - 2016-03-06 21:38 - 01240576 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2017-04-21 12:06 - 2016-03-06 21:38 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2017-04-21 12:06 - 2015-11-05 22:02 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\wshrm.dll
2017-04-21 12:06 - 2015-11-05 12:48 - 00117760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rmcast.sys
2017-04-21 12:06 - 2014-12-19 05:43 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2017-04-21 12:06 - 2014-12-11 20:47 - 00046592 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2017-04-21 12:06 - 2014-10-30 04:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2017-04-21 12:06 - 2012-09-26 01:47 - 00078336 _____ (Microsoft Corporation) C:\Windows\system32\synceng.dll
2017-04-21 12:06 - 2012-03-17 10:27 - 00056176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\partmgr.sys
2017-04-21 12:06 - 2011-12-16 10:52 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\msvcrt.dll
2017-04-21 12:06 - 2011-06-15 11:55 - 00319488 _____ (Microsoft Corporation) C:\Windows\system32\odbcjt32.dll
2017-04-21 12:06 - 2011-06-15 11:55 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\odbctrac.dll
2017-04-21 12:06 - 2011-06-15 11:55 - 00122880 _____ (Microsoft Corporation) C:\Windows\system32\odbccp32.dll
2017-04-21 12:06 - 2011-06-15 11:55 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\odbccu32.dll
2017-04-21 12:06 - 2011-06-15 11:55 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\odbccr32.dll
2017-04-21 12:05 - 2015-11-14 01:50 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\mapistub.dll
2017-04-21 12:05 - 2015-11-14 01:50 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\mapi32.dll
2017-04-21 12:05 - 2015-11-14 01:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\fixmapi.exe
2017-04-21 12:05 - 2015-02-03 06:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2017-04-21 12:05 - 2013-10-12 05:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2017-04-21 12:05 - 2013-10-12 05:01 - 00679424 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2017-04-21 12:05 - 2013-10-12 05:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2017-04-21 12:05 - 2013-08-05 04:56 - 00133056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2017-04-21 12:04 - 2016-02-05 21:44 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\fveapibase.dll
2017-04-21 12:04 - 2016-02-05 20:33 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\tbs.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00922432 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00066400 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00022368 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00019808 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00016224 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00015712 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00013664 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
2017-04-21 12:04 - 2015-06-03 23:22 - 00355456 _____ (Microsoft Corporation) C:\Windows\system32\fveapi.dll
2017-04-21 12:04 - 2014-07-17 04:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2017-04-21 12:04 - 2014-07-17 04:39 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2017-04-21 12:04 - 2014-07-17 04:39 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2017-04-21 12:04 - 2014-07-17 04:39 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2017-04-21 12:04 - 2014-07-17 04:03 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2017-04-21 12:04 - 2014-07-17 04:02 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2017-04-21 12:04 - 2012-04-26 07:45 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\rdpwsx.dll
2017-04-21 12:04 - 2012-04-26 07:41 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\rdrmemptylst.exe
2017-04-21 12:03 - 2016-05-11 18:19 - 00351744 _____ (Microsoft Corporation) C:\Windows\system32\winhttp.dll
2017-04-21 12:03 - 2016-05-11 18:19 - 00231424 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2017-04-21 12:03 - 2016-05-11 18:19 - 00206336 _____ (Microsoft Corporation) C:\Windows\system32\ws2_32.dll
2017-04-21 12:03 - 2016-05-11 18:01 - 00026624 _____ (Microsoft Corporation) C:\Windows\system32\netbtugc.exe
2017-04-21 12:03 - 2016-05-11 17:52 - 00188928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbt.sys
2017-04-21 12:03 - 2015-07-15 05:55 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\basesrv.dll
2017-04-21 12:03 - 2012-01-04 11:58 - 00442880 _____ (Microsoft Corporation) C:\Windows\system32\ntshrui.dll
2017-04-21 12:02 - 2012-11-23 05:48 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\taskhost.exe
2017-04-21 12:01 - 2015-06-02 02:47 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\cewmdm.dll
2017-04-21 12:01 - 2015-02-25 06:03 - 00514560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2017-04-21 12:01 - 2014-12-06 06:50 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2017-04-21 12:01 - 2014-01-29 05:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2017-04-21 12:01 - 2012-10-03 19:42 - 00156672 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll
2017-04-21 12:01 - 2012-10-03 19:42 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll
2017-04-21 12:00 - 2016-04-09 09:59 - 00730344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2017-04-21 12:00 - 2016-04-09 09:59 - 00218856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2017-04-21 12:00 - 2016-04-09 09:54 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2017-04-21 12:00 - 2015-12-09 00:54 - 01620992 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2017-04-21 12:00 - 2015-12-09 00:54 - 01568768 _____ (Microsoft Corporation) C:\Windows\system32\WMVENCOD.DLL
2017-04-21 12:00 - 2015-12-09 00:54 - 00902144 _____ (Microsoft Corporation) C:\Windows\system32\WMADMOD.DLL
2017-04-21 12:00 - 2015-12-09 00:54 - 00815616 _____ (Microsoft Corporation) C:\Windows\system32\WMADMOE.DLL
2017-04-21 12:00 - 2015-12-09 00:54 - 00740352 _____ (Microsoft Corporation) C:\Windows\system32\wmpmde.dll
2017-04-21 12:00 - 2015-12-09 00:54 - 00739328 _____ (Microsoft Corporation) C:\Windows\system32\WMSPDMOD.DLL
2017-04-21 12:00 - 2015-12-09 00:54 - 00665088 _____ (Microsoft Corporation) C:\Windows\system32\WMVXENCD.DLL
2017-04-21 12:00 - 2015-12-09 00:54 - 00541184 _____ (Microsoft Corporation) C:\Windows\system32\WMVSDECD.DLL
2017-04-21 12:00 - 2015-12-09 00:53 - 00970240 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2adec.dll
2017-04-21 12:00 - 2015-12-09 00:53 - 00829952 _____ (Microsoft Corporation) C:\Windows\system32\MSMPEG2ENC.DLL
2017-04-21 12:00 - 2015-12-09 00:53 - 00728576 _____ (Microsoft Corporation) C:\Windows\system32\mcmde.dll
2017-04-21 12:00 - 2015-12-09 00:53 - 00153600 _____ (Microsoft Corporation) C:\Windows\system32\COLORCNV.DLL
2017-04-21 11:59 - 2015-12-09 00:54 - 01325056 _____ (Microsoft Corporation) C:\Windows\system32\WMSPDMOE.DLL
2017-04-21 11:59 - 2015-12-09 00:54 - 00358400 _____ (Microsoft Corporation) C:\Windows\system32\WMVSENCD.DLL
2017-04-21 11:59 - 2015-12-09 00:54 - 00154112 _____ (Microsoft Corporation) C:\Windows\system32\VIDRESZR.DLL
2017-04-21 11:59 - 2015-12-09 00:53 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\MFWMAAEC.DLL
2017-04-21 11:59 - 2015-12-09 00:53 - 00415744 _____ (Microsoft Corporation) C:\Windows\system32\MP4SDECD.DLL
2017-04-21 11:59 - 2015-12-09 00:53 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\MPG4DECD.DLL
2017-04-21 11:59 - 2015-12-09 00:53 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\MP43DECD.DLL
2017-04-21 11:59 - 2015-12-09 00:53 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\RESAMPLEDMO.DLL
2017-04-21 11:59 - 2015-12-09 00:53 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\qasf.dll
2017-04-21 11:59 - 2015-12-09 00:53 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\ksproxy.ax
2017-04-21 11:59 - 2015-12-09 00:53 - 00079872 _____ (Microsoft Corporation) C:\Windows\system32\MP3DMOD.DLL
2017-04-21 11:59 - 2015-12-09 00:53 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\devenum.dll
2017-04-21 11:59 - 2015-12-09 00:53 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\mfvdsp.dll
2017-04-21 11:59 - 2015-12-09 00:53 - 00004608 _____ (Microsoft Corporation) C:\Windows\system32\ksuser.dll
2017-04-21 11:59 - 2015-02-04 05:54 - 00318464 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2017-04-21 11:59 - 2013-06-26 01:56 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2017-04-21 11:59 - 2012-11-29 01:57 - 00047720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfLdr.sys
2017-04-21 11:59 - 2012-11-29 01:57 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\Wdfres.dll
2017-04-21 11:59 - 2012-11-29 01:57 - 00000003 _____ C:\Windows\system32\Drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
2017-04-21 11:58 - 2014-12-08 05:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2017-04-21 11:58 - 2013-12-04 05:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2017-04-21 11:58 - 2013-12-04 05:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2017-04-21 11:58 - 2013-12-04 05:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2017-04-21 11:58 - 2013-12-04 05:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2017-04-21 11:58 - 2013-12-04 05:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2017-04-21 11:58 - 2013-12-04 04:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2017-04-21 11:58 - 2013-12-04 04:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2017-04-21 11:58 - 2013-12-04 04:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2017-04-21 11:58 - 2013-12-04 04:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2017-04-21 11:57 - 2015-04-24 20:56 - 00530432 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2017-04-21 11:57 - 2014-10-14 04:50 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2017-04-21 03:45 - 2016-01-11 21:54 - 01212352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2017-04-21 03:31 - 2017-04-21 03:31 - 00000000 __SHD C:\Users\VTB\AppData\Local\kemgadeojglibflomicgnfeopkdfflnw
2017-04-21 02:17 - 2017-04-21 02:17 - 00000000 ____D C:\Users\Public\Documents\XMUpdate
2017-04-19 23:24 - 2017-04-22 16:56 - 00000000 ____D C:\Users\VTB\AppData\LocalLow\uTorrent
2017-04-18 02:10 - 2017-04-18 02:11 - 00519680 _____ (Auslogics) C:\Users\VTB\Downloads\boost_speed_stub_installer(1).exe
2017-04-18 01:58 - 2017-04-18 01:58 - 00519680 _____ (Auslogics) C:\Users\VTB\Downloads\boost_speed_stub_installer.exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-04-23 00:01 - 2013-09-23 19:27 - 00000000 ____D C:\Users\VTB\AppData\Roaming\uTorrent
2017-04-22 23:57 - 2013-09-24 19:27 - 00000000 ____D C:\Users\VTB\AppData\Roaming\Skype
2017-04-22 23:32 - 2013-09-23 20:30 - 00000000 ____D C:\Users\VTB\AppData\Roaming\vlc
2017-04-22 20:13 - 2015-03-12 23:27 - 00064288 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
2017-04-22 17:14 - 2016-11-18 13:07 - 00000000 ____D C:\Users\VTB\AppData\LocalLow\Mozilla
2017-04-22 17:08 - 2009-07-14 07:34 - 00021072 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-04-22 17:08 - 2009-07-14 07:34 - 00021072 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-04-22 17:03 - 2010-11-21 00:01 - 00713888 _____ C:\Windows\system32\PerfStringBackup.INI
2017-04-22 17:03 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\inf
2017-04-22 16:57 - 2015-03-12 23:28 - 00220088 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-04-22 16:57 - 2015-03-12 23:27 - 00039360 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2017-04-22 16:55 - 2009-07-14 07:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-04-22 01:57 - 2013-09-23 19:23 - 00063544 _____ C:\Users\VTB\AppData\Local\GDIPFONTCACHEV1.DAT
2017-04-22 01:52 - 2009-07-14 07:33 - 00280032 _____ C:\Windows\system32\FNTCACHE.DAT
2017-04-22 01:49 - 2010-11-21 03:46 - 00000000 ____D C:\Windows\ShellNew
2017-04-22 01:49 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\system32\AdvancedInstallers
2017-04-22 01:49 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\PolicyDefinitions
2017-04-22 01:49 - 2009-07-14 05:37 - 00000000 ____D C:\Program Files\Common Files\System
2017-04-22 01:48 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\system32\Dism
2017-04-21 20:47 - 2016-02-19 20:20 - 00002099 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-04-21 20:47 - 2016-02-19 20:20 - 00002087 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-04-21 19:54 - 2013-09-23 19:59 - 00001011 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-04-21 18:49 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\system32\NDF
2017-04-21 16:45 - 2015-03-12 23:27 - 00161216 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2017-04-21 16:41 - 2014-08-06 23:12 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-04-21 16:25 - 2009-07-14 05:04 - 00000722 _____ C:\Windows\win.ini
2017-04-21 15:41 - 2009-07-14 07:52 - 00000000 ____D C:\Program Files\Windows Defender
2017-04-21 12:32 - 2013-09-23 20:44 - 00002057 _____ C:\Windows\epplauncher.mif
2017-04-21 12:31 - 2013-09-23 20:44 - 00002077 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2017-04-21 12:31 - 2013-09-23 20:43 - 00000000 ____D C:\Program Files\Microsoft Security Client
2017-04-21 02:12 - 2013-09-23 09:08 - 00001136 _____ C:\Users\VTB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2017-04-21 01:33 - 2013-09-23 20:35 - 00000000 ____D C:\Users\VTB\AppData\Roaming\Winamp
2017-04-21 01:25 - 2015-03-12 23:28 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2017-04-21 01:08 - 2016-01-19 19:05 - 00000168 _____ C:\Users\VTB\Desktop\email, skype.txt
2017-04-20 14:57 - 2016-11-18 01:56 - 00000000 ____D C:\Program Files\Mozilla Firefox
2017-04-20 13:00 - 2013-09-23 09:07 - 00000000 ____D C:\Users\VTB
2017-04-18 02:05 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\registration
2017-04-18 02:05 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\Help
2017-04-17 01:41 - 2014-04-27 16:26 - 00000000 ____D C:\ProgramData\DatacardService
2017-04-11 19:20 - 2013-09-23 19:57 - 00802904 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2017-04-11 19:20 - 2013-09-23 19:57 - 00144472 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2017-04-11 19:20 - 2013-09-23 19:50 - 00000000 ____D C:\Windows\system32\Macromed
2017-04-08 01:06 - 2013-09-23 19:24 - 00430248 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2017-04-02 06:07 - 2013-09-23 19:59 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2017-03-30 15:25 - 2009-07-14 07:53 - 00032594 _____ C:\Windows\Tasks\SCHEDLGU.TXT

==================== Files in the root of some directories =======

2014-09-01 11:18 - 2014-09-01 11:18 - 0002086 _____ () C:\Users\VTB\AppData\Roaming\LM
2014-09-01 11:18 - 2014-09-01 11:18 - 0001248 _____ () C:\Users\VTB\AppData\Roaming\ZMYSP
2015-02-14 12:38 - 2015-03-04 00:59 - 0000058 _____ () C:\Users\VTB\AppData\Local\DonationCoder_ScreenshotCaptor_InstallInfo.dat

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-04-20 20:46

==================== End of FRST.txt ============================

Addition3.txt

23 април 20179 г.

Здравейте,

СТЪПКА 1

След това Изтеглете fixlist.txt и го запазете на десктопа.
Стартирайте FRST.exe и натиснете бутона Fix веднъж!
След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.

Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

СТЪПКА 2

Изтеглете следния файл => run.vbs

Запазете го на десктопа.

В търсачката на Windows въведете CMD.exe => кликнете с десен бутон върху CMD.exe и изберете Run as administrator.

В конзолата въведете командата:

cd c:\users\%username%\desktop

Натиснете Enter

сега въведете командата:

cscript run.vbs

Натиснете Enter

Рестартирайте системата.

23 април 20179 г.

Автор

Изпълних стъпка1 и стъпка 2

Fix result of Farbar Recovery Scan Tool (x86) Version: 22-04-2017 01
Ran by VTB (23-04-2017 11:16:38) Run:1
Running from C:\Users\VTB\Desktop
Loaded Profiles: VTB (Available Profiles: VTB)
Boot Mode: Normal

==============================================

fixlist content:
*****************
start
CreateRestorePoint:
CloseProcesses:
HKU\S-1-5-21-2291805700-3923089709-3695025833-1000\...\MountPoints2: {57db2e36-ce0f-11e3-8801-001b38791474} - G:\AutoRun.exe
HKU\S-1-5-21-2291805700-3923089709-3695025833-1000\...\MountPoints2: {57db2e4a-ce0f-11e3-8801-001b38791474} - G:\AutoRun.exe
HKU\S-1-5-21-2291805700-3923089709-3695025833-1000\...\MountPoints2: {59e747cd-2f70-11e5-9afb-001b38791474} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL G:\Install.bat
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
FF Extension: (Disable TLS Certificate Transparency) - C:\Users\VTB\AppData\Roaming\Mozilla\Firefox\Profiles\a9nvgmro.default-1492816599870\features\{95307fc3-7ebd-4a4e-9e57-36789c357280}\[email protected] [2017-04-22]
FF Extension: (Disable Prefetch) - C:\Users\VTB\AppData\Roaming\Mozilla\Firefox\Profiles\a9nvgmro.default-1492816599870\features\{95307fc3-7ebd-4a4e-9e57-36789c357280}\[email protected] [2017-04-22]
FF Extension: (Site Deployment Checker) - C:\Program Files\Mozilla Firefox\browser\features\[email protected] [2017-04-01] [not signed]
cmd: type "C:\Users\VTB\Desktop\ZHPCleaner.txt"
cmd: type "C:\Users\VTB\Desktop\JRT.txt"
cmd: type "C:\Users\VTB\Desktop\ф,и.txt"
cmd: type "C:\Users\VTB\Desktop\AdwCleaner[C0].txt"
cmd: type "C:\Users\VTB\Desktop\111.txt"
2017-04-21 03:31 - 2017-04-21 03:31 - 00000000 __SHD C:\Users\VTB\AppData\Local\kemgadeojglibflomicgnfeopkdfflnw
2017-04-21 02:17 - 2017-04-21 02:17 - 00000000 ____D C:\Users\Public\Documents\XMUpdate
Task: {31F68D47-F1E3-4BBD-9EAC-60D93C147693} - System32\Tasks\{986C088D-F0A8-4CA2-8762-DD21514D9BC2} => pcalua.exe -a "D:\Програми\Portable Microsoft Office 2003.exe"
AlternateDataStreams: C:\Windows\system32\drivers:ucdrv-x86.sys [84370]
AlternateDataStreams: C:\ProgramData\TEMP:56E2E879 [118]
FirewallRules: [{A2546E71-9FCE-4273-9FE6-8FD880D8B442}] => (Allow) C:\Program Files\UCBrowser\Application\UCBrowser.exe
FirewallRules: [{DFCBB092-44DB-47BA-9387-3D0BBA37D165}] => (Allow) C:\Program Files\Maoha\MaohaAP\MaohaWifiSvr.exe
C:\Program Files\UCBrowser
C:\Program Files\Maoha
CMD: winmgmt /resyncperf
CMD: lodctr /R
CMD: winmgmt /resyncperf
CMD: lodctr /R
File: C:\Windows\System32\drivers\cryptfd.sys
File: C:\Windows\System32\DRIVERS\EMSC.SYS
cmd: bitsadmin /reset /allusers
cmd: netsh winsock reset catalog
cmd: ipconfig /flushdns
RemoveProxy:
EmptyTemp:
End
*****************

Restore point was successfully created.
Processes closed successfully.
HKU\S-1-5-21-2291805700-3923089709-3695025833-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{57db2e36-ce0f-11e3-8801-001b38791474} => key removed successfully.
HKCR\CLSID\{57db2e36-ce0f-11e3-8801-001b38791474} => key not found.
HKU\S-1-5-21-2291805700-3923089709-3695025833-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{57db2e4a-ce0f-11e3-8801-001b38791474} => key removed successfully.
HKCR\CLSID\{57db2e4a-ce0f-11e3-8801-001b38791474} => key not found.
HKU\S-1-5-21-2291805700-3923089709-3695025833-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{59e747cd-2f70-11e5-9afb-001b38791474} => key removed successfully.
HKCR\CLSID\{59e747cd-2f70-11e5-9afb-001b38791474} => key not found.
HKLM\SOFTWARE\Policies\Google => key removed successfully.
C:\Users\VTB\AppData\Roaming\Mozilla\Firefox\Profiles\a9nvgmro.default-1492816599870\features\{95307fc3-7ebd-4a4e-9e57-36789c357280}\[email protected] => moved successfully
C:\Users\VTB\AppData\Roaming\Mozilla\Firefox\Profiles\a9nvgmro.default-1492816599870\features\{95307fc3-7ebd-4a4e-9e57-36789c357280}\[email protected] => moved successfully
C:\Program Files\Mozilla Firefox\browser\features\[email protected] => moved successfully

========= type "C:\Users\VTB\Desktop\ZHPCleaner.txt" =========

‘ЁбвҐ¬ в Ґ ¬®¦Ґ ¤ ¬ҐаЁ гЄ § Ёп д ©«.

========= End of CMD: =========

========= type "C:\Users\VTB\Desktop\JRT.txt" =========

‘ЁбвҐ¬ в Ґ ¬®¦Ґ ¤ ¬ҐаЁ гЄ § Ёп д ©«.

========= End of CMD: =========

========= type "C:\Users\VTB\Desktop\ф,и.txt" =========

‘ЁбвҐ¬ в Ґ ¬®¦Ґ ¤ ¬ҐаЁ гЄ § Ёп д ©«.

========= End of CMD: =========

========= type "C:\Users\VTB\Desktop\AdwCleaner[C0].txt" =========

‘ЁбвҐ¬ в Ґ ¬®¦Ґ ¤ ¬ҐаЁ гЄ § Ёп д ©«.

========= End of CMD: =========

========= type "C:\Users\VTB\Desktop\111.txt" =========

‘ЁбвҐ¬ в Ґ ¬®¦Ґ ¤ ¬ҐаЁ гЄ § Ёп д ©«.

========= End of CMD: =========

C:\Users\VTB\AppData\Local\kemgadeojglibflomicgnfeopkdfflnw => moved successfully
C:\Users\Public\Documents\XMUpdate => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{31F68D47-F1E3-4BBD-9EAC-60D93C147693} => key removed successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{31F68D47-F1E3-4BBD-9EAC-60D93C147693} => key removed successfully.
C:\Windows\System32\Tasks\{986C088D-F0A8-4CA2-8762-DD21514D9BC2} => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{986C088D-F0A8-4CA2-8762-DD21514D9BC2} => key removed successfully.
C:\Windows\system32\drivers => ":ucdrv-x86.sys" ADS removed successfully..
C:\ProgramData\TEMP => ":56E2E879" ADS removed successfully..
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{A2546E71-9FCE-4273-9FE6-8FD880D8B442} => value removed successfully.
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{DFCBB092-44DB-47BA-9387-3D0BBA37D165} => value removed successfully.
"C:\Program Files\UCBrowser" => not found.
"C:\Program Files\Maoha" => not found.

========= winmgmt /resyncperf =========

========= End of CMD: =========

========= lodctr /R =========

Info: Successfully rebuilt performance counter setting from system backup store
========= End of CMD: =========

========= winmgmt /resyncperf =========

========= End of CMD: =========

========= lodctr /R =========

Info: Successfully rebuilt performance counter setting from system backup store
========= End of CMD: =========

========================= File: C:\Windows\System32\drivers\cryptfd.sys ========================

File is digitally signed
MD5: BF8E043011EA2107A62BBFD8F4C25B93
Creation and modification date: 2017-03-03 05:35 - 2017-03-03 05:35
Size: 0176552
Attributes: ----A
Company Name:
Internal Name:
Original Name:
Product:
Description:
File Version:
Product Version:
Copyright:

====== End of File: ======

========================= File: C:\Windows\System32\DRIVERS\EMSC.SYS ========================

File is digitally signed
MD5: 553CFF6CF3622DE0D7FEFDEBE72A6395
Creation and modification date: 2007-03-14 10:16 - 2007-03-14 10:16
Size: 0009856
Attributes: ----A
Company Name:
Internal Name:
Original Name:
Product:
Description:
File Version:
Product Version:
Copyright:

====== End of File: ======

========= bitsadmin /reset /allusers =========

BITSADMIN version 3.0 [ 7.5.7601 ]
BITS administration utility.
(C) Copyright 2000-2006 Microsoft Corp.

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

Unable to cancel {639BC7EE-810F-4BCE-8E07-D3014020733C}.
Unable to cancel {E1D89161-5EE2-4A6F-84E0-8BF28298FF08}.
0 out of 2 jobs canceled.

========= End of CMD: =========

========= netsh winsock reset catalog =========

Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.

========= End of CMD: =========

========= ipconfig /flushdns =========

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========

========= RemoveProxy: =========

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully.
HKU\S-1-5-21-2291805700-3923089709-3695025833-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully.
HKU\S-1-5-21-2291805700-3923089709-3695025833-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully.

========= End of RemoveProxy: =========

=========== EmptyTemp: ==========

BITS transfer queue => 8388608 B
DOMStoree, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 6244051 B
Java, Flash, Steam htmlcache => 727 B
Windows/system/drivers => 11417410 B
Edge => 0 B
Chrome => 5128039 B
Firefox => 63809075 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Users => 0 B
Default => 0 B
Public => 0 B
ProgramData => 0 B
systemprofile => 82776 B
LocalService => 0 B
NetworkService => 62312 B
VTB => 45018466 B

RecycleBin => 0 B
EmptyTemp: => 133.7 MB temporary data Removed.

================================

The system needed a reboot.

==== End of Fixlog 11:21:12 ====

23 април 20179 г.

Здравейте.

Сега изтеглете fixlist.txt и го запазете на десктопа.
Стартирайте FRST.exe и натиснете бутона Fix веднъж!
След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.

Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

24 април 20179 г.

Автор

Fix result of Farbar Recovery Scan Tool (x86) Version: 23-04-2017 01
Ran by VTB (24-04-2017 11:26:27) Run:2
Running from C:\Users\VTB\Desktop
Loaded Profiles: VTB (Available Profiles: VTB)
Boot Mode: Normal

==============================================

fixlist content:
*****************
start
cmd: type C:\Users\VTB\Desktop\ZHPCleaner.txt
cmd: type C:\Users\VTB\Desktop\JRT.txt
cmd: type C:\Users\VTB\Desktop\ф,и.txt
cmd: type C:\Users\VTB\Desktop\AdwCleaner[C0].txt
cmd: type C:\Users\VTB\Desktop\111.txt
Startbatch:
@echo off
net stop BITS
ipconfig /flushdns
ren "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr0.dat" qmgr0.dat.old
ren "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr1.dat" qmgr1.dat.old
net start BITS
Endbatch:
Powershell: Get-BitsTransfer -AllUsers | select -ExpandProperty FileList
Powershell: Get-BitsTransfer -AllUsers
cmd: bitsadmin /reset /allusers
end
*****************

========= type C:\Users\VTB\Desktop\ZHPCleaner.txt =========

‘ЁбвҐ¬ в Ґ ¬®¦Ґ ¤ ¬ҐаЁ гЄ § Ёп д ©«.

========= End of CMD: =========

========= type C:\Users\VTB\Desktop\JRT.txt =========

‘ЁбвҐ¬ в Ґ ¬®¦Ґ ¤ ¬ҐаЁ гЄ § Ёп д ©«.

========= End of CMD: =========

========= type C:\Users\VTB\Desktop\ф,и.txt =========

‘ЁбвҐ¬ в Ґ ¬®¦Ґ ¤ ¬ҐаЁ гЄ § Ёп д ©«.
Error occurred while processing: C:\Users\VTB\Desktop\д.
‘ЁбвҐ¬ в Ґ ¬®¦Ґ ¤ ¬ҐаЁ гЄ § Ёп д ©«.
Error occurred while processing: Ё.txt.

========= End of CMD: =========

========= type C:\Users\VTB\Desktop\AdwCleaner[C0].txt =========

‘ЁбвҐ¬ в Ґ ¬®¦Ґ ¤ ¬ҐаЁ гЄ § Ёп д ©«.

========= End of CMD: =========

========= type C:\Users\VTB\Desktop\111.txt =========

‘ЁбвҐ¬ в Ґ ¬®¦Ґ ¤ ¬ҐаЁ гЄ § Ёп д ©«.

========= End of CMD: =========

========= Batch: =========
The Background Intelligent Transfer Service service is not started.

More help is available by typing NET HELPMSG 3521.

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.
The Background Intelligent Transfer Service service is starting.
The Background Intelligent Transfer Service service was started successfully.

========= End of Batch: =========

========= Get-BitsTransfer -AllUsers | select -ExpandProperty FileList =========

========= End of Powershell: =========

========= Get-BitsTransfer -AllUsers =========

========= End of Powershell: =========

========= bitsadmin /reset /allusers =========

BITSADMIN version 3.0 [ 7.5.7601 ]
BITS administration utility.
(C) Copyright 2000-2006 Microsoft Corp.

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

0 out of 0 jobs canceled.

========= End of CMD: =========

==== End of Fixlog 11:27:13 ====

24 април 20179 г.

Как е сега положението?

Да направим малко контролни проверки и приключваме:

СТЪПКА 1

1.Изтеглете Hitman Pro.

За 32-битова система - .
За 64-битова система -

2.Стартирайте програмата.
3.След като сте стартирали програмата като кликнете върху иконата и натиснете бутона „Напред“ като се съгласите с лицензионното споразумение (EULA).

4.Сложете отметка пред "Не, искам да завърша еднократно сканиране на компютъра".

5.Натиснете бутона „Напред“.

6.Програмата ще започне да сканира. Времето за сканиране е около 2 минути.

7.След завършване на сканирането от списъка с намерените неща (ако има такива) изберете Apply to all => Ignore.

8.Натиснете "Next" и след това натиснете "Изнеси резултата в XML file" и запазете лог файла на десктопа.

9.Архивирайте файла и го прикачете в следващия си коментар или копирайте съдържанието му в следващия си коментар.

Забележка: Ако няма падащо меню, където да изберете ignore както на снимката:

Тогава просто затворете програмата след края на проверката (без да премахвате нищо)...след това отворете C:\Programdata\HitmanPro\Logs, отворете и публикувайте съдържанието на лог файла в следващия си коментар. Пак повтарям, не трийте нищо с програмата, защото е доста мощна и може да бъде опасна!

Забележка: Папката C:\ProgramData е скрита и затова трябва да направите скритите файлове видими по-следния начин:

От My Computer => Tools => Folder Options => View:

Сложете отметка пред "Show hidden files, folders and drives"

и махнете отметката пред "Hide protected operating system files (recommended)".

Натиснете Apply.

Сега проверете за лог файла в папката C:\Programdata\HitmanPro\Logs и го прикачете в следващия си коментар.

СТЪПКА 2

За финал искам да направим и една последна проверка за всеки случай:

Моля изтеглете и стартирайте изпълнимия файл от линка: ESET Online Scanner
Сложете отметката пред (ако опцията е налична) и натиснете бутона .

Добре е да изключите вашата антивирусна преди началото на проверката. За да видите списъка с инсталираната от вас антивирусна програма, която трябва да изключите натиснете бутона .
Ще се появи списък с инсталираната от вас антивирусна програма:

Изключете антивирусната си програма.

Сложете отметката пред: Enable detection of potentially unwanted applications.
Сега кликнете на Advanced Settings и се уверете, че опцията Clean threats automatically не е маркирана, а следните са маркирани:

Enable detection of potentially unsafe applications
Enable detection of suspicious applications
Scan archives
Enable Anti-Stealth Technology

Изберете сега бутона Change и поставете отметки пред следните обекти Operating memory, Autostart locations и дял C:\

Натиснете бутона за да започне проверката.
ESET ще започне да сваля и инсталира актуализации за вирусните дефиниции и след това ще започне да сканира компютъра. Бъдете търпеливи, защото процеса е бавен и може да отнеме доста време.

След като проверката приключи списъка с намерените зарази ще се отвори автоматично (ако такива са намерени).

Натиснете бутона и запазете файла на десктопа с име по избор като например (ESETScan.txt). Копирайте резултата в следващия си коментар.
Натиснете бутона
Сложете отметка пред за да почистите следите от приложението след затварянето му.
Натиснете бутона и след това затворете приложението от хикса в горния десен ъгъл.

24 април 20179 г.

Автор

Сега положението е по-добро. Malwarebytes непрекъсното ми дава съобщение, че уеб сайтът е блокиран : C:\Users\...uTorrent.exe Дали да не деинсталирам uTorrent? Резултата от сканирането:

HitmanPro 3.7.3.193
www.hitmanpro.com
	   Computer name . . . . : VTB-PC
   Windows . . . . . . . : 6.1.1.7601.X86/2
   User name . . . . . . : VTB-PC\VTB
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Trial (Expired)
	   Scan date . . . . . . : 2017-04-24 13:15:02
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 13m 8s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No
	   Threats . . . . . . . : 0
   Traces  . . . . . . . : 12
	   Objects scanned . . . : 1 840 378
   Files scanned . . . . : 21 809
   Remnants scanned  . . : 1 225 270 files / 593 299 keys
	Miniport ____________________________________________________________________
	   Primary
      DriverObject . . . : 853ED780
      DriverName . . . . : \Driver\atapi
      DriverPath . . . . : \SystemRoot\system32\drivers\atapi.sys
      StartIo  . . . . . : 00000000 +0
      IRP_MJ_SCSI  . . . : 853571F8 +0
Cloud failed
	Cookies _____________________________________________________________________
	   C:\Users\VTB\AppData\Roaming\Mozilla\Firefox\Profiles\a9nvgmro.default-1492816599870\cookies.sqlite:ads.kaldata.com
   C:\Users\VTB\AppData\Roaming\Mozilla\Firefox\Profiles\a9nvgmro.default-1492816599870\cookies.sqlite:adtech.de
   C:\Users\VTB\AppData\Roaming\Mozilla\Firefox\Profiles\a9nvgmro.default-1492816599870\cookies.sqlite:adtechus.com
   C:\Users\VTB\AppData\Roaming\Mozilla\Firefox\Profiles\a9nvgmro.default-1492816599870\cookies.sqlite:advertising.com
   C:\Users\VTB\AppData\Roaming\Mozilla\Firefox\Profiles\a9nvgmro.default-1492816599870\cookies.sqlite:casalemedia.com
   C:\Users\VTB\AppData\Roaming\Mozilla\Firefox\Profiles\a9nvgmro.default-1492816599870\cookies.sqlite:doubleclick.net
   C:\Users\VTB\AppData\Roaming\Mozilla\Firefox\Profiles\a9nvgmro.default-1492816599870\cookies.sqlite:ero-advertising.com
   C:\Users\VTB\AppData\Roaming\Mozilla\Firefox\Profiles\a9nvgmro.default-1492816599870\cookies.sqlite:revsci.net
   C:\Users\VTB\AppData\Roaming\Mozilla\Firefox\Profiles\a9nvgmro.default-1492816599870\cookies.sqlite:smartadserver.com
   C:\Users\VTB\AppData\Roaming\Mozilla\Firefox\Profiles\a9nvgmro.default-1492816599870\cookies.sqlite:statcounter.com
   C:\Users\VTB\AppData\Roaming\Mozilla\Firefox\Profiles\a9nvgmro.default-1492816599870\cookies.sqlite:www.googleadservices.com
   C:\Users\VTB\AppData\Roaming\Mozilla\Firefox\Profiles\a9nvgmro.default-1492816599870\cookies.sqlite:yadro.ru

24 април 20179 г.

Сканирали сте с доста стара версия на Hitmanpro. Не мисля, че линковете, които съм дал водят към нея, но за всеки случай ето линк към последната бета:

http://dl.surfright.nl/HitmanProBeta.exe

И без това нещо облачната услуга се е провалила => Cloud failed така че повторете проверката.

А иначе е нормално, когато uTorrent е активен, MBAM да засича подозрителна активност с Web protection модула си. Имате 3 възможности:

1. Да спирате Web protection-a, докато използвате uTorrent (не препоръчително, макар че една защитна стена с правилни правила за работа с uTorrent би свършила по-добра работа с по-малко предупреждения).

2. Да оставите Web protection-a включен, но да изключите предупрежденията изцяло (не препоръчително, защото при истинска заплаха няма да получите предупреждение).

3. Да оставите включен Web protection-a, като просто игнорирате съобщенията за блокирани адреси през uTorrent-a. Досадно е, но MBAM просто си върши работата.

Поздрави!

24 април 20179 г.

Автор

Не мога да сканирам с Hitman ProBeta, компютъра се рестартира 4 пъти, след като натисна бутона Напред. Между другото и на по -предното сканиране с HitmanPro първия път компютъра се рестартира. Не знам, късно е. Дали аз не бъркам нещо?

24 април 20179 г.

Възможно е да е бъг в самата програма или да има хардуерен проблем. Има ли файлове в папката C:\Windows\minidump с дата 24-ти април? Ако да, копирайте ги на десктопа и ги архивирайте. Качете архива на адрес www.dox.bg и публикувайте линка за изтегляне на архива в следващия си коментар.

Ок, засега пропуснете проверката с HitmanPro и направете такава само с Eset. Ако трябва вместо HitmanPro ще използваме друг скенер като Zemana Anti-Malware, RogueKiller или EmsisoftEmergencyKit.

Нарочно не ви пуснах проверка с AdwCleaner, JRT, ZHPCleaner и Malwarebytes Anti-Malware, защото видях, че вече сте ги използвали.

Поздрави!

25 април 20179 г.

Автор

Здравейте, линка за сваляне:

http://dox.bg/files/dw?a=5b7e090db3

И вчерашното сканиране с Eset:

C:\Users\VTB\AppData\Roaming\LM   JS/Toolbar.Crossrider.C potentially unwanted application
C:\Users\VTB\AppData\Roaming\ZMYSP   JS/Toolbar.Crossrider.C potentially unwanted application
C:\Users\VTB\AppData\Roaming\uTorrent\updates\3.4.2_37754.exe   a variant of Win32/OpenCandy.A potentially unsafe application
C:\Users\VTB\AppData\Roaming\uTorrent\updates\3.4.2_38913.exe   a variant of Win32/OpenCandy.A potentially unsafe application
C:\Users\VTB\Downloads\boost_speed_stub_installer(1).exe   Win32/Deceptor.BoostSpeed.A application
C:\Users\VTB\Downloads\boost_speed_stub_installer.exe   Win32/Deceptor.BoostSpeed.A application
C:\Users\VTB\Downloads\ccsetup514pro(1).exe   Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\VTB\Downloads\ccsetup514pro.exe   Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\VTB\Downloads\FreeAudioConverter.exe   a variant of Win32/OpenCandy.A potentially unsafe application
C:\Windows\FixCamera.exe   a variant of Win32/KillProc.A potentially unwanted application

25 април 20179 г.

Лог файла е чист. Има само два елемента за премахване.

За да ги изтрием направете следното:

Сега изтеглете fixlist.txt и го запазете на десктопа.
Стартирайте FRST.exe и натиснете бутона Fix веднъж!
След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.

Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

А иначе прегледах dmp файловете и ги пратих на разработчиците на HitmanPro за да оправят проблема в следващата версия (ако проблема е бил в HitmanPro).

Докато ги анализирах видях обаче, че проблема може да се дължи и на проблеми с РАМ паметта. (memory_corruption).

Затова е добре да тествате плочките една по една с MemTest86+.

Инструкции има тук:

25 април 20179 г.

Автор

Лог файла:

Fix result of Farbar Recovery Scan Tool (x86) Version: 23-04-2017 01
Ran by VTB (25-04-2017 18:51:42) Run:3
Running from C:\Users\VTB\Desktop
Loaded Profiles: VTB (Available Profiles: VTB)
Boot Mode: Normal

==============================================

fixlist content:
*****************
start
C:\Users\VTB\AppData\Roaming\LM
C:\Users\VTB\AppData\Roaming\ZMYSP
end
*****************

C:\Users\VTB\AppData\Roaming\LM => moved successfully
C:\Users\VTB\AppData\Roaming\ZMYSP => moved successfully

==== End of Fixlog 18:51:42 ====

Да сканирам ли още за вируси? Сега ще се опитам да тествам РАМ паметта. Благодаря.

26 април 20179 г.

Автор

Не можах да тествам паметта с Memtest86+ 5.01

DVD записвачката нещо се прецака. Ако може по-късно да направя тази проверка? Сканирах с Memtest и не откри грешки. Сега какво следва?

26 април 20179 г.

С коя MemTest се сканирали? С тази, която сканира под Windows ли?

MemTest 5.0 не е лоша програма, но съвсем не е обстойна като Memtest86+.

Разбира се, добре е, че не е намерила проблеми, но това не дава гаранция, че такива наистина липсват. Разбира се проблема не е задължително да е в RAM паметта, ако се случва само при стартиране на HitmanPro (то така или иначе файловете са при автора на инструмента и ако открие нередности ще ги отстрани в бъдещите версии на програмата), но ако имате възможности тествайте и с MemTest86+. Не е задължително да се използва DVD записвачката. Може да използвате и флашка за целта. В интернет има инструкции как да стане това.

В краен случай можете да използвате и вградената програма на Windows за целта - Windows Memory Diagnostic => стартирате я и избирате Restart and check for problems:

Като зареди теста, натиснете F1 и изберете разширен тест => Extended => натиснете F10 за да приложите промените и остава да чакате (най-добре оставете теста за през нощта). Но все пак намирам, че дори този тест да мине без проблеми понякога Memtest86+ намира такива пропуснати и от него.

Пример е тази тема:

Чак, когато MemTest86+ не даде грешки вече може да сте спокойни, че проблема едва ли се крие в РАМ паметта.

Но ако машината си работи коректно не се занимавайте.

Ето и последните 3 проверки и след това ще ви дам финални инструкции как да почистите използваните от нас неща:

СТЪПКА 1

Моля, изтеглете Zemana AntiMalware и го запишете на вашия работен плот.

Стартирайте програмата.
Кликнете върху иконата .
Отидете на Scan и сложете отметка пред Create Restore Point.
Отидете на Advanced и кликнете бутона I have read the warning and wish to proceed anyway.
Сложете отметки пред Auto Upload и Detect suspicious (root CA) certificates.
Сега вече натиснете иконата .
Натиснете Scan за да започне проверката.
След кратко сканирането приключи кликнете върху иконата (не натискайте бутона Next) и отворете последния доклад.
Сега кликнете File => Save As и изберете своя Desktop и натиснете Save.
Моля копирайте съдържанието на лог файла в следващия си пост.

СТЪПКА 2

Изтеглете RogueKiller и го запазете на десктопа.

Забележка: Трябва да изтеглите версия съвместима с вашата система.

RogueKiller.exe

RogueKillerX64.exe

Стартирайте RogueKiller.exe. В новия прозорец изберете "Scan", след което изберете "Start Scan"

Когато сканирането завърши изберете "Open Report"

В новия прозорец изберете "Export txt" Ще се създаде лог файл с името RK.txt

Публикувайте лог файла в следващия си пост.

СТЪПКА 3

Моля изтеглете EmsisoftEmergencyKit, стартирайте exe файла и посочете къде да се разархивира програмата - например в (C:\EEK), натискайки бутона Extract.
Стартирайте иконата на файла Start Emsisoft Emergency Kit от десктопа за да стартирате приложението.
Натиснете бутона"Yes", когато бъдете подканени да обновите дефинициите на програмата.
След като процеса по обновяването на дефинициите приключи натиснете бутона "Scan".
Натиснете бутона "Yes", когато бъдете попитани дали да програмата да включи засичането на потенциално нежелани приложения (Potentially Unwanted Applications).
Сега вече изберете бутона Custom Scan. Премахнете от списъка всички дялове без C:\ (т.е. нека да остане само дял C:\ в списъка).
Натиснете Next за да започне проверката.
Когато проверката приключи натиснете бутона View Report.
Копирайте съдържанието на лог файла в следващия си коментар.

След това приключваме.

Поздрави!

27 април 20179 г.

Автор

Благодаря за инструкциите, прочетох в Интернет как да тествам паметта. За отчета на Zemana ви изпращам снимки на екрна, понеже не внимавах и изтеглих пак вирус, сканирах със Zemana и сега не мога да запиша отчета. Но файловете бяха същите.

27 април 20179 г.

Автор

Сканирах отново отначало. Ето лог файловете, където са открити заплахи:

ЕSET и ZHP Cleaner

Esetskan.txt

ZHPCleaner.txt

28 април 20179 г.

Момент, момент. Аз логовете от какви програми исках, вие какво публикувате?

Защо снимка от Zemana след като има възможност да се експортне лог файла в txt формат? Къде са проверките от Emsisoft и RogueKiller?

След като сте се заразили отново ще трябва да започнем отначало. Откъде ви хрумна да сканирате с Eset и ZHPCleaner?

Почваме от НУЛАТА!

Искам нови лог файлове от FRST. Прикачете лог файловете - FRST.txt и Addition.txt в следващия си коментар!

28 април 20179 г.

Автор

Ако има значение, ето лога на RogueKiller

RK.txt

28 април 20179 г.

Автор

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 27-04-2017
Ran by VTB (administrator) on VTB-PC (28-04-2017 13:01:03)
Running from C:\Users\VTB\Desktop
Loaded Profiles: VTB (Available Profiles: VTB)
Platform: Microsoft Windows 7 Ultimate Service Pack 1 (X86) Language: Български (България)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(ABBYY Production LLC) C:\Program Files\ABBYY FineReader 12\NetworkLicenseServer.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1002984 2016-11-14] (Microsoft Corporation)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2780112 2017-01-20] (Malwarebytes)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 0.0.0.0
Tcpip\..\Interfaces\{A2822287-723E-4E3D-82CE-DC080348D07D}: [DhcpNameServer] 192.168.1.1 0.0.0.0

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: C:\Users\VTB\AppData\Roaming\Mozilla\Firefox\Profiles\a9nvgmro.default-1492816599870 [2017-04-28]
FF Homepage: Mozilla\Firefox\Profiles\a9nvgmro.default-1492816599870 -> hxxps://www.google.bg/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_25_0_0_148.dll [2017-04-11] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.8 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2013-12-21] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFFICE.DLL [2003-07-15] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2013-12-21] (Adobe Systems Inc.)

Chrome:
=======
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 ABBYY.Licensing.FineReader.Professional.12.0; C:\Program Files\ABBYY FineReader 12\NetworkLicenseServer.exe [925904 2014-01-23] (ABBYY Production LLC)
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [3303888 2017-01-20] (Malwarebytes)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [103696 2016-11-14] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [280864 2016-11-14] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 cryptfd; C:\Windows\System32\drivers\cryptfd.sys [176552 2017-03-03] ()
R0 EMSC; C:\Windows\System32\DRIVERS\EMSC.SYS [9856 2007-03-14] ()
R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae.sys [59904 2017-03-22] ()
S3 gdrv; C:\Windows\gdrv.sys [15600 2013-10-20] (Windows (R) 2000 DDK provider)
S3 hitmanpro37; C:\Windows\system32\drivers\hitmanpro37.sys [47056 2017-04-26] ()
R2 MBAMChameleon; C:\Windows\system32\drivers\MBAMChameleon.sys [161216 2017-04-26] (Malwarebytes)
R3 MBAMFarflt; C:\Windows\system32\drivers\farflt.sys [96704 2017-04-28] (Malwarebytes)
R3 MBAMProtection; C:\Windows\system32\drivers\mbam.sys [39360 2017-04-28] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [220088 2017-04-28] (Malwarebytes)
R3 MBAMWebProtection; C:\Windows\system32\drivers\mwac.sys [64288 2017-04-28] (Malwarebytes)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [252808 2016-08-25] (Microsoft Corporation)
R1 MpKsl73ea1117; C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{EF003227-8F45-45B6-9121-71212F446813}\MpKsl73ea1117.sys [39168 2017-04-28] (Microsoft Corporation)
S3 SNP2STD; C:\Windows\System32\DRIVERS\snp2sxp.sys [10305664 2006-05-13] () [File not signed]
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2013-09-23] () [File not signed]
R1 ZAM; C:\Windows\System32\drivers\zam32.sys [181496 2017-04-27] (Zemana Ltd.)
U3 ad5uiez2; C:\Windows\system32\Drivers\ad5uiez2.sys [0 ] (Microsoft Corporation) <==== ATTENTION (zero byte File/Folder)
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X]
S3 huawei_cdcacm; system32\DRIVERS\ew_jucdcacm.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S1 ZAM_Guard; \??\C:\Windows\System32\drivers\zamguard32.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-04-28 12:53 - 2017-04-28 13:01 - 00007504 _____ C:\Users\VTB\Desktop\FRST.txt
2017-04-28 12:51 - 2017-04-28 12:51 - 01768448 _____ (Farbar) C:\Users\VTB\Desktop\FRST.exe
2017-04-28 12:35 - 2017-04-28 12:35 - 00010066 _____ C:\Users\VTB\Desktop\RK.txt
2017-04-28 10:55 - 2017-04-28 10:55 - 00024688 _____ C:\Windows\system32\Drivers\TrueSight.sys
2017-04-28 10:53 - 2017-04-28 12:38 - 00000000 ____D C:\ProgramData\RogueKiller
2017-04-28 10:47 - 2017-04-28 10:48 - 21950024 _____ C:\Users\VTB\Downloads\RogueKiller(1).exe
2017-04-28 10:28 - 2017-04-28 10:29 - 00000000 _____ C:\Users\VTB\Downloads\RogueKiller.exe
2017-04-28 00:08 - 2017-04-28 00:09 - 00000826 _____ C:\Users\VTB\Desktop\ZHPCleaner.lnk
2017-04-28 00:06 - 2017-04-28 00:06 - 02762240 _____ C:\Users\VTB\Desktop\ZHPCleaner(2).exe
2017-04-27 23:53 - 2017-04-28 00:28 - 00008215 _____ C:\Users\VTB\Desktop\ZHPCleaner.txt
2017-04-27 23:26 - 2017-04-27 23:26 - 00002196 _____ C:\Users\VTB\Desktop\Esetskan.txt
2017-04-27 20:18 - 2017-04-27 20:18 - 14554768 _____ (Copyright 2017.) C:\Users\VTB\Desktop\Zemana.AntiMalware.Portable.exe
2017-04-27 20:12 - 2017-04-27 20:12 - 00181496 _____ (Zemana Ltd.) C:\Windows\system32\Drivers\zam32.sys
2017-04-27 11:41 - 2017-04-27 11:48 - 302462848 _____ C:\Users\VTB\Downloads\EmsisoftEmergencyKit(1).exe
2017-04-26 18:25 - 2017-04-26 18:26 - 01663672 _____ (Malwarebytes) C:\Users\VTB\Downloads\JRT(3).exe
2017-04-26 17:41 - 2017-04-26 17:42 - 04102600 _____ C:\Users\VTB\Downloads\adwcleaner_6.046(1).exe
2017-04-26 17:29 - 2017-04-26 17:29 - 00201316 _____ C:\Users\VTB\Downloads\Google.htm
2017-04-26 17:10 - 2017-04-26 17:11 - 11007424 _____ (SurfRight B.V.) C:\Users\VTB\Downloads\hitmanpro(1).exe
2017-04-26 16:35 - 2017-04-26 16:35 - 00161216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMChameleon.sys
2017-04-26 16:34 - 2017-04-28 10:22 - 00064288 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
2017-04-26 16:34 - 2017-04-28 10:10 - 00220088 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-04-26 16:34 - 2017-04-28 10:10 - 00096704 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
2017-04-26 16:34 - 2017-04-28 10:10 - 00039360 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2017-04-26 16:34 - 2017-04-26 16:34 - 00001984 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-04-26 16:34 - 2017-04-26 16:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-04-26 16:34 - 2017-03-22 11:02 - 00059904 _____ C:\Windows\system32\Drivers\mbae.sys
2017-04-26 16:26 - 2017-04-26 16:27 - 60107896 _____ (Malwarebytes ) C:\Users\VTB\Downloads\mb3-setup-consumer-3.0.6.1469-10103(1).exe
2017-04-26 15:47 - 2017-04-28 13:01 - 00048734 _____ C:\Windows\ZAM.krnl.trace
2017-04-26 15:47 - 2017-04-28 01:23 - 00000000 ____D C:\Program Files\Zemana AntiMalware
2017-04-26 15:47 - 2017-04-28 01:20 - 00032319 _____ C:\Windows\ZAM_Guard.krnl.trace
2017-04-26 15:46 - 2017-04-26 15:46 - 00000000 ____D C:\Users\VTB\AppData\Local\Zemana
2017-04-26 15:45 - 2017-04-26 15:46 - 05774688 _____ (Zemana Ltd. ) C:\Users\VTB\Downloads\Zemana.AntiMalware.Setup.exe
2017-04-26 13:43 - 2017-04-26 13:43 - 00000000 ____D C:\Users\VTB\AppData\Roaming\Burnaware
2017-04-26 13:42 - 2017-04-26 14:54 - 00000000 ____D C:\Program Files\BurnAware Free
2017-04-26 13:40 - 2017-04-26 13:40 - 06781512 _____ (Burnaware ) C:\Users\VTB\Downloads\burnaware_cfree_10.2.exe
2017-04-26 13:32 - 2013-08-10 16:39 - 01839104 _____ C:\Users\VTB\Desktop\memtest86+-5.01.iso
2017-04-26 10:29 - 2017-04-26 10:29 - 00000000 ____D C:\ProgramData\Emsisoft
2017-04-26 10:23 - 2017-04-26 13:25 - 00000000 ____D C:\EEK
2017-04-26 10:16 - 2017-04-26 10:19 - 295313472 _____ C:\Users\VTB\Downloads\EmsisoftEmergencyKit.exe
2017-04-26 09:42 - 2017-04-26 09:42 - 19607040 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 12829696 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 04305920 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2017-04-26 09:42 - 2017-04-26 09:42 - 02278912 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2017-04-26 09:42 - 2017-04-26 09:42 - 01950720 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 01309696 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 00689152 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 00685568 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2017-04-26 09:42 - 2017-04-26 09:42 - 00664064 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2017-04-26 09:42 - 2017-04-26 09:42 - 00645120 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2017-04-26 09:42 - 2017-04-26 09:42 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 00342728 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2017-04-26 09:42 - 2017-04-26 09:42 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 00208384 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 00151552 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2017-04-26 09:42 - 2017-04-26 09:42 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2017-04-26 09:42 - 2017-04-26 09:42 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2017-04-26 09:42 - 2017-04-26 09:42 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2017-04-26 09:42 - 2017-04-26 09:42 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2017-04-26 09:42 - 2017-04-26 09:42 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2017-04-26 09:42 - 2017-04-26 09:42 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2017-04-26 09:42 - 2017-04-26 09:42 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2017-04-26 09:42 - 2017-04-26 09:42 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2017-04-26 09:42 - 2017-04-26 09:42 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2017-04-26 09:42 - 2017-04-26 09:42 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2017-04-26 09:38 - 2017-04-26 09:38 - 03419136 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2017-04-26 09:38 - 2017-04-26 09:38 - 02284544 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2017-04-26 09:38 - 2017-04-26 09:38 - 01988096 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2017-04-26 09:38 - 2017-04-26 09:38 - 01247744 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2017-04-26 09:38 - 2017-04-26 09:38 - 01230336 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2017-04-26 09:38 - 2017-04-26 09:38 - 01158144 _____ (Microsoft Corporation) C:\Windows\system32\XpsPrint.dll
2017-04-26 09:38 - 2017-04-26 09:38 - 01080832 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2017-04-26 09:38 - 2017-04-26 09:38 - 00906240 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2017-04-26 09:38 - 2017-04-26 09:38 - 00604160 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2017-04-26 09:38 - 2017-04-26 09:38 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2017-04-26 09:38 - 2017-04-26 09:38 - 00364544 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2017-04-26 09:38 - 2017-04-26 09:38 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll
2017-04-26 09:38 - 2017-04-26 09:38 - 00249856 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2017-04-26 09:38 - 2017-04-26 09:38 - 00220160 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2017-04-26 09:38 - 2017-04-26 09:38 - 00207872 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecsExt.dll
2017-04-26 09:38 - 2017-04-26 09:38 - 00187392 _____ (Microsoft Corporation) C:\Windows\system32\UIAnimation.dll
2017-04-26 09:38 - 2017-04-26 09:38 - 00161792 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2017-04-26 09:38 - 2017-04-26 09:38 - 00010752 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2017-04-26 09:38 - 2017-04-26 09:38 - 00009728 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2017-04-26 09:38 - 2017-04-26 09:38 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2017-04-26 09:38 - 2017-04-26 09:38 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2017-04-26 09:38 - 2017-04-26 09:38 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2017-04-26 09:38 - 2017-04-26 09:38 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2017-04-26 09:38 - 2017-04-26 09:38 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2017-04-26 09:38 - 2017-04-26 09:38 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2017-04-26 09:38 - 2017-04-26 09:38 - 00002560 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2017-04-25 19:56 - 2017-01-09 12:09 - 00012947 _____ C:\Users\VTB\Desktop\manual.html
2017-04-25 19:56 - 2017-01-09 10:52 - 00032768 _____ () C:\Users\VTB\Desktop\memtest.exe
2017-04-25 18:14 - 2017-04-25 18:14 - 02762240 _____ C:\Users\VTB\Downloads\ZHPCleaner(1).exe
2017-04-25 17:59 - 2017-04-25 18:00 - 01663672 _____ (Malwarebytes) C:\Users\VTB\Downloads\JRT(2).exe
2017-04-25 16:47 - 2017-04-25 16:48 - 22908888 _____ (Malwarebytes ) C:\Users\VTB\Downloads\mbam-setup-2.2.0.1024.exe
2017-04-25 16:17 - 2017-04-25 16:17 - 04102600 _____ C:\Users\VTB\Downloads\adwcleaner_6.046.exe
2017-04-25 00:36 - 2017-04-25 00:36 - 00151528 _____ C:\Windows\Minidump\042517-19297-01.dmp
2017-04-25 00:26 - 2017-04-25 00:26 - 00151528 _____ C:\Windows\Minidump\042517-20092-01.dmp
2017-04-25 00:23 - 2017-04-25 00:24 - 11007936 _____ (SurfRight B.V.) C:\Users\VTB\Downloads\HitmanProBeta(1).exe
2017-04-25 00:09 - 2017-04-25 00:09 - 00151528 _____ C:\Windows\Minidump\042517-20108-01.dmp
2017-04-25 00:05 - 2017-04-25 00:05 - 11007936 _____ (SurfRight B.V.) C:\Users\VTB\Downloads\HitmanProBeta.exe
2017-04-24 23:40 - 2017-04-24 23:40 - 00151528 _____ C:\Windows\Minidump\042417-20716-01.dmp
2017-04-24 23:38 - 2017-04-26 17:12 - 00047056 _____ C:\Windows\system32\Drivers\hitmanpro37.sys
2017-04-24 13:40 - 2017-04-28 01:23 - 00000000 ____D C:\Users\VTB\AppData\Local\ESET
2017-04-24 13:38 - 2017-04-24 13:38 - 06752896 _____ (ESET spol. s r.o.) C:\Users\VTB\Desktop\esetonlinescanner_enu.exe
2017-04-24 12:44 - 2017-04-26 17:13 - 00000000 ____D C:\Windows\Minidump
2017-04-24 12:44 - 2017-04-24 12:44 - 00151528 _____ C:\Windows\Minidump\042417-19312-01.dmp
2017-04-24 12:37 - 2017-04-24 12:40 - 11007424 _____ (SurfRight B.V.) C:\Users\VTB\Downloads\HitmanPro36(4).exe
2017-04-24 11:26 - 2017-04-28 01:00 - 00000000 ____D C:\Users\VTB\Desktop\FRST-OlderVersion
2017-04-23 11:31 - 2017-04-23 11:31 - 00000908 _____ C:\Users\VTB\Desktop\run.vbs
2017-04-23 11:19 - 2017-04-23 11:20 - 00615360 _____ C:\Windows\system32\perfh002.dat
2017-04-23 11:19 - 2017-04-23 11:20 - 00103702 _____ C:\Windows\system32\perfc002.dat
2017-04-22 23:59 - 2017-04-22 23:59 - 00000000 ____D C:\Users\VTB\Downloads\FRST-OlderVersion
2017-04-22 02:16 - 2017-04-22 02:16 - 00000000 ____D C:\Users\VTB\Desktop\Стари данни Firefox
2017-04-22 01:49 - 2017-04-22 01:49 - 00000000 ____D C:\Windows\tracing
2017-04-21 22:49 - 2017-04-28 00:28 - 00000000 ____D C:\Users\VTB\AppData\Roaming\ZHP
2017-04-21 22:49 - 2017-04-21 22:49 - 00000000 ____D C:\Users\VTB\AppData\Local\ZHP
2017-04-21 22:47 - 2017-04-21 22:47 - 02761728 _____ C:\Users\VTB\Downloads\ZHPCleaner.exe
2017-04-21 22:16 - 2017-04-21 22:16 - 01663672 _____ (Malwarebytes) C:\Users\VTB\Downloads\JRT(1).exe
2017-04-21 22:00 - 2017-04-22 02:29 - 00023927 _____ C:\Users\VTB\Downloads\Addition.txt
2017-04-21 21:57 - 2017-04-22 02:29 - 00071434 _____ C:\Users\VTB\Downloads\FRST.txt
2017-04-21 21:55 - 2017-04-28 13:01 - 00000000 ____D C:\FRST
2017-04-21 21:06 - 2017-04-21 21:06 - 01663672 _____ (Malwarebytes) C:\Users\VTB\Downloads\JRT.exe
2017-04-21 20:31 - 2017-04-26 18:02 - 00000000 ____D C:\AdwCleaner
2017-04-21 20:29 - 2017-04-21 20:30 - 04089296 _____ C:\Users\VTB\Downloads\adwcleaner_6.045.exe
2017-04-21 18:47 - 2016-07-22 17:51 - 00123904 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2017-04-21 18:47 - 2016-02-03 20:59 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS
2017-04-21 18:47 - 2015-01-09 05:48 - 00635904 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll
2017-04-21 18:47 - 2015-01-09 05:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll
2017-04-21 18:47 - 2015-01-09 05:48 - 00027136 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll
2017-04-21 18:47 - 2013-07-03 06:36 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2017-04-21 18:47 - 2013-07-03 06:36 - 00025728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2017-04-21 18:46 - 2016-05-11 18:19 - 00363520 _____ (Microsoft Corporation) C:\Windows\system32\StructuredQuery.dll
2017-04-21 18:46 - 2015-01-29 06:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2017-04-21 18:46 - 2013-10-04 04:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2017-04-21 18:46 - 2013-10-04 04:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2017-04-21 18:46 - 2012-07-04 22:45 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\RNDISMP.sys
2017-04-21 18:44 - 2015-07-10 20:34 - 03221504 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2017-04-21 18:44 - 2015-07-10 20:34 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2017-04-21 18:44 - 2015-07-10 20:33 - 00131584 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2017-04-21 18:44 - 2013-02-12 06:32 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usb8023.sys
2017-04-21 18:41 - 2016-02-09 12:50 - 00021504 _____ (Microsoft Corporation) C:\Windows\system32\seclogon.dll
2017-04-21 18:41 - 2016-02-02 21:48 - 00376320 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2017-04-21 18:41 - 2015-11-11 21:39 - 01242624 _____ (Microsoft Corporation) C:\Windows\system32\comsvcs.dll
2017-04-21 18:41 - 2015-11-11 21:39 - 00487936 _____ (Microsoft Corporation) C:\Windows\system32\catsrvut.dll
2017-04-21 18:41 - 2015-08-27 20:58 - 01391104 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2017-04-21 18:40 - 2015-08-27 20:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2017-04-21 18:30 - 2016-03-16 21:28 - 00176128 _____ (Microsoft Corporation) C:\Windows\system32\msorcl32.dll
2017-04-21 18:30 - 2016-03-16 21:28 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\mtxoci.dll
2017-04-21 18:30 - 2015-07-09 20:42 - 00179712 _____ (Microsoft Corporation) C:\Windows\system32\notepad.exe
2017-04-21 18:30 - 2015-07-09 20:42 - 00179712 _____ (Microsoft Corporation) C:\Windows\notepad.exe
2017-04-21 18:30 - 2013-10-30 05:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2017-04-21 18:30 - 2013-01-24 07:47 - 00196328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fvevol.sys
2017-04-21 18:30 - 2012-11-02 08:11 - 00376832 _____ (Microsoft Corporation) C:\Windows\system32\dpnet.dll
2017-04-21 18:30 - 2011-06-16 07:33 - 00180224 _____ (Microsoft Corporation) C:\Windows\system32\xmllite.dll
2017-04-21 18:29 - 2016-03-18 01:30 - 00171008 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2017-04-21 18:29 - 2016-03-18 01:28 - 01414144 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2017-04-21 18:29 - 2016-03-18 01:26 - 00872448 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2017-04-21 18:29 - 2016-03-18 01:26 - 00294400 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 01:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 00:36 - 00271360 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2017-04-21 18:29 - 2016-03-18 00:29 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 00:29 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 00:29 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-04-21 18:29 - 2016-03-18 00:29 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-04-21 18:29 - 2016-03-09 21:40 - 00316416 _____ (Microsoft Corporation) C:\Windows\system32\webio.dll
2017-04-21 18:29 - 2016-02-04 21:41 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\mfds.dll
2017-04-21 18:28 - 2015-08-05 20:41 - 00751104 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2017-04-21 18:28 - 2014-11-11 05:44 - 00186880 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll
2017-04-21 18:27 - 2016-06-25 22:53 - 00779776 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2017-04-21 18:27 - 2016-06-25 22:53 - 00297472 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.dll
2017-04-21 18:27 - 2016-06-25 22:53 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\inetpp.dll
2017-04-21 18:27 - 2016-06-25 22:42 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\wpnpinst.exe
2017-04-21 18:27 - 2016-06-25 22:41 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.exe
2017-04-21 18:27 - 2016-06-25 22:41 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\inetppui.dll
2017-04-21 18:07 - 2015-10-13 19:31 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2017-04-21 18:07 - 2015-10-13 19:31 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2017-04-21 18:07 - 2012-08-21 23:12 - 00245760 _____ (Microsoft Corporation) C:\Windows\system32\OxpsConverter.exe
2017-04-21 18:06 - 2016-02-12 21:39 - 02956288 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2017-04-21 18:06 - 2016-02-12 21:39 - 00174080 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2017-04-21 18:06 - 2016-02-12 21:26 - 00073728 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2017-04-21 18:06 - 2016-02-12 21:07 - 02062848 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2017-04-21 18:06 - 2016-02-12 21:06 - 00573440 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2017-04-21 18:06 - 2016-02-12 21:05 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2017-04-21 18:06 - 2016-02-12 21:05 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2017-04-21 18:06 - 2016-02-12 21:05 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2017-04-21 18:06 - 2016-02-12 21:05 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2017-04-21 18:06 - 2016-02-12 21:05 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2017-04-21 18:06 - 2016-02-12 21:05 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2017-04-21 18:06 - 2013-10-19 04:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2017-04-21 18:04 - 2014-03-04 12:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2017-04-21 18:04 - 2014-03-04 12:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2017-04-21 18:04 - 2014-03-04 12:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2017-04-21 18:04 - 2014-03-04 12:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2017-04-21 18:04 - 2014-03-04 12:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2017-04-21 18:04 - 2014-03-04 12:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2017-04-21 18:04 - 2014-03-04 12:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2017-04-21 17:56 - 2013-10-12 05:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2017-04-21 17:56 - 2013-10-12 05:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2017-04-21 17:56 - 2013-10-12 04:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2017-04-21 17:56 - 2013-10-12 04:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2017-04-21 17:55 - 2015-06-11 20:57 - 00919552 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2017-04-21 17:55 - 2015-06-11 20:15 - 00134656 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2017-04-21 17:55 - 2015-06-11 20:15 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2017-04-21 17:54 - 2016-05-12 18:18 - 00606720 _____ (Microsoft Corporation) C:\Windows\system32\gpsvc.dll
2017-04-21 17:54 - 2016-05-12 18:18 - 00591872 _____ (Microsoft Corporation) C:\Windows\system32\gpprefcl.dll
2017-04-21 17:54 - 2016-05-12 18:18 - 00351744 _____ (Microsoft Corporation) C:\Windows\system32\IPSECSVC.DLL
2017-04-21 17:54 - 2016-05-12 18:18 - 00274944 _____ (Microsoft Corporation) C:\Windows\system32\polstore.dll
2017-04-21 17:54 - 2016-05-12 18:18 - 00079360 _____ (Microsoft Corporation) C:\Windows\system32\gpapi.dll
2017-04-21 17:54 - 2016-05-12 18:18 - 00070144 _____ (Microsoft Corporation) C:\Windows\system32\winipsec.dll
2017-04-21 17:54 - 2016-05-12 18:18 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\FwRemoteSvr.dll
2017-04-21 17:54 - 2016-05-12 17:57 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\gpscript.dll
2017-04-21 17:54 - 2016-05-12 17:57 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\gpscript.exe
2017-04-21 17:54 - 2015-10-29 20:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2017-04-21 17:54 - 2015-10-29 20:49 - 00295936 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2017-04-21 17:54 - 2015-10-29 20:49 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2017-04-21 17:54 - 2015-10-29 20:49 - 00020992 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2017-04-21 17:52 - 2011-08-27 07:26 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\oleacc.dll
2017-04-21 17:47 - 2015-07-15 20:55 - 01159168 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll
2017-04-21 17:34 - 2016-03-09 21:34 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2017-04-21 17:33 - 2011-08-17 07:24 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\psisdecd.dll
2017-04-21 17:33 - 2011-08-17 07:19 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\psisrndr.ax
2017-04-21 17:32 - 2011-12-30 08:27 - 00478720 _____ (Microsoft Corporation) C:\Windows\system32\timedate.cpl
2017-04-21 17:31 - 2011-05-24 13:44 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\umpnpmgr.dll
2017-04-21 17:26 - 2015-10-13 07:50 - 00712640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2017-04-21 17:25 - 2013-05-10 06:20 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll
2017-04-21 17:19 - 2015-03-04 07:10 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
2017-04-21 17:19 - 2014-09-04 08:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2017-04-21 17:19 - 2014-01-28 05:07 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2017-04-21 17:19 - 2013-03-19 06:33 - 00040960 _____ (Microsoft Corporation) C:\Windows\system32\wwanprotdim.dll
2017-04-21 17:18 - 2013-05-13 06:08 - 00903168 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe
2017-04-21 17:18 - 2013-05-13 06:08 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll
2017-04-21 17:17 - 2015-11-03 21:55 - 00179712 _____ (Microsoft Corporation) C:\Windows\system32\els.dll
2017-04-21 16:47 - 2016-08-29 18:12 - 12880384 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2017-04-21 16:47 - 2016-08-29 18:12 - 01499648 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2017-04-21 16:47 - 2016-08-29 17:55 - 02972672 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2017-04-21 16:47 - 2015-04-11 06:07 - 00054656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\stream.sys
2017-04-21 16:47 - 2014-02-04 05:07 - 00234432 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2017-04-21 16:47 - 2014-02-04 05:07 - 00149440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2017-04-21 16:47 - 2014-02-04 05:07 - 00027072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2017-04-21 16:47 - 2014-02-04 05:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2017-04-21 16:41 - 2017-04-21 16:41 - 00000000 ____D C:\Program Files\Malwarebytes
2017-04-21 16:38 - 2017-04-21 16:39 - 60107896 _____ (Malwarebytes ) C:\Users\VTB\Downloads\mb3-setup-consumer-3.0.6.1469-10103.exe
2017-04-21 16:07 - 2016-03-16 02:53 - 00566272 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll
2017-04-21 16:06 - 2016-03-16 02:53 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\samlib.dll
2017-04-21 16:06 - 2012-10-03 19:42 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\netcorehc.dll
2017-04-21 16:06 - 2012-10-03 19:42 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\netevent.dll
2017-04-21 16:06 - 2012-10-03 19:40 - 00499712 _____ (Microsoft Corporation) C:\Windows\system32\iphlpsvc.dll
2017-04-21 16:06 - 2012-10-03 18:21 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpipreg.sys
2017-04-21 16:06 - 2011-05-04 07:34 - 01549312 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll
2017-04-21 16:06 - 2011-05-04 07:32 - 01401344 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll
2017-04-21 16:06 - 2011-05-04 07:32 - 00666624 _____ (Microsoft Corporation) C:\Windows\system32\mssvp.dll
2017-04-21 16:06 - 2011-05-04 07:32 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\mssph.dll
2017-04-21 16:06 - 2011-05-04 07:32 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\mssphtb.dll
2017-04-21 16:06 - 2011-05-04 07:32 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\msscntrs.dll
2017-04-21 16:06 - 2011-05-04 07:28 - 00427520 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe
2017-04-21 16:06 - 2011-05-04 07:28 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\SearchProtocolHost.exe
2017-04-21 16:06 - 2011-05-04 07:28 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\SearchFilterHost.exe
2017-04-21 16:05 - 2015-07-22 20:53 - 00635392 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2017-04-21 16:04 - 2014-06-18 04:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2017-04-21 16:01 - 2016-01-21 03:51 - 00057280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\disk.sys
2017-04-21 16:01 - 2015-07-09 20:42 - 01372160 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2017-04-21 16:01 - 2015-07-09 20:42 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll
2017-04-21 16:01 - 2013-04-26 02:30 - 01505280 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2017-04-21 16:00 - 2016-01-22 09:04 - 00642048 _____ (Microsoft Corporation) C:\Windows\system32\CPFilters.dll
2017-04-21 16:00 - 2016-01-22 09:04 - 00535040 _____ (Microsoft Corporation) C:\Windows\system32\EncDec.dll
2017-04-21 12:26 - 2012-07-26 06:21 - 00196608 _____ (Microsoft Corporation) C:\Windows\system32\WUDFHost.exe
2017-04-21 12:26 - 2012-07-26 06:20 - 00613888 _____ (Microsoft Corporation) C:\Windows\system32\WUDFx.dll
2017-04-21 12:26 - 2012-07-26 06:20 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\WUDFPlatform.dll
2017-04-21 12:26 - 2012-07-26 06:20 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\WUDFSvc.dll
2017-04-21 12:26 - 2012-07-26 06:20 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\WUDFCoinstaller.dll
2017-04-21 12:26 - 2012-07-26 05:33 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFPf.sys
2017-04-21 12:26 - 2012-07-26 05:32 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFRd.sys
2017-04-21 12:26 - 2012-06-02 17:57 - 00000003 _____ C:\Windows\system32\Drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
2017-04-21 12:25 - 2012-03-01 08:46 - 00019824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fs_rec.sys
2017-04-21 12:25 - 2012-03-01 08:29 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\wmi.dll
2017-04-21 12:11 - 2016-08-12 19:21 - 00313856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2017-04-21 12:11 - 2016-08-12 19:21 - 00310784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2017-04-21 12:11 - 2016-08-12 19:21 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2017-04-21 12:10 - 2015-12-09 00:53 - 00509952 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2017-04-21 12:10 - 2015-04-18 05:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2017-04-21 12:10 - 2015-04-13 06:19 - 00259072 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2017-04-21 12:10 - 2014-10-25 04:32 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2017-04-21 12:10 - 2014-08-01 14:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2017-04-21 12:10 - 2012-12-07 15:26 - 00308736 _____ (Microsoft Corporation) C:\Windows\system32\Wpc.dll
2017-04-21 12:10 - 2012-12-07 15:20 - 02576384 _____ (Microsoft Corporation) C:\Windows\system32\gameux.dll
2017-04-21 12:10 - 2012-12-07 13:46 - 00055296 _____ (Microsoft) C:\Windows\system32\cero.rs
2017-04-21 12:10 - 2012-12-07 13:46 - 00051712 _____ (Microsoft) C:\Windows\system32\esrb.rs
2017-04-21 12:10 - 2012-12-07 13:46 - 00046592 _____ (Microsoft) C:\Windows\system32\fpb.rs
2017-04-21 12:10 - 2012-12-07 13:46 - 00045568 _____ (Microsoft) C:\Windows\system32\oflc-nz.rs
2017-04-21 12:10 - 2012-12-07 13:46 - 00044544 _____ (Microsoft) C:\Windows\system32\pegibbfc.rs
2017-04-21 12:10 - 2012-12-07 13:46 - 00043520 _____ (Microsoft) C:\Windows\system32\csrr.rs
2017-04-21 12:10 - 2012-12-07 13:46 - 00040960 _____ (Microsoft) C:\Windows\system32\cob-au.rs
2017-04-21 12:10 - 2012-12-07 13:46 - 00030720 _____ (Microsoft) C:\Windows\system32\usk.rs
2017-04-21 12:10 - 2012-12-07 13:46 - 00023552 _____ (Microsoft) C:\Windows\system32\oflc.rs
2017-04-21 12:10 - 2012-12-07 13:46 - 00021504 _____ (Microsoft) C:\Windows\system32\grb.rs
2017-04-21 12:10 - 2012-12-07 13:46 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi-pt.rs
2017-04-21 12:10 - 2012-12-07 13:46 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi-fi.rs
2017-04-21 12:10 - 2012-12-07 13:46 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi.rs
2017-04-21 12:10 - 2012-12-07 13:46 - 00015360 _____ (Microsoft) C:\Windows\system32\djctq.rs
2017-04-21 12:09 - 2014-04-05 05:25 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2017-04-21 12:09 - 2014-04-05 05:24 - 00187840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2017-04-21 12:09 - 2013-11-26 14:11 - 00240576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2017-04-21 12:09 - 2013-07-26 04:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2017-04-21 12:09 - 2012-10-09 20:40 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcore6.dll
2017-04-21 12:09 - 2012-10-09 20:40 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcsvc6.dll
2017-04-21 12:08 - 2017-01-05 20:46 - 00137960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2017-04-21 12:08 - 2017-01-05 20:46 - 00067304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2017-04-21 12:08 - 2017-01-05 20:43 - 01062912 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2017-04-21 12:08 - 2017-01-05 20:43 - 00655360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2017-04-21 12:08 - 2017-01-05 20:43 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2017-04-21 12:08 - 2017-01-05 20:43 - 00261120 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2017-04-21 12:08 - 2017-01-05 20:43 - 00254464 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2017-04-21 12:08 - 2017-01-05 20:43 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2017-04-21 12:08 - 2017-01-05 20:43 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2017-04-21 12:08 - 2017-01-05 20:43 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2017-04-21 12:08 - 2017-01-05 20:43 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2017-04-21 12:08 - 2017-01-05 20:43 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2017-04-21 12:08 - 2017-01-05 20:43 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2017-04-21 12:08 - 2017-01-05 20:43 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2017-04-21 12:08 - 2017-01-05 20:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2017-04-21 12:08 - 2017-01-05 20:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2017-04-21 12:08 - 2017-01-05 20:43 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2017-04-21 12:08 - 2017-01-05 20:42 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2017-04-21 12:08 - 2017-01-05 20:23 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2017-04-21 12:08 - 2017-01-05 20:19 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2017-04-21 12:08 - 2017-01-05 20:19 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2017-04-21 12:08 - 2017-01-05 20:19 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2017-04-21 12:08 - 2017-01-05 20:19 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2017-04-21 12:08 - 2017-01-05 20:19 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2017-04-21 12:08 - 2017-01-05 20:19 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2017-04-21 12:08 - 2016-11-20 19:19 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\hlink.dll
2017-04-21 12:08 - 2016-11-20 17:07 - 00373896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2017-04-21 12:08 - 2016-11-17 19:27 - 00250600 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2017-04-21 12:08 - 2016-11-10 19:19 - 00811520 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2017-04-21 12:08 - 2016-11-09 19:24 - 00105192 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2017-04-21 12:08 - 2016-11-09 19:17 - 02365440 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2017-04-21 12:08 - 2016-11-09 19:17 - 01806848 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2017-04-21 12:08 - 2016-11-09 19:17 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2017-04-21 12:08 - 2016-11-09 19:17 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2017-04-21 12:08 - 2016-11-09 19:17 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2017-04-21 12:08 - 2016-11-09 19:17 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2017-04-21 12:08 - 2016-11-09 18:55 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2017-04-21 12:08 - 2016-11-06 19:16 - 00306688 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2017-04-21 12:08 - 2016-11-06 18:55 - 02399744 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2017-04-21 12:08 - 2016-11-02 18:22 - 00308456 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2017-04-21 12:08 - 2016-11-02 18:16 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2017-04-21 12:08 - 2016-11-02 18:16 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2017-04-21 12:08 - 2016-11-02 18:16 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2017-04-21 12:08 - 2016-11-02 17:53 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2017-04-21 12:08 - 2016-10-27 18:20 - 00627712 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2017-04-21 12:08 - 2016-10-15 18:13 - 00741888 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2017-04-21 12:08 - 2016-10-15 18:13 - 00084480 _____ (Microsoft Corporation) C:\Windows\system32\INETRES.dll
2017-04-21 12:08 - 2016-10-11 18:24 - 04000488 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2017-04-21 12:08 - 2016-10-11 18:24 - 03944680 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2017-04-21 12:08 - 2016-10-11 18:21 - 01310528 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2017-04-21 12:08 - 2016-10-11 18:18 - 01027584 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10.IME
2017-04-21 12:08 - 2016-10-11 18:18 - 00829952 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2017-04-21 12:08 - 2016-10-11 18:18 - 00701440 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL
2017-04-21 12:08 - 2016-10-11 18:18 - 00644096 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2017-04-21 12:08 - 2016-10-11 18:18 - 00430080 _____ (Microsoft Corporation) C:\Windows\system32\imkr80.ime
2017-04-21 12:08 - 2016-10-11 18:18 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2017-04-21 12:08 - 2016-10-11 18:18 - 00202240 _____ (Microsoft Corporation) C:\Windows\system32\input.dll
2017-04-21 12:08 - 2016-10-11 18:18 - 00126976 _____ (Microsoft Corporation) C:\Windows\system32\tintlgnt.ime
2017-04-21 12:08 - 2016-10-11 18:18 - 00125952 _____ (Microsoft Corporation) C:\Windows\system32\quick.ime
2017-04-21 12:08 - 2016-10-11 18:18 - 00125952 _____ (Microsoft Corporation) C:\Windows\system32\qintlgnt.ime
2017-04-21 12:08 - 2016-10-11 18:18 - 00125952 _____ (Microsoft Corporation) C:\Windows\system32\phon.ime
2017-04-21 12:08 - 2016-10-11 18:18 - 00125952 _____ (Microsoft Corporation) C:\Windows\system32\cintlgnt.ime
2017-04-21 12:08 - 2016-10-11 18:18 - 00125952 _____ (Microsoft Corporation) C:\Windows\system32\chajei.ime
2017-04-21 12:08 - 2016-10-11 18:18 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\pintlgnt.ime
2017-04-21 12:08 - 2016-10-11 18:18 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\nlsbres.dll
2017-04-21 12:08 - 2016-10-11 18:18 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2017-04-21 12:08 - 2016-10-11 18:18 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2017-04-21 12:08 - 2016-10-11 18:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2017-04-21 12:08 - 2016-10-11 18:18 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2017-04-21 12:08 - 2016-10-11 18:18 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2017-04-21 12:08 - 2016-10-11 17:55 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2017-04-21 12:08 - 2016-10-11 17:55 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2017-04-21 12:08 - 2016-10-11 17:55 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2017-04-21 12:08 - 2016-10-11 17:55 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2017-04-21 12:08 - 2016-10-11 17:53 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2017-04-21 12:08 - 2016-10-11 17:51 - 00295936 _____ (Microsoft Corporation) C:\Windows\system32\bcdedit.exe
2017-04-21 12:08 - 2016-10-11 17:50 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2017-04-21 12:08 - 2016-10-11 16:18 - 00419648 _____ C:\Windows\system32\locale.nls
2017-04-21 12:08 - 2016-10-08 16:05 - 00534600 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2017-04-21 12:08 - 2016-10-07 18:12 - 02291712 _____ (Microsoft Corporation) C:\Windows\system32\MSVidCtl.dll
2017-04-21 12:08 - 2016-10-07 18:12 - 00581632 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2017-04-21 12:08 - 2016-10-07 18:12 - 00090624 _____ (Microsoft Corporation) C:\Windows\system32\olepro32.dll
2017-04-21 12:08 - 2016-10-07 18:12 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\asycfilt.dll
2017-04-21 12:08 - 2016-10-05 17:50 - 00068608 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bowser.sys
2017-04-21 12:08 - 2016-10-04 18:13 - 01176064 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2017-04-21 12:08 - 2016-10-04 18:13 - 00179200 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2017-04-21 12:08 - 2016-10-04 18:13 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2017-04-21 12:08 - 2016-10-04 18:13 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2017-04-21 12:08 - 2016-09-15 17:51 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2017-04-21 12:08 - 2016-09-12 23:49 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\adsmsext.dll
2017-04-21 12:08 - 2016-09-09 21:00 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2017-04-21 12:08 - 2016-09-08 23:34 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2017-04-21 12:08 - 2016-09-08 23:34 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2017-04-21 12:08 - 2016-09-08 17:49 - 00117248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2017-04-21 12:08 - 2016-09-08 17:49 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dfsc.sys
2017-04-21 12:08 - 2016-08-21 16:05 - 00935424 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2017-04-21 12:08 - 2016-08-12 19:47 - 12574208 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2017-04-21 12:08 - 2016-08-12 19:47 - 11410432 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2017-04-21 12:08 - 2016-08-12 19:31 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2017-04-21 12:08 - 2016-08-12 19:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2017-04-21 12:08 - 2016-08-12 19:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2017-04-21 12:08 - 2016-08-12 19:21 - 00437248 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2017-04-21 12:08 - 2016-08-06 18:15 - 01178112 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2017-04-21 12:08 - 2016-08-06 18:15 - 00249344 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2017-04-21 12:08 - 2016-08-06 18:15 - 00214016 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2017-04-21 12:08 - 2016-08-06 18:15 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2017-04-21 12:08 - 2016-08-06 18:15 - 00054272 _____ (Microsoft Corporation) C:\Windows\system32\WsmRes.dll
2017-04-21 12:08 - 2016-08-06 17:53 - 00199168 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
2017-04-21 12:08 - 2016-08-06 17:53 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wsmprovhost.exe
2017-04-21 12:08 - 2016-08-06 17:53 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\wsmplpxy.dll
2017-04-21 12:08 - 2016-06-14 18:25 - 00078568 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2017-04-21 12:08 - 2016-06-14 18:21 - 03209216 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 01329664 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 01005056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00988160 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00744960 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00617984 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00474624 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00442368 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00406016 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00374784 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00354816 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00265216 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00195072 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00157184 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00103424 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
2017-04-21 12:08 - 2016-06-14 18:21 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2017-04-21 12:08 - 2016-06-14 18:17 - 00593920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2017-04-21 12:08 - 2016-06-14 18:05 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2017-04-21 12:08 - 2016-06-14 18:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2017-04-21 12:08 - 2016-06-14 18:05 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2017-04-21 12:08 - 2016-06-14 18:00 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2017-04-21 12:08 - 2016-06-14 17:55 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
2017-04-21 12:08 - 2016-06-14 17:55 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
2017-04-21 12:08 - 2016-06-14 17:54 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
2017-04-21 12:08 - 2016-05-12 16:04 - 00249352 _____ (Microsoft Corporation) C:\Windows\system32\bcryptprimitives.dll
2017-04-21 12:08 - 2016-03-24 01:42 - 00409272 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2017-04-21 12:08 - 2016-03-24 01:39 - 00470704 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2017-04-21 12:06 - 2016-03-06 21:38 - 01240576 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2017-04-21 12:06 - 2016-03-06 21:38 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2017-04-21 12:06 - 2015-11-05 22:02 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\wshrm.dll
2017-04-21 12:06 - 2015-11-05 12:48 - 00117760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rmcast.sys
2017-04-21 12:06 - 2014-12-19 05:43 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2017-04-21 12:06 - 2014-12-11 20:47 - 00046592 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2017-04-21 12:06 - 2014-10-30 04:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2017-04-21 12:06 - 2012-09-26 01:47 - 00078336 _____ (Microsoft Corporation) C:\Windows\system32\synceng.dll
2017-04-21 12:06 - 2012-03-17 10:27 - 00056176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\partmgr.sys
2017-04-21 12:06 - 2011-12-16 10:52 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\msvcrt.dll
2017-04-21 12:06 - 2011-06-15 11:55 - 00319488 _____ (Microsoft Corporation) C:\Windows\system32\odbcjt32.dll
2017-04-21 12:06 - 2011-06-15 11:55 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\odbctrac.dll
2017-04-21 12:06 - 2011-06-15 11:55 - 00122880 _____ (Microsoft Corporation) C:\Windows\system32\odbccp32.dll
2017-04-21 12:06 - 2011-06-15 11:55 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\odbccu32.dll
2017-04-21 12:06 - 2011-06-15 11:55 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\odbccr32.dll
2017-04-21 12:05 - 2015-11-14 01:50 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\mapistub.dll
2017-04-21 12:05 - 2015-11-14 01:50 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\mapi32.dll
2017-04-21 12:05 - 2015-11-14 01:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\fixmapi.exe
2017-04-21 12:05 - 2015-02-03 06:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2017-04-21 12:05 - 2013-10-12 05:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2017-04-21 12:05 - 2013-10-12 05:01 - 00679424 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2017-04-21 12:05 - 2013-10-12 05:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2017-04-21 12:05 - 2013-08-05 04:56 - 00133056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2017-04-21 12:04 - 2016-02-05 21:44 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\fveapibase.dll
2017-04-21 12:04 - 2016-02-05 20:33 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\tbs.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00922432 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00066400 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00022368 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00019808 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00016224 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00015712 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00013664 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2017-04-21 12:04 - 2015-11-19 17:06 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
2017-04-21 12:04 - 2015-06-03 23:22 - 00355456 _____ (Microsoft Corporation) C:\Windows\system32\fveapi.dll
2017-04-21 12:04 - 2014-07-17 04:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2017-04-21 12:04 - 2014-07-17 04:39 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2017-04-21 12:04 - 2014-07-17 04:39 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2017-04-21 12:04 - 2014-07-17 04:39 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2017-04-21 12:04 - 2014-07-17 04:03 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2017-04-21 12:04 - 2014-07-17 04:02 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2017-04-21 12:04 - 2012-04-26 07:45 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\rdpwsx.dll
2017-04-21 12:04 - 2012-04-26 07:41 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\rdrmemptylst.exe
2017-04-21 12:03 - 2016-05-11 18:19 - 00351744 _____ (Microsoft Corporation) C:\Windows\system32\winhttp.dll
2017-04-21 12:03 - 2016-05-11 18:19 - 00231424 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2017-04-21 12:03 - 2016-05-11 18:19 - 00206336 _____ (Microsoft Corporation) C:\Windows\system32\ws2_32.dll
2017-04-21 12:03 - 2016-05-11 18:01 - 00026624 _____ (Microsoft Corporation) C:\Windows\system32\netbtugc.exe
2017-04-21 12:03 - 2016-05-11 17:52 - 00188928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbt.sys
2017-04-21 12:03 - 2015-07-15 05:55 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\basesrv.dll
2017-04-21 12:03 - 2012-01-04 11:58 - 00442880 _____ (Microsoft Corporation) C:\Windows\system32\ntshrui.dll
2017-04-21 12:02 - 2012-11-23 05:48 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\taskhost.exe
2017-04-21 12:01 - 2015-06-02 02:47 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\cewmdm.dll
2017-04-21 12:01 - 2015-02-25 06:03 - 00514560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2017-04-21 12:01 - 2014-12-06 06:50 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2017-04-21 12:01 - 2014-01-29 05:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2017-04-21 12:01 - 2012-10-03 19:42 - 00156672 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll
2017-04-21 12:01 - 2012-10-03 19:42 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll
2017-04-21 12:00 - 2016-04-09 09:59 - 00730344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2017-04-21 12:00 - 2016-04-09 09:59 - 00218856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2017-04-21 12:00 - 2016-04-09 09:54 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2017-04-21 12:00 - 2015-12-09 00:54 - 01620992 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2017-04-21 12:00 - 2015-12-09 00:54 - 01568768 _____ (Microsoft Corporation) C:\Windows\system32\WMVENCOD.DLL
2017-04-21 12:00 - 2015-12-09 00:54 - 00902144 _____ (Microsoft Corporation) C:\Windows\system32\WMADMOD.DLL
2017-04-21 12:00 - 2015-12-09 00:54 - 00815616 _____ (Microsoft Corporation) C:\Windows\system32\WMADMOE.DLL
2017-04-21 12:00 - 2015-12-09 00:54 - 00740352 _____ (Microsoft Corporation) C:\Windows\system32\wmpmde.dll
2017-04-21 12:00 - 2015-12-09 00:54 - 00739328 _____ (Microsoft Corporation) C:\Windows\system32\WMSPDMOD.DLL
2017-04-21 12:00 - 2015-12-09 00:54 - 00665088 _____ (Microsoft Corporation) C:\Windows\system32\WMVXENCD.DLL
2017-04-21 12:00 - 2015-12-09 00:54 - 00541184 _____ (Microsoft Corporation) C:\Windows\system32\WMVSDECD.DLL
2017-04-21 12:00 - 2015-12-09 00:53 - 00970240 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2adec.dll
2017-04-21 12:00 - 2015-12-09 00:53 - 00829952 _____ (Microsoft Corporation) C:\Windows\system32\MSMPEG2ENC.DLL
2017-04-21 12:00 - 2015-12-09 00:53 - 00728576 _____ (Microsoft Corporation) C:\Windows\system32\mcmde.dll
2017-04-21 12:00 - 2015-12-09 00:53 - 00153600 _____ (Microsoft Corporation) C:\Windows\system32\COLORCNV.DLL
2017-04-21 11:59 - 2015-12-09 00:54 - 01325056 _____ (Microsoft Corporation) C:\Windows\system32\WMSPDMOE.DLL
2017-04-21 11:59 - 2015-12-09 00:54 - 00358400 _____ (Microsoft Corporation) C:\Windows\system32\WMVSENCD.DLL
2017-04-21 11:59 - 2015-12-09 00:54 - 00154112 _____ (Microsoft Corporation) C:\Windows\system32\VIDRESZR.DLL
2017-04-21 11:59 - 2015-12-09 00:53 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\MFWMAAEC.DLL
2017-04-21 11:59 - 2015-12-09 00:53 - 00415744 _____ (Microsoft Corporation) C:\Windows\system32\MP4SDECD.DLL
2017-04-21 11:59 - 2015-12-09 00:53 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\MPG4DECD.DLL
2017-04-21 11:59 - 2015-12-09 00:53 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\MP43DECD.DLL
2017-04-21 11:59 - 2015-12-09 00:53 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\RESAMPLEDMO.DLL
2017-04-21 11:59 - 2015-12-09 00:53 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\qasf.dll
2017-04-21 11:59 - 2015-12-09 00:53 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\ksproxy.ax
2017-04-21 11:59 - 2015-12-09 00:53 - 00079872 _____ (Microsoft Corporation) C:\Windows\system32\MP3DMOD.DLL
2017-04-21 11:59 - 2015-12-09 00:53 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\devenum.dll
2017-04-21 11:59 - 2015-12-09 00:53 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\mfvdsp.dll
2017-04-21 11:59 - 2015-12-09 00:53 - 00004608 _____ (Microsoft Corporation) C:\Windows\system32\ksuser.dll
2017-04-21 11:59 - 2013-06-26 01:56 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2017-04-21 11:59 - 2012-11-29 01:57 - 00047720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfLdr.sys
2017-04-21 11:59 - 2012-11-29 01:57 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\Wdfres.dll
2017-04-21 11:59 - 2012-11-29 01:57 - 00000003 _____ C:\Windows\system32\Drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
2017-04-21 11:58 - 2014-12-08 05:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2017-04-21 11:58 - 2013-12-04 05:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2017-04-21 11:58 - 2013-12-04 05:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2017-04-21 11:58 - 2013-12-04 05:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2017-04-21 11:58 - 2013-12-04 05:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2017-04-21 11:58 - 2013-12-04 05:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2017-04-21 11:58 - 2013-12-04 04:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2017-04-21 11:58 - 2013-12-04 04:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2017-04-21 11:58 - 2013-12-04 04:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2017-04-21 11:58 - 2013-12-04 04:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2017-04-21 11:57 - 2015-04-24 20:56 - 00530432 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2017-04-21 11:57 - 2014-10-14 04:50 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2017-04-21 03:45 - 2016-01-11 21:54 - 01212352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2017-04-19 23:24 - 2017-04-27 14:53 - 00000000 ____D C:\Users\VTB\AppData\LocalLow\uTorrent
2017-04-18 02:10 - 2017-04-18 02:11 - 00519680 _____ (Auslogics) C:\Users\VTB\Downloads\boost_speed_stub_installer(1).exe
2017-04-18 01:58 - 2017-04-18 01:58 - 00519680 _____ (Auslogics) C:\Users\VTB\Downloads\boost_speed_stub_installer.exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-04-28 10:33 - 2009-07-14 07:34 - 00021072 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-04-28 10:33 - 2009-07-14 07:34 - 00021072 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-04-28 10:19 - 2016-11-18 13:07 - 00000000 ____D C:\Users\VTB\AppData\LocalLow\Mozilla
2017-04-28 10:09 - 2009-07-14 07:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-04-28 00:02 - 2013-09-23 09:07 - 00000000 ____D C:\Users\VTB
2017-04-27 14:58 - 2013-09-23 19:27 - 00000000 ____D C:\Users\VTB\AppData\Roaming\uTorrent
2017-04-27 14:53 - 2013-09-24 19:27 - 00000000 ____D C:\Users\VTB\AppData\Roaming\Skype
2017-04-26 17:13 - 2013-09-23 08:59 - 00218451 ____N C:\Windows\Minidump\042617-23899-01.dmp
2017-04-26 09:58 - 2013-09-23 19:54 - 00000000 ____D C:\Windows\Panther
2017-04-26 09:52 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\PolicyDefinitions
2017-04-25 19:51 - 2015-09-10 21:14 - 00000000 ____D C:\Users\VTB\AppData\Local\ElevatedDiagnostics
2017-04-25 17:40 - 2016-11-18 01:56 - 00000000 ____D C:\Program Files\Mozilla Firefox
2017-04-25 17:40 - 2013-09-23 19:59 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2017-04-23 15:15 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\rescache
2017-04-23 11:21 - 2014-05-26 01:31 - 00000000 ____D C:\Users\VTB\AppData\LocalLow\Temp
2017-04-22 23:32 - 2013-09-23 20:30 - 00000000 ____D C:\Users\VTB\AppData\Roaming\vlc
2017-04-22 17:03 - 2010-11-21 00:01 - 00713888 _____ C:\Windows\system32\PerfStringBackup.INI
2017-04-22 17:03 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\inf
2017-04-22 01:57 - 2013-09-23 19:23 - 00063544 _____ C:\Users\VTB\AppData\Local\GDIPFONTCACHEV1.DAT
2017-04-22 01:52 - 2009-07-14 07:33 - 00280032 _____ C:\Windows\system32\FNTCACHE.DAT
2017-04-22 01:49 - 2010-11-21 03:46 - 00000000 ____D C:\Windows\ShellNew
2017-04-22 01:49 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\system32\AdvancedInstallers
2017-04-22 01:49 - 2009-07-14 05:37 - 00000000 ____D C:\Program Files\Common Files\System
2017-04-22 01:48 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\system32\Dism
2017-04-21 20:47 - 2016-02-19 20:20 - 00002099 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-04-21 20:47 - 2016-02-19 20:20 - 00002087 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-04-21 19:54 - 2013-09-23 19:59 - 00001011 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-04-21 18:49 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\system32\NDF
2017-04-21 16:41 - 2014-08-06 23:12 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-04-21 16:25 - 2009-07-14 05:04 - 00000722 _____ C:\Windows\win.ini
2017-04-21 15:41 - 2009-07-14 07:52 - 00000000 ____D C:\Program Files\Windows Defender
2017-04-21 12:32 - 2013-09-23 20:44 - 00002057 _____ C:\Windows\epplauncher.mif
2017-04-21 12:31 - 2013-09-23 20:44 - 00002077 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2017-04-21 12:31 - 2013-09-23 20:43 - 00000000 ____D C:\Program Files\Microsoft Security Client
2017-04-21 02:12 - 2013-09-23 09:08 - 00001136 _____ C:\Users\VTB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2017-04-21 01:33 - 2013-09-23 20:35 - 00000000 ____D C:\Users\VTB\AppData\Roaming\Winamp
2017-04-21 01:08 - 2016-01-19 19:05 - 00000168 _____ C:\Users\VTB\Desktop\email, skype.txt
2017-04-18 02:05 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\registration
2017-04-18 02:05 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\Help
2017-04-17 01:41 - 2014-04-27 16:26 - 00000000 ____D C:\ProgramData\DatacardService
2017-04-11 19:20 - 2013-09-23 19:57 - 00802904 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2017-04-11 19:20 - 2013-09-23 19:57 - 00144472 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2017-04-11 19:20 - 2013-09-23 19:50 - 00000000 ____D C:\Windows\system32\Macromed
2017-04-08 01:06 - 2013-09-23 19:24 - 00430248 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2017-03-30 15:25 - 2009-07-14 07:53 - 00032594 _____ C:\Windows\Tasks\SCHEDLGU.TXT

==================== Files in the root of some directories =======

2015-02-14 12:38 - 2015-03-04 00:59 - 0000058 _____ () C:\Users\VTB\AppData\Local\DonationCoder_ScreenshotCaptor_InstallInfo.dat

Some files in TEMP:
====================
2017-04-28 10:53 - 2016-10-11 18:21 - 1310528 _____ (Microsoft Corporation) C:\Users\VTB\AppData\Local\Temp\dllnt_dump.dll

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-04-23 14:57

==================== End of FRST.txt ============================

Addition.txt

2 май 20179 г.

Здравейте,

Извинявам се за забавянето, но бях зает.

Не виждам да сте се заразили отново, но имаме още малко работа:

СТЪПКА 1

След това Изтеглете fixlist.txt и го запазете на десктопа.
Стартирайте FRST.exe и натиснете бутона Fix веднъж!
След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.

Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

СТЪПКА 2

Стартирайте ZHPCleaner отново и направете нова проверка.

След като приключи натиснете бутона Repair.

Ще се отвори ново меню. Отидете до Registry и премахнете отметката пред:

FOUND key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2} [Google Inc.] =>Heuristic.Suspect

Натиснете бутона Validate.

Сега натиснете пак бутона Repair и прикачете лог файла.

СТЪПКА 3

Направете нова проверка с RogueKiller.

Премахнете отметките пред следните обекти:

Цитат

[Proc.Injected] explorer.exe(1672) -- C:\Windows\explorer.exe[7] -> Found
[PUP.FusionCore|PUP.Gen0] HKEY_CLASSES_ROOT\CLSID\{27CD670F-BDD6-43C9-90E2-6842AF2E9E65} (C:\Program Files\Common Files\DVDVideoSoft\lib\MediaTagsEditor.dll) -> Found
[PUP.FusionCore|PUP.Gen0] HKEY_CLASSES_ROOT\CLSID\{7BC039E5-96E2-48C3-82AE-23889B9C969B} (C:\Program Files\Common Files\DVDVideoSoft\lib\MediaTagsEditor.dll) -> Found
[PUP.DownloadAssistant] HKEY_LOCAL_MACHINE\Software\DVDVideoSoft -> Found
[PUP.DownloadAssistant] HKEY_USERS\S-1-5-21-2291805700-3923089709-3695025833-1000\Software\DVDVideoSoft -> Found
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 192.168.1.1 0.0.0.0 ([-][]) -> Found
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters | DhcpNameServer : 192.168.1.1 0.0.0.0 ([-][]) -> Found
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{A2822287-723E-4E3D-82CE-DC080348D07D} | DhcpNameServer : 192.168.1.1 0.0.0.0 ([-][]) -> Found
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{A2822287-723E-4E3D-82CE-DC080348D07D} | DhcpNameServer : 192.168.1.1 0.0.0.0 ([-][]) -> Found
[PUP.DownloadAssistant][Folder] C:\Users\VTB\AppData\Roaming\DVDVideoSoft -> Found
[Tr.Gen0][File] C:\Users\VTB\AppData\Roaming\uTorrent\updates\3.4.5_41073\utorrentie.exe -> Found
[Tr.Gen0][File] C:\Users\VTB\AppData\Roaming\uTorrent\updates\3.4.5_41162\utorrentie.exe -> Found
[Tr.Gen0][File] C:\Users\VTB\AppData\Roaming\uTorrent\updates\3.4.5_41202\utorrentie.exe -> Found
[Tr.Gen0][File] C:\Users\VTB\AppData\Roaming\uTorrent\updates\3.4.5_41372\utorrentie.exe -> Found
[Tr.Gen0][File] C:\Users\VTB\AppData\Roaming\uTorrent\updates\3.4.5_41712\utorrentie.exe -> Found
[Tr.Gen0][File] C:\Users\VTB\AppData\Roaming\uTorrent\updates\3.4.5_41865\utorrentie.exe -> Found
[Tr.Gen0][File] C:\Users\VTB\AppData\Roaming\uTorrent\updates\3.4.6_42094\utorrentie.exe -> Found
[Tr.Gen0][File] C:\Users\VTB\AppData\Roaming\uTorrent\updates\3.4.7_42330\utorrentie.exe -> Found
[Tr.Gen0][File] C:\Users\VTB\AppData\Roaming\uTorrent\updates\3.4.8_42449\utorrentie.exe -> Found
[Tr.Gen0][File] C:\Users\VTB\AppData\Roaming\uTorrent\updates\3.4.8_42576\utorrentie.exe -> Found
[Tr.Gen0][File] C:\Users\VTB\AppData\Roaming\uTorrent\updates\3.4.9_42606\utorrentie.exe -> Found
[Tr.Gen0][File] C:\Users\VTB\AppData\Roaming\uTorrent\updates\3.4.9_42923\utorrentie.exe -> Found
[Tr.Gen0][File] C:\Users\VTB\AppData\Roaming\uTorrent\updates\3.4.9_42973\utorrentie.exe -> Found
[Tr.Gen0][File] C:\Users\VTB\AppData\Roaming\uTorrent\updates\3.4.9_43085\utorrentie.exe -> Found
[Tr.Gen0][File] C:\Users\VTB\AppData\Roaming\uTorrent\updates\3.4.9_43295\utorrentie.exe -> Found
[Tr.Gen0][File] C:\Users\VTB\AppData\Roaming\uTorrent\updates\3.4.9_43388\utorrentie.exe -> Found
[Tr.Gen0][File] C:\Users\VTB\AppData\Roaming\uTorrent\updates\3.5.0_43580\utorrentie.exe -> Found
[PUP.DownloadAssistant][Folder] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft -> Found
[PUP.FusionCore|PUP.Gen0][Folder] C:\Program Files\Common Files\DVDVideoSoft -> Found
[PUP.DownloadAssistant][Folder] C:\Program Files\DVDVideoSoft -> Found

т.е. да останат маркирани само следните:

Цитат

[PUP.UCBrowser|PUP.Gen1] HKEY_LOCAL_MACHINE\Software\UCBrowser -> Found
[PUP.Gen1] HKEY_LOCAL_MACHINE\Software\UCBrowserPID -> Found
[PUP.UCBrowser|PUP.Gen1] HKEY_USERS\.DEFAULT\Software\UCBrowser -> Found
[PUP.UCBrowser|PUP.Gen1] HKEY_USERS\S-1-5-21-2291805700-3923089709-3695025833-1000\Software\UCBrowser -> Found
[PUP.Gen1] HKEY_USERS\S-1-5-21-2291805700-3923089709-3695025833-1000\Software\UCBrowserPID -> Found
[PUP.UCBrowser|PUP.Gen1] HKEY_USERS\S-1-5-18\Software\UCBrowser -> Found

Натиснете Remove selected и пишете как е положението.

Поздрави!

9 май 20179 г.

Автор

Здравейте, извинявам се, но приключете темата. Наложи ми се да пътувам и няма кой да довърши темата. Аз сканирах с няколко антивирусни, почистих всички PUM, PUP, [Tr.Gen0][File], [Tr.Gen1][File]. След това видях как завършвате подобни теми и изтеглих Delfix, почистих и ръчно. Може и да не съм постъпила правилно, но компютъра работеше добре. Благодаря за отделеното време. Късно забелязах, че имате платена услуга.

10 май 20179 г.

Няма проблеми. Радвам се, че успях да помогна.

Приятен ден!

Добре дошли!

Вирус проблем с Yea Desktop

Featured Replies

Архивирана тема

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)