Като ъплоудер, отново ми се наложи да тествам една игра дали работи. Е не само, че не работеше, но ми натресе един куп неща. Част от тях деинсталирах, но едно нещата, които остана е някакъв файл с име 1.0.0.1, което при деинсталация иска да напишеш потвърдителен код, който е с йероглифи и няма как да се случи. В интерес на истината, след като инсталирах част от програмите, нещата се успокоиха и не ми изкачат китайски браузъри с реклами. Windows Defender не намери нищо при scan-а... Единствената програма, която помня се пишеше gypalia (или нещо от сорта) което удряше 30% от CPU-то. След рестарт отново се стартира браузър, който не е инсталиран никъде... Прикачам файл на няколкото файла които се инсталираха. Просто икоини... 

Всъщност не мога да прикача нито screen нито txt файла...

 

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 23-04-2017 01
Ran by Kuncavia (administrator) on DESKTOP-AHN0OIH (23-04-2017 18:14:43)
Running from D:\Users\Kuncavia\Downloads
Loaded Profiles: Kuncavia (Available Profiles: Kuncavia)
Platform: Windows 10 Pro Version 1703 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(Microsoft Corporation) C:\Windows\System32\SecurityHealthService.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
() C:\ProgramData\service.exe
(Razer Inc) C:\ProgramData\Razer\Synapse\Devices\Razer Surround\Driver\RzSurroundVADStreamingService.exe
() C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(TeamViewer GmbH) D:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
() C:\Program Files\WindowsApps\2414FC7A.Viber_6.6.21745.0_x86__p61zvh252yqyr\Native.Host.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.3\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.3\GoogleCrashHandler64.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
() C:\Program Files\WindowsApps\2414FC7A.Viber_6.6.21745.0_x86__p61zvh252yqyr\Viber.Universal.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
() C:\Users\Kuncavia\AppData\Roaming\gplyra\gplyra\gplyra.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Disc Soft Ltd) D:\Program Files (x86)\DAEMON Tools Lite\DTAgent.exe
(Disc Soft Ltd) D:\Program Files (x86)\DAEMON Tools Lite\DiscSoftBusServiceLite.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OFFICE16\CSISYNCCLIENT.EXE
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Microsoft Corporation) D:\Program Files (x86)\Office16\MSOSYNC.EXE
() C:\Users\Kuncavia\AppData\Local\Temp\00023036\msiql.exe
() C:\Program Files (x86)\YeaDesktop\YeaDesktop.exe
(Razer Inc.) C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Skype Technologies) C:\Program Files (x86)\Skype\Browser\SkypeBrowserHost.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.13.133.0_x64__kzf8qxf38zg5c\SkypeHost.exe
() C:\ProgramData\Razer\Synapse\RzStats\RzStats.Manager.exe
(Razer, Inc.) C:\Program Files (x86)\Razer\InGameEngine\32bit\RazerIngameEngine.exe
(Razer, Inc.) C:\Users\Kuncavia\AppData\Local\Razer\InGameEngine\cache\RzStats.Manager\rzcefrenderprocess.exe
(Skype Technologies) C:\Program Files (x86)\Skype\Browser\SkypeBrowserHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.15063.0_none_1a733a82001933cc\TiWorker.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [629152 2017-03-18] (Microsoft Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [558496 2014-02-27] (Adobe Systems Incorporated)
HKLM\...\Run: [gplyra] => C:\Users\Kuncavia\AppData\Roaming\gplyra\gplyra\start.cmd [216 2017-01-10] ()
HKLM-x32\...\Run: [Razer Synapse] => C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe [596640 2017-03-02] (Razer Inc.)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-1400939329-2555203986-2462190200-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3019552 2017-03-23] (Valve Corporation)
HKU\S-1-5-21-1400939329-2555203986-2462190200-1001\...\Run: [DAEMON Tools Lite Automount] => D:\Program Files (x86)\DAEMON Tools Lite\DTAgent.exe [4701888 2016-12-22] (Disc Soft Ltd)
HKU\S-1-5-21-1400939329-2555203986-2462190200-1001\...\Run: [Pritc] => C:\Users\Kuncavia\AppData\Local\Temp\is-G038A.tmp\Setup.exe [1431040 2017-04-21] (Setup) <===== ATTENTION
HKU\S-1-5-21-1400939329-2555203986-2462190200-1001\...\Run: [msiql] => C:\Users\Kuncavia\AppData\Local\Temp\00023036\msiql.exe [2072064 2017-04-23] () <===== ATTENTION
HKU\S-1-5-21-1400939329-2555203986-2462190200-1001\...\Run: [svchost0] => "C:\Program Files (x86)\UCBrowser\Application\UCBrowser.exe"\UUC0789.exe
HKU\S-1-5-21-1400939329-2555203986-2462190200-1001\...\Run: [YeaDesktop] => C:\Program Files (x86)\YeaDesktop\YeaDesktop.exe [2904064 2017-04-19] ()
HKU\S-1-5-21-1400939329-2555203986-2462190200-1001\...\Run: [apphide] => C:\Program Files (x86)\lll\uc.exe [176128 2017-04-22] (Unauthorized copy)
IFEO\SppExtComObj.exe: [Debugger] SppExtComObjPatcher.exe
ShellExecuteHooks: No Name - {5F51FFFE-7463-4220-B711-E5B9ACB8EDFE} - C:\ProgramData\igfxDH.dll [1032192 2017-04-20] ()
ShellIconOverlayIdentifiers: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => D:\Program Files (x86)\Office16\GROOVEEX.DLL [2016-06-15] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => D:\Program Files (x86)\Office16\GROOVEEX.DLL [2016-06-15] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => D:\Program Files (x86)\Office16\GROOVEEX.DLL [2016-06-15] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{9237b0bd-1bf5-42d4-bd43-41e4d4e02739}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\S-1-5-21-1400939329-2555203986-2462190200-1001\Software\Microsoft\Internet Explorer\Main,Start Page = 
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> D:\Program Files (x86)\Office16\OCHelper.dll [2016-07-12] (Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> D:\Program Files (x86)\Office16\GROOVEEX.DLL [2016-06-15] (Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office16\OCHelper.dll [2015-07-31] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\ssv.dll [2016-10-27] (Oracle Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office16\GROOVEEX.DLL [2016-06-15] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\jp2ssv.dll [2016-10-27] (Oracle Corporation)
Handler: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - D:\Program Files (x86)\Office16\MSOSB.DLL [2016-06-14] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2016-06-14] (Microsoft Corporation)
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - D:\Program Files (x86)\Office16\MSOSB.DLL [2016-06-14] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2016-06-14] (Microsoft Corporation)

Edge: 
======
Edge HomeButtonPage: HKU\S-1-5-21-1400939329-2555203986-2462190200-1001 -> hxxp://www.google.com

FireFox:
========
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> D:\Program Files (x86)\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2014-04-29] (Adobe Systems)
FF Plugin-x32: @java.com/DTPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\dtplugin\npDeployJava1.dll [2016-10-27] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\plugin2\npjp2.dll [2016-10-27] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-07-12] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll [2013-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2016-12-29] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2016-12-29] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.3\npGoogleUpdate3.dll [2017-04-11] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.3\npGoogleUpdate3.dll [2017-04-11] (Google Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2014-04-29] (Adobe Systems)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2016-07-12] (Microsoft Corporation)

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.msn.com/?pc=UP97&ocid=UP97DHP
CHR StartupUrls: Default -> "hxxp://www.delta-homes.com/?type=hp&ts=1432154289&z=307ceb3f219562f7502f7d4g2z0c5o1g3wczcoebcq&from=wpm05203&uid=ST31000524AS_5VPA2KTPXXXX5VPA2KTP","hxxp://www.youndoo.com/?z=915179240d88490a1114960gfz0bfbez5b6qcc8q5e&from=amz&uid=ST2000DM001-1ER164_W4Z1764SXXXXW4Z1764S&type=hp"
CHR Profile: C:\Users\Kuncavia\AppData\Local\Google\Chrome\User Data\Default [2017-04-23]
CHR Extension: (Google Slides) - C:\Users\Kuncavia\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-03-05]
CHR Extension: (Google Docs) - C:\Users\Kuncavia\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-03-05]
CHR Extension: (Google Drive) - C:\Users\Kuncavia\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-03-05]
CHR Extension: (YouTube) - C:\Users\Kuncavia\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-03-05]
CHR Extension: (Video Downloader professional) - C:\Users\Kuncavia\AppData\Local\Google\Chrome\User Data\Default\Extensions\elicpjhcidhpjomhibiffojpinpmmpil [2017-03-05]
CHR Extension: (Photo Zoom for Facebook) - C:\Users\Kuncavia\AppData\Local\Google\Chrome\User Data\Default\Extensions\elioihkkcdgakfbahdoddophfngopipi [2017-03-05]
CHR Extension: (Google Sheets) - C:\Users\Kuncavia\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-03-05]
CHR Extension: (Facebook™ Chat Privacy) - C:\Users\Kuncavia\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfpgaanechfneiboempkfjghninbibjn [2017-03-05]
CHR Extension: (Google Docs Offline) - C:\Users\Kuncavia\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-03-05]
CHR Extension: (Avast Online Security) - C:\Users\Kuncavia\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2017-04-14]
CHR Extension: (anonymoX) - C:\Users\Kuncavia\AppData\Local\Google\Chrome\User Data\Default\Extensions\icpklikeghomkemdellmmkoifgfbakio [2017-03-05]
CHR Extension: (Ghostery) - C:\Users\Kuncavia\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlomiejdfkolichcflejclcbmpeaniij [2017-03-05]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Kuncavia\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-09]
CHR Extension: (Gmail) - C:\Users\Kuncavia\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-03-05]
CHR Extension: (Chrome Media Router) - C:\Users\Kuncavia\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-04-14]
HKU\S-1-5-21-1400939329-2555203986-2462190200-1001\...\StartMenuInternet\ChromeHTML: -> C:\Program Files (x86)\Legass\Application\chrome.exe <==== ATTENTION

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 Disc Soft Lite Bus Service; D:\Program Files (x86)\DAEMON Tools Lite\DiscSoftBusServiceLite.exe [1471168 2016-12-22] (Disc Soft Ltd)
R2 GoogleChromeUpService; C:\ProgramData\service.exe [1620992 2017-04-23] () [File not signed] <==== ATTENTION
R2 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [458176 2016-12-29] (NVIDIA Corporation)
R2 Razer Game Scanner Service; C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [189264 2016-09-25] ()
R2 RzSurroundVADStreamingService; C:\ProgramData\Razer\Synapse\Devices\Razer Surround\Driver\RzSurroundVADStreamingService.exe [4261344 2016-11-04] (Razer Inc)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [3913064 2017-03-19] (Microsoft Corporation)
R2 TeamViewer; D:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [10351856 2016-12-15] (TeamViewer GmbH)
S3 VSStandardCollectorService140; C:\Program Files (x86)\Microsoft Visual Studio 14.0\Team Tools\DiagnosticsHub\Collector\StandardCollector.Service.exe [108776 2016-09-06] (Microsoft Corporation)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [342264 2017-03-18] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [102816 2017-03-18] (Microsoft Corporation)
S3 wlpasvc; C:\WINDOWS\System32\lpasvc.dll [1295360 2017-03-18] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 cryptfd; C:\WINDOWS\System32\drivers\cryptfd.sys [193448 2017-03-03] ()
R3 dtlitescsibus; C:\WINDOWS\System32\drivers\dtlitescsibus.sys [30264 2016-10-31] (Disc Soft Ltd)
R3 dtliteusbbus; C:\WINDOWS\System32\drivers\dtliteusbbus.sys [47672 2017-01-19] (Disc Soft Ltd)
S3 iaLPSS2i_GPIO2_BXT_P; C:\WINDOWS\System32\drivers\iaLPSS2i_GPIO2_BXT_P.sys [85504 2017-03-18] (Intel Corporation)
S3 iaLPSS2i_I2C_BXT_P; C:\WINDOWS\System32\drivers\iaLPSS2i_I2C_BXT_P.sys [168448 2017-03-18] (Intel Corporation)
R3 nvlddmkm; C:\WINDOWS\System32\DriverStore\FileRepository\nv_dispiwu.inf_amd64_b67dc924fff8de6d\nvlddmkm.sys [14199224 2017-01-04] (NVIDIA Corporation)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [604160 2017-03-18] (Realtek                                            )
R2 rzpmgrk; C:\WINDOWS\system32\drivers\rzpmgrk.sys [44144 2016-09-17] (Razer, Inc.)
R2 rzpnk; C:\WINDOWS\system32\drivers\rzpnk.sys [137840 2016-09-07] (Razer, Inc.)
R3 RZSURROUNDVADService; C:\WINDOWS\system32\drivers\RzSurroundVAD.sys [49176 2016-10-16] (Windows (R) Win 7 DDK provider)
S3 SDFRd; C:\WINDOWS\System32\drivers\SDFRd.sys [31128 2017-03-18] ()
R3 SensorsSimulatorDriver; C:\WINDOWS\System32\drivers\WUDFRd.sys [220672 2017-03-18] (Microsoft Corporation)
R1 ucdrv; C:\Program Files (x86)\UCBrowser\Security:ucdrv-x64.sys [25444 ] (UC Web Inc.) <==== ATTENTION
R1 VBoxNetAdp; C:\WINDOWS\system32\DRIVERS\VBoxNetAdp6.sys [132120 2016-10-18] (Oracle Corporation)
R1 VBoxNetLwf; C:\WINDOWS\system32\DRIVERS\VBoxNetLwf.sys [206416 2016-10-18] (Oracle Corporation)
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44632 2017-03-18] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [294816 2017-03-18] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [121248 2017-03-18] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

NETSVCx32: TokenBroker -> C:\Windows\SysWOW64\TokenBroker.dll (Microsoft Corporation)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-04-23 18:14 - 2017-04-23 18:14 - 00000000 ____D C:\FRST
2017-04-23 18:12 - 2017-04-23 18:12 - 00000000 ___HD C:\OneDriveTemp
2017-04-23 17:58 - 2017-04-23 18:11 - 00001617 _____ C:\Users\Kuncavia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\UC浏览器.lnk
2017-04-23 17:58 - 2017-04-23 18:11 - 00000000 ____D C:\Users\Kuncavia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\UC浏览器
2017-04-23 17:57 - 2017-04-23 18:10 - 00000494 _____ C:\WINDOWS\Tasks\UCBrowserUpdater.job
2017-04-23 17:57 - 2017-04-23 18:10 - 00000330 _____ C:\WINDOWS\Tasks\UCBrowserUpdaterCore.job
2017-04-23 17:57 - 2017-04-23 18:09 - 00003476 _____ C:\WINDOWS\System32\Tasks\UCBrowserSecureUpdater
2017-04-23 17:57 - 2017-04-23 18:09 - 00000000 ____D C:\Program Files (x86)\UCBrowser
2017-04-23 17:57 - 2017-04-23 17:57 - 00003518 _____ C:\WINDOWS\System32\Tasks\UCBrowserUpdater
2017-04-23 17:57 - 2017-04-23 17:57 - 00002668 _____ C:\WINDOWS\System32\Tasks\UCBrowserUpdaterCore
2017-04-23 17:57 - 2017-04-23 17:57 - 00000000 __SHD C:\Users\Kuncavia\AppData\Local\svchost
2017-04-23 17:57 - 2017-04-23 17:57 - 00000000 __SHD C:\Users\Kuncavia\AppData\Local\kemgadeojglibflomicgnfeopkdfflnw
2017-04-23 17:57 - 2017-04-23 17:57 - 00000000 ____D C:\Users\Kuncavia\AppData\Local\UCBrowser
2017-04-23 17:57 - 2017-04-20 21:59 - 01032192 ___SH C:\ProgramData\igfxDH.dll
2017-04-23 17:56 - 2017-04-23 18:11 - 00003662 _____ C:\WINDOWS\System32\Tasks\CreateExplorerShellUnelevatedTask
2017-04-23 17:56 - 2017-04-23 18:08 - 00000000 ____D C:\Program Files (x86)\YeaDesktop
2017-04-23 17:56 - 2017-04-23 17:56 - 01620992 _____ C:\ProgramData\service.exe
2017-04-23 17:56 - 2017-04-23 17:56 - 00003070 _____ C:\WINDOWS\System32\Tasks\Pritc
2017-04-23 17:56 - 2017-04-23 17:56 - 00000000 ____D C:\Users\Kuncavia\AppData\Roaming\UCChannel
2017-04-23 17:56 - 2017-04-23 17:56 - 00000000 ____D C:\Users\Kuncavia\AppData\Roaming\gplyra
2017-04-23 17:56 - 2017-04-23 17:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YeaDesktop
2017-04-23 17:56 - 2017-04-23 17:56 - 00000000 ____D C:\Program Files (x86)\lll
2017-04-23 17:55 - 2017-04-23 17:55 - 00140288 _____ C:\Users\Kuncavia\AppData\Roaming\Installer.dat
2017-04-23 17:55 - 2017-04-23 17:55 - 00011568 _____ C:\Users\Kuncavia\AppData\Roaming\InstallationConfiguration.xml
2017-04-22 00:41 - 2017-04-22 00:41 - 00000000 ____D C:\Users\Kuncavia\AppData\Local\DBG
2017-04-19 18:50 - 2017-04-19 18:50 - 00000000 ____D C:\ProgramData\Microsoft OneDrive
2017-04-19 18:48 - 2017-04-19 18:48 - 00000020 ___SH C:\Users\Kuncavia\ntuser.ini
2017-04-19 11:24 - 2017-04-19 11:24 - 23680512 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 23675392 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 20505600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 19334144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 12787200 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 11869696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 08319392 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2017-04-19 11:24 - 2017-04-19 11:24 - 08247296 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 07904784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 06756920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 06296064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 05477088 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneCoreUAPCommonProxyStub.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 03672064 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2017-04-19 11:24 - 2017-04-19 11:24 - 02957824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2017-04-19 11:24 - 2017-04-19 11:24 - 02444184 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2017-04-19 11:24 - 2017-04-19 11:24 - 02085280 _____ (Microsoft Corporation) C:\WINDOWS\system32\UpdateAgent.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 01760264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 01657344 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsPrint.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 01605632 _____ (Microsoft Corporation) C:\WINDOWS\system32\quartz.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 01604312 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 01518088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 01506816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\quartz.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 01411640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 01356800 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 01323880 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 01147296 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2017-04-19 11:24 - 2017-04-19 11:24 - 01060352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsPrint.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 01024416 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2017-04-19 11:24 - 2017-04-19 11:24 - 00986592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00805376 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieproxy.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00750560 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2017-04-19 11:24 - 2017-04-19 11:24 - 00626520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2017-04-19 11:24 - 2017-04-19 11:24 - 00624640 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00545792 _____ (Microsoft Corporation) C:\WINDOWS\system32\winspool.drv
2017-04-19 11:24 - 2017-04-19 11:24 - 00433664 _____ (Microsoft Corporation) C:\WINDOWS\system32\msIso.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00429568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winspool.drv
2017-04-19 11:24 - 2017-04-19 11:24 - 00409504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2017-04-19 11:24 - 2017-04-19 11:24 - 00382368 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00364032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00357888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieproxy.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00354360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcryptprimitives.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00347136 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsDocumentTargetPrint.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00311192 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00252928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsDocumentTargetPrint.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00205728 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00119296 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataTimeUtil.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00094720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataTimeUtil.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmjpegdec.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00087552 _____ (Microsoft Corporation) C:\WINDOWS\system32\asycfilt.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00081408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmjpegdec.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00078336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\asycfilt.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00047104 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00038912 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\BasicRender.sys
2017-04-19 11:24 - 2017-04-19 11:24 - 00032004 _____ C:\WINDOWS\system32\edgehtmlpluginpolicy.bin
2017-04-19 11:24 - 2017-04-19 11:24 - 00000000 ____D C:\Windows.old
2017-04-19 11:23 - 2017-04-19 11:23 - 00543648 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe
2017-04-19 11:23 - 2017-04-19 11:23 - 00388000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS
2017-04-19 11:23 - 2017-03-18 09:48 - 00094720 _____ (Microsoft Corporation) C:\WINDOWS\system32\DxToolsReportGenerator.dll
2017-04-19 11:23 - 2017-03-18 09:08 - 17777152 _____ (Microsoft Corporation) C:\WINDOWS\system32\DXCaptureReplay.dll
2017-04-19 11:23 - 2017-03-18 09:05 - 00094720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DxToolsReportGenerator.dll
2017-04-19 11:23 - 2017-03-18 09:02 - 00393216 _____ (Windows (R) Win 7 DDK provider) C:\WINDOWS\system32\DXCpl.exe
2017-04-19 11:23 - 2017-03-18 08:59 - 04164608 _____ (Microsoft Corporation) C:\WINDOWS\system32\NlsLexicons0002.dll
2017-04-19 11:23 - 2017-03-18 08:59 - 00091136 _____ (Microsoft Corporation) C:\WINDOWS\system32\VsGraphicsProxyStub.dll
2017-04-19 11:23 - 2017-03-18 08:59 - 00079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\VSD3DWARP12Debug.dll
2017-04-19 11:23 - 2017-03-18 08:57 - 00059392 _____ (Microsoft Corporation) C:\WINDOWS\system32\VSD3DWARPDebug.dll
2017-04-19 11:23 - 2017-03-18 08:55 - 00164864 _____ (Microsoft Corporation) C:\WINDOWS\system32\NlsData0002.dll
2017-04-19 11:23 - 2017-03-18 08:54 - 01914368 _____ (Microsoft Corporation) C:\WINDOWS\system32\MLS2.dll
2017-04-19 11:23 - 2017-03-18 08:53 - 00334848 _____ (Microsoft Corporation) C:\WINDOWS\system32\DXGIDebug.dll
2017-04-19 11:23 - 2017-03-18 08:52 - 04897280 _____ (Microsoft Corporation) C:\WINDOWS\system32\VsGraphicsRemoteEngine.exe
2017-04-19 11:23 - 2017-03-18 08:51 - 05776384 _____ (Microsoft Corporation) C:\WINDOWS\system32\VsGraphicsDesktopEngine.exe
2017-04-19 11:23 - 2017-03-18 08:49 - 01309184 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11_3SDKLayers.dll
2017-04-19 11:23 - 2017-03-18 08:49 - 00498176 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1debug3.dll
2017-04-19 11:23 - 2017-03-18 08:48 - 13785600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DXCaptureReplay.dll
2017-04-19 11:23 - 2017-03-18 08:47 - 06806016 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d12warp.dll
2017-04-19 11:23 - 2017-03-18 08:46 - 02617344 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d12SDKLayers.dll
2017-04-19 11:23 - 2017-03-18 08:46 - 00370176 _____ (Windows (R) Win 7 DDK provider) C:\WINDOWS\SysWOW64\DXCpl.exe
2017-04-19 11:23 - 2017-03-18 08:44 - 01977344 _____ (Microsoft Corporation) C:\WINDOWS\system32\DXToolsOfflineAnalysis.dll
2017-04-19 11:23 - 2017-03-18 08:44 - 01174528 _____ (Microsoft Corporation) C:\WINDOWS\system32\DXCap.exe
2017-04-19 11:23 - 2017-03-18 08:44 - 00283648 _____ (Microsoft Corporation) C:\WINDOWS\system32\VsGraphicsExperiment.dll
2017-04-19 11:23 - 2017-03-18 08:44 - 00163328 _____ (Microsoft Corporation) C:\WINDOWS\system32\VsGraphicsCapture.dll
2017-04-19 11:23 - 2017-03-18 08:43 - 04164608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NlsLexicons0002.dll
2017-04-19 11:23 - 2017-03-18 08:43 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\system32\DXToolsMonitor.dll
2017-04-19 11:23 - 2017-03-18 08:43 - 00176128 _____ (Microsoft Corporation) C:\WINDOWS\system32\DXToolsReporting.dll
2017-04-19 11:23 - 2017-03-18 08:43 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VSD3DWARP12Debug.dll
2017-04-19 11:23 - 2017-03-18 08:43 - 00041984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VsGraphicsProxyStub.dll
2017-04-19 11:23 - 2017-03-18 08:41 - 00058880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VSD3DWARPDebug.dll
2017-04-19 11:23 - 2017-03-18 08:40 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NlsData0002.dll
2017-04-19 11:23 - 2017-03-18 08:39 - 01868288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MLS2.dll
2017-04-19 11:23 - 2017-03-18 08:39 - 00236544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DXGIDebug.dll
2017-04-19 11:23 - 2017-03-18 08:38 - 00348672 _____ (Microsoft Corporation) C:\WINDOWS\system32\perf_gputiming.dll
2017-04-19 11:23 - 2017-03-18 08:36 - 04544000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VsGraphicsDesktopEngine.exe
2017-04-19 11:23 - 2017-03-18 08:35 - 01060864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11_3SDKLayers.dll
2017-04-19 11:23 - 2017-03-18 08:35 - 00430080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1debug3.dll
2017-04-19 11:23 - 2017-03-18 08:33 - 05141504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d12warp.dll
2017-04-19 11:23 - 2017-03-18 08:33 - 03648000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VsGraphicsRemoteEngine.exe
2017-04-19 11:23 - 2017-03-18 08:32 - 02102272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d12SDKLayers.dll
2017-04-19 11:23 - 2017-03-18 08:30 - 01480704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DXToolsOfflineAnalysis.dll
2017-04-19 11:23 - 2017-03-18 08:30 - 00926208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DXCap.exe
2017-04-19 11:23 - 2017-03-18 08:30 - 00220160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VsGraphicsExperiment.dll
2017-04-19 11:23 - 2017-03-18 08:30 - 00123904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VsGraphicsCapture.dll
2017-04-19 11:23 - 2017-03-18 08:29 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DXToolsMonitor.dll
2017-04-19 11:23 - 2017-03-18 08:29 - 00121344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DXToolsReporting.dll
2017-04-19 11:23 - 2017-03-18 08:25 - 00269824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\perf_gputiming.dll
2017-04-19 11:22 - 2017-04-19 11:22 - 00008192 _____ C:\WINDOWS\system32\config\userdiff
2017-04-19 11:22 - 2017-04-19 11:22 - 00000000 ____D C:\Program Files\Reference Assemblies
2017-04-19 11:22 - 2017-04-19 11:22 - 00000000 ____D C:\Program Files\MSBuild
2017-04-19 11:22 - 2017-04-19 11:22 - 00000000 ____D C:\Program Files (x86)\Reference Assemblies
2017-04-19 11:22 - 2017-04-19 00:29 - 00000000 ____D C:\Program Files (x86)\MSBuild
2017-04-19 11:22 - 2017-04-19 00:26 - 00000000 ____D C:\WINDOWS\ServiceProfiles
2017-04-19 11:21 - 2017-02-10 22:26 - 01166520 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationNative_v0300.dll
2017-04-19 11:21 - 2017-02-10 22:26 - 00124624 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2017-04-19 11:21 - 2017-02-10 22:26 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe
2017-04-19 11:21 - 2017-02-10 22:21 - 00778936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationNative_v0300.dll
2017-04-19 11:21 - 2017-02-10 22:21 - 00103120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2017-04-19 11:21 - 2017-02-10 22:21 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe
2017-04-19 00:45 - 2017-04-19 00:45 - 00000000 ____D C:\ProgramData\USOShared
2017-04-19 00:38 - 2017-04-19 00:38 - 00000000 _SHDL C:\Users\Default\My Documents
2017-04-19 00:37 - 2017-04-19 00:37 - 00007623 _____ C:\WINDOWS\diagwrn.xml
2017-04-19 00:37 - 2017-04-19 00:37 - 00007623 _____ C:\WINDOWS\diagerr.xml
2017-04-19 00:36 - 2017-04-23 18:10 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-04-19 00:36 - 2017-04-23 13:49 - 00004174 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{53F05FE1-2F08-40FE-8B7B-BBF7E672BC99}
2017-04-19 00:36 - 2017-04-19 18:50 - 00003296 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task v2
2017-04-19 00:36 - 2017-04-19 00:36 - 00003444 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2017-04-19 00:36 - 2017-04-19 00:36 - 00003220 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2017-04-19 00:36 - 2017-04-19 00:36 - 00000000 ____D C:\WINDOWS\System32\Tasks\OfficeSoftwareProtectionPlatform
2017-04-19 00:34 - 2017-04-19 00:34 - 00001576 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2017-04-19 00:28 - 2017-04-19 00:34 - 00000000 ____D C:\WINDOWS\system32\config\bbimigrate
2017-04-19 00:28 - 2017-03-18 23:56 - 02233344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2017-04-19 00:27 - 2017-04-23 18:11 - 00000000 ____D C:\Users\Kuncavia
2017-04-19 00:27 - 2017-04-19 00:41 - 00982514 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-04-19 00:27 - 2017-04-19 00:29 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2017-04-19 00:27 - 2017-04-19 00:29 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2017-04-19 00:27 - 2017-04-19 00:29 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2017-04-19 00:27 - 2017-04-19 00:27 - 00939752 _____ C:\WINDOWS\SysWOW64\PerfStringBackup.INI
2017-04-19 00:27 - 2017-04-19 00:27 - 00000000 _SHDL C:\Users\Kuncavia\My Documents
2017-04-19 00:27 - 2016-12-29 15:44 - 06386232 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcpl.dll
2017-04-19 00:27 - 2016-12-29 15:44 - 02477624 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvsvc64.dll
2017-04-19 00:27 - 2016-12-29 15:44 - 01762752 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvsvcr.dll
2017-04-19 00:27 - 2016-12-29 15:44 - 00546752 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nv3dappshext.dll
2017-04-19 00:27 - 2016-12-29 15:44 - 00392128 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvmctray.dll
2017-04-19 00:27 - 2016-12-29 15:44 - 00083512 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nv3dappshextr.dll
2017-04-19 00:27 - 2016-12-29 15:44 - 00069568 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvshext.dll
2017-04-19 00:27 - 2016-12-19 10:26 - 07651057 _____ C:\WINDOWS\system32\nvcoproc.bin
2017-04-19 00:26 - 2017-04-23 18:10 - 00392968 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2017-04-19 00:26 - 2017-04-23 13:04 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2017-04-18 18:53 - 2017-04-18 18:53 - 00000000 ____D C:\Users\Kuncavia\AppData\LocalLow\CipciuGames
2017-04-18 18:27 - 2017-04-18 18:27 - 00000000 ____D C:\Users\Kuncavia\AppData\LocalLow\Ripened Peach Entertainment
2017-04-18 08:15 - 2017-04-19 18:48 - 00000000 ___DC C:\WINDOWS\Panther
2017-04-14 23:28 - 2017-04-14 23:28 - 00000000 ____D C:\Users\Kuncavia\AppData\Local\Kalyskah_RPG
2017-04-14 08:37 - 2017-04-14 08:37 - 00000000 ____D C:\Users\Kuncavia\AppData\Local\UNP
2017-04-14 08:31 - 2017-04-19 00:34 - 00000000 ____D C:\WINDOWS\system32\UNP
2017-04-14 08:31 - 2017-04-14 08:32 - 00000000 ____D C:\Program Files\UNP
2017-04-12 17:21 - 2017-03-28 08:37 - 00031232 _____ (Microsoft Corporation) C:\WINDOWS\system32\DdcWnsListener.dll
2017-04-12 17:21 - 2017-03-28 08:28 - 00261632 _____ (Microsoft Corporation) C:\WINDOWS\system32\indexeddbserver.dll
2017-04-04 15:29 - 2017-04-19 00:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2017-04-04 15:29 - 2017-04-04 15:29 - 00000000 ___RD C:\Program Files (x86)\Skype
2017-04-02 08:15 - 2017-04-02 08:15 - 00087904 _____ (Microsoft Corporation) C:\WINDOWS\system32\UNPUXWorker.exe
2017-03-29 19:44 - 2017-03-29 19:44 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-03-29 19:42 - 2017-04-19 00:34 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2016 Tools
2017-03-29 19:42 - 2017-03-29 19:42 - 00002729 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook 2016.lnk
2017-03-29 19:42 - 2017-03-29 19:42 - 00002662 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneDrive for Business.lnk
2017-03-29 19:42 - 2017-03-29 19:42 - 00002656 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Word 2016.lnk
2017-03-29 19:42 - 2017-03-29 19:42 - 00002656 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype for Business 2016.lnk
2017-03-29 19:42 - 2017-03-29 19:42 - 00002656 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access 2016.lnk
2017-03-29 19:42 - 2017-03-29 19:42 - 00002648 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneNote 2016.lnk
2017-03-29 19:42 - 2017-03-29 19:42 - 00002648 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel 2016.lnk
2017-03-29 19:42 - 2017-03-29 19:42 - 00002642 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerPoint 2016.lnk
2017-03-29 19:42 - 2017-03-29 19:42 - 00002628 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Publisher 2016.lnk
2017-03-29 19:41 - 2017-03-29 19:41 - 00000000 ____D C:\Program Files\Common Files\DESIGNER
2017-03-29 19:40 - 2017-03-29 19:40 - 00000000 ____D C:\Program Files\Microsoft Analysis Services
2017-03-29 19:40 - 2017-03-29 19:40 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2017-03-29 19:40 - 2017-03-29 19:40 - 00000000 ____D C:\Program Files (x86)\Microsoft Analysis Services
2017-03-27 18:42 - 2017-03-27 19:58 - 00000000 ____D C:\Users\Kuncavia\AppData\Local\tyranoscript

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-04-23 18:12 - 2016-10-20 18:29 - 00000000 ____D C:\Users\Kuncavia\AppData\Roaming\Skype
2017-04-23 18:12 - 2016-10-19 19:21 - 00000000 ____D C:\Program Files (x86)\Steam
2017-04-23 18:12 - 2016-10-19 14:02 - 00000000 ___RD C:\Users\Kuncavia\OneDrive
2017-04-23 18:11 - 2016-10-26 11:34 - 00000000 _____ C:\WINDOWS\system32\RzSurroundVADAudioDeviceManager_log.txt
2017-04-23 18:10 - 2017-03-18 14:40 - 00786432 _____ C:\WINDOWS\system32\config\BBI
2017-04-23 18:10 - 2016-12-11 13:44 - 00000000 ____D C:\Users\Kuncavia\AppData\Roaming\uTorrent
2017-04-23 18:10 - 2016-10-24 03:50 - 00000000 ____D C:\ProgramData\NVIDIA
2017-04-23 13:27 - 2017-03-19 00:03 - 00000000 ___HD C:\Program Files\WindowsApps
2017-04-23 13:27 - 2017-03-19 00:03 - 00000000 ____D C:\WINDOWS\AppReadiness
2017-04-21 23:05 - 2016-10-27 18:32 - 00000000 ____D C:\Users\Kuncavia\AppData\Roaming\RenPy
2017-04-20 23:10 - 2017-03-19 00:01 - 00000000 ____D C:\WINDOWS\INF
2017-04-20 04:58 - 2017-03-19 00:03 - 00000000 ____D C:\WINDOWS\appcompat
2017-04-19 19:40 - 2017-03-18 23:51 - 00000000 ____D C:\WINDOWS\CbsTemp
2017-04-19 19:05 - 2016-10-19 14:01 - 00000000 ____D C:\Users\Kuncavia\AppData\Local\Packages
2017-04-19 18:50 - 2016-10-24 07:33 - 00000000 ____D C:\Users\Kuncavia\AppData\Local\ConnectedDevicesPlatform
2017-04-19 18:50 - 2016-10-19 14:02 - 00002376 _____ C:\Users\Kuncavia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2017-04-19 18:48 - 2017-03-19 00:03 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2017-04-19 18:48 - 2016-11-15 18:12 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 11.0
2017-04-19 18:48 - 2016-11-15 18:05 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 12.0
2017-04-19 18:48 - 2016-11-15 18:03 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 14.0
2017-04-19 18:48 - 2016-10-19 14:01 - 00000000 __RHD C:\Users\Public\AccountPictures
2017-04-19 11:25 - 2017-03-19 00:03 - 00028672 _____ C:\WINDOWS\system32\config\BCD-Template
2017-04-19 11:24 - 2017-03-19 00:06 - 00000000 ____D C:\WINDOWS\Setup
2017-04-19 11:23 - 2017-03-19 05:30 - 00000000 ____D C:\WINDOWS\OCR
2017-04-19 00:45 - 2017-03-19 00:03 - 00000000 ____D C:\ProgramData\USOPrivate
2017-04-19 00:39 - 2017-03-19 00:03 - 00000000 ____D C:\WINDOWS\rescache
2017-04-19 00:38 - 2017-03-19 00:03 - 00000000 ____D C:\WINDOWS\system32\WinBioDatabase
2017-04-19 00:37 - 2017-03-19 00:03 - 00000000 ____D C:\WINDOWS\Registration
2017-04-19 00:37 - 2017-03-19 00:03 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2017-04-19 00:37 - 2017-03-18 14:40 - 00032768 _____ C:\WINDOWS\system32\config\ELAM
2017-04-19 00:37 - 2017-03-03 00:30 - 00002272 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-04-19 00:37 - 2016-07-16 14:47 - 00000000 ____D C:\WINDOWS\system32\Tasks_Migrated
2017-04-19 00:36 - 2017-03-19 05:31 - 00000000 ____D C:\WINDOWS\HoloShell
2017-04-19 00:36 - 2017-03-19 00:03 - 00000000 __RHD C:\Users\Public\Libraries
2017-04-19 00:36 - 2016-10-24 03:54 - 00022840 _____ C:\WINDOWS\system32\emptyregdb.dat
2017-04-19 00:34 - 2017-01-04 22:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOM
2017-04-19 00:34 - 2016-12-27 01:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoHotkey
2017-04-19 00:34 - 2016-12-03 00:00 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Second Life Viewer
2017-04-19 00:34 - 2016-11-15 18:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Python Tools for Visual Studio 2015
2017-04-19 00:34 - 2016-11-15 18:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2017-04-19 00:34 - 2016-11-15 18:04 - 00000000 ____D C:\WINDOWS\SysWOW64\1033
2017-04-19 00:34 - 2016-11-15 18:03 - 00000000 ____D C:\WINDOWS\system32\1033
2017-04-19 00:34 - 2016-11-07 21:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CC 2014
2017-04-19 00:34 - 2016-11-03 23:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOM Player
2017-04-19 00:34 - 2016-10-31 12:46 - 00000000 ____D C:\WINDOWS\SHELLNEW
2017-04-19 00:34 - 2016-10-27 18:30 - 00000000 ____D C:\Users\Kuncavia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2017-04-19 00:34 - 2016-10-27 18:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2017-04-19 00:34 - 2016-10-19 19:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2017-04-19 00:30 - 2017-03-19 00:03 - 00000000 ____D C:\WINDOWS\system32\spool
2017-04-19 00:30 - 2017-03-03 00:30 - 00000000 ____D C:\WINDOWS\system32\appmgmt
2017-04-19 00:29 - 2017-03-19 00:03 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2017-04-19 00:29 - 2017-03-19 00:03 - 00000000 ____D C:\Program Files\Common Files\System
2017-04-19 00:29 - 2017-03-19 00:03 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2017-04-19 00:29 - 2017-02-08 09:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2017-04-19 00:29 - 2017-01-19 19:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ILLUSION
2017-04-19 00:29 - 2016-11-15 18:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Expression
2017-04-19 00:29 - 2016-11-15 18:05 - 00000000 ____D C:\Program Files\IIS
2017-04-19 00:29 - 2016-11-15 18:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Visual Studio 2015
2017-04-19 00:29 - 2016-10-26 11:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razer
2017-04-19 00:28 - 2015-10-30 10:24 - 00000000 ___HD C:\WINDOWS\system32\GroupPolicy
2017-04-19 00:27 - 2017-03-19 00:03 - 00000000 ____D C:\WINDOWS\Help
2017-04-19 00:27 - 2017-03-18 14:40 - 00000000 ____D C:\WINDOWS\system32\Sysprep
2017-04-19 00:15 - 2017-03-19 06:20 - 00000000 ___HD C:\$WINDOWS.~BT
2017-04-17 22:34 - 2016-10-26 11:34 - 00000000 _____ C:\WINDOWS\SysWOW64\RzSurroundVADAudioDeviceManager_log.txt
2017-04-14 23:28 - 2016-10-27 20:02 - 00000000 ____D C:\Users\Kuncavia\AppData\Local\UnrealEngine
2017-04-12 19:32 - 2016-10-19 20:34 - 00000000 ____D C:\WINDOWS\system32\MRT
2017-04-12 19:30 - 2016-10-19 13:59 - 148601744 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2017-04-08 17:27 - 2016-10-19 14:00 - 00532136 _____ (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2017-04-04 15:29 - 2016-10-20 20:10 - 00000000 ____D C:\ProgramData\Skype
2017-04-03 19:56 - 2017-03-19 00:06 - 00835576 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2017-04-03 19:56 - 2017-03-19 00:06 - 00177656 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2017-03-29 19:40 - 2015-10-30 10:24 - 00000167 _____ C:\WINDOWS\win.ini
2017-03-29 19:33 - 2016-10-31 12:47 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2017-03-28 19:01 - 2017-03-01 20:34 - 00000000 ____D C:\Users\Kuncavia\AppData\Roaming\Thinstall
2017-03-25 22:29 - 2017-02-13 10:30 - 00000000 ____D C:\Users\Kuncavia\AppData\Local\CrashDumps

==================== Files in the root of some directories =======

2017-04-23 17:55 - 2017-04-23 17:55 - 0011568 _____ () C:\Users\Kuncavia\AppData\Roaming\InstallationConfiguration.xml
2017-04-23 17:55 - 2017-04-23 17:55 - 0140288 _____ () C:\Users\Kuncavia\AppData\Roaming\Installer.dat
2017-04-23 17:57 - 2017-04-20 21:59 - 1032192 ___SH () C:\ProgramData\igfxDH.dll
2017-04-23 17:56 - 2017-04-23 17:56 - 1620992 _____ () C:\ProgramData\service.exe

Files to move or delete:
====================
C:\Users\Kuncavia\AppData\Local\Temp\is-G038A.tmp\Setup.exe
C:\Users\Kuncavia\AppData\Local\Temp\00023036\msiql.exe
C:\ProgramData\igfxDH.dll
C:\ProgramData\service.exe

Some files in TEMP:
====================
2017-04-23 17:56 - 2017-04-23 17:57 - 51185040 _____ (UCWeb Inc.) C:\Users\Kuncavia\AppData\Local\Temp\Browser_V6.0.1471.913_f_4730_(Build1702151518).exe
2017-04-23 17:57 - 2017-04-23 17:57 - 1958888 _____ (深圳市史宾赛科技有限公司) C:\Users\Kuncavia\AppData\Local\Temp\FlowSpritSetup_slnt_5016.exe
2017-04-23 17:58 - 2017-04-23 17:58 - 2983626 _____ () C:\Users\Kuncavia\AppData\Local\Temp\MagicDiskSetup.exe
2017-04-23 17:58 - 2017-04-23 17:58 - 1006592 _____ (湖南七度网络科技有限公司) C:\Users\Kuncavia\AppData\Local\Temp\PSoft_4010_1.0.0.104_Setup.exe
2017-04-18 09:48 - 2017-04-18 09:48 - 2982680 _____ (Chengdu Xingju Infinite Technology Co.,Ltd.) C:\Users\Kuncavia\AppData\Local\Temp\setup.3.16.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-04-19 00:26

==================== End of FRST.txt ============================

 

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23-04-2017 01
Ran by Kuncavia (23-04-2017 18:15:24)
Running from D:\Users\Kuncavia\Downloads
Windows 10 Pro Version 1703 (X64) (2017-04-18 21:39:02)
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-1400939329-2555203986-2462190200-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1400939329-2555203986-2462190200-503 - Limited - Disabled)
Guest (S-1-5-21-1400939329-2555203986-2462190200-501 - Limited - Disabled)
Kuncavia (S-1-5-21-1400939329-2555203986-2462190200-1001 - Administrator - Enabled) => C:\Users\Kuncavia

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKLM-x32\...\uTorrent) (Version: 2.2.1 - )
1.0.0.1 (HKLM-x32\...\YeaDesktop) (Version: 1.0.0.1 - )
13 rooms (HKLM-x32\...\13 rooms1.1) (Version: 1.1 - megalol777)
Active Directory Authentication Library for SQL Server (Version: 13.0.1601.5 - Microsoft Corporation) Hidden
Active Directory Authentication Library for SQL Server (x86) (x32 Version: 13.0.1601.5 - Microsoft Corporation) Hidden
Adobe Photoshop CC 2014.2.2 (HKLM-x32\...\Adobe Photoshop CC 2014.2.2) (Version:  - )
Ansel (Version: 373.06 - NVIDIA Corporation) Hidden
Application Insights Tools for Visual Studio 2015 (HKLM-x32\...\{0E4C791E-B78E-477D-BD5A-CDD0985BA6EC}) (Version: 7.0.20622.1 - Microsoft Corporation)
AutoHotkey 1.1.24.04 (HKLM\...\AutoHotkey) (Version: 1.1.24.04 - Lexikos)
Azure AD Authentication Connected Service (x32 Version: 14.0.25420 - Microsoft Corporation) Hidden
AzureTools.Notifications (x32 Version: 2.7.30611.1601 - Microsoft Corporation) Hidden
Blend for Visual Studio SDK for .NET 4.5 (x32 Version: 3.0.40218.0 - Microsoft Corporation) Hidden
Counter-Strike: Global Offensive (HKLM\...\Steam App 730) (Version:  - Valve)
DAEMON Tools Lite (HKLM\...\DAEMON Tools Lite) (Version: 10.5.0.0222 - Disc Soft Ltd)
Dotfuscator and Analytics Community Edition 5.22.0 (x32 Version: 5.22.0.3788 - PreEmptive Solutions) Hidden
Emergency 2017 (HKLM-x32\...\Emergency 2017_is1) (Version:  - )
Entity Framework 6.1.3 Tools  for Visual Studio 2015 Update 1 (HKLM-x32\...\{2A56910C-69C8-495D-8ED8-9080F0A14E58}) (Version: 14.0.41103.0 - Microsoft Corporation)
GOM Player (HKLM-x32\...\GOM Player) (Version: 2.3.10.5266 - Gretech Corporation)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 57.0.2987.133 - Google Inc.)
Google Update Helper (x32 Version: 1.3.33.3 - Google Inc.) Hidden
Herramientas de corrección de Microsoft Office 2016: español (Version: 16.0.4266.1001 - Microsoft Corporation) Hidden
IIS 10.0 Express (HKLM\...\{13FD7E30-D2F1-498D-ABC2-A4242DB6610E}) (Version: 10.0.1736 - Microsoft Corporation)
IIS Express Application Compatibility Database for x64 (HKLM\...\{08274920-8908-45c2-9258-8ad67ff77b09}.sdb) (Version:  - )
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.4229 - Intel Corporation)
Last Man (HKU\S-1-5-21-1400939329-2555203986-2462190200-1001\...\Last Man) (Version:  - )
Matt and the bus stop girl (HKU\S-1-5-21-1400939329-2555203986-2462190200-1001\...\Matt and the bus stop girl) (Version:  - )
Medusa's curse (HKLM-x32\...\Medusa's curse1.1) (Version: 1.1 - megalol777)
Microsoft .NET Framework 4.5 Multi-Targeting Pack (HKLM-x32\...\{56E962F0-4FB0-3C67-88DB-9EAA6EEFC493}) (Version: 4.5.50710 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 Multi-Targeting Pack (ENU) (HKLM-x32\...\{D3517C62-68A5-37CF-92F7-93C029A89681}) (Version: 4.5.50932 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 Multi-Targeting Pack (HKLM-x32\...\{6A0C6700-EA93-372C-8871-DCCF13D160A4}) (Version: 4.5.50932 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 SDK (HKLM-x32\...\{19A5926D-66E1-46FC-854D-163AA10A52D3}) (Version: 4.5.51641 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 Multi-Targeting Pack (ENU) (HKLM-x32\...\{290FC320-2F5A-329E-8840-C4193BD7A9EE}) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 Multi-Targeting Pack (HKLM-x32\...\{19E8AE59-4D4A-3534-B567-6CC08FA4102E}) (Version: 4.5.51651 - Microsoft Corporation)
Microsoft .NET Framework 4.6 SDK (HKLM-x32\...\{B5915D37-0637-4A26-A3AA-C5DC9F856370}) (Version: 4.6.00081 - Microsoft Corporation)
Microsoft .NET Framework 4.6 Targeting Pack (ENU) (HKLM-x32\...\{034547E9-D8FA-49E7-8B9C-4C9861FB9146}) (Version: 4.6.00127 - Microsoft Corporation)
Microsoft .NET Framework 4.6 Targeting Pack (HKLM-x32\...\{2CC6A4A7-AAC2-46C9-9DBB-3727B5954F65}) (Version: 4.6.00081 - Microsoft Corporation)
Microsoft .NET Framework 4.6.1 SDK (HKLM-x32\...\{2F0ECC80-B9E4-4485-8083-CD32F22ABD92}) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft .NET Framework 4.6.1 Targeting Pack (ENU) (HKLM-x32\...\{8EEB28EE-5141-411C-9CF0-9952264FE4AF}) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft .NET Framework 4.6.1 Targeting Pack (HKLM-x32\...\{8BC3EEC9-090F-4C53-A8DA-1BEC913040F9}) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft .NET Version Manager (x64) 1.0.0-beta5 (HKLM\...\{c5a4aba3-1aba-3ef8-b2d5-c3fa37f59738}) (Version: 1.0.10609.0 - Microsoft Corporation)
Microsoft Help Viewer 2.2 (HKLM-x32\...\Microsoft Help Viewer 2.2) (Version: 2.2.25420 - Microsoft Corporation)
Microsoft Office Professional Plus 2016 (HKLM\...\Office16.PROPLUS) (Version: 16.0.4266.1001 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1400939329-2555203986-2462190200-1001\...\OneDriveSetup.exe) (Version: 17.3.6816.0313 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.20513.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Command Line Utilities  (HKLM\...\{9D573E71-1077-4C7E-B4DB-4E22A5D2B48B}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Native Client  (HKLM\...\{49D665A2-4C2A-476E-9AB8-FCC425F526FC}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2014 Management Objects  (HKLM-x32\...\{2774595F-BC2A-4B12-A25B-0C37A37049B0}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft SQL Server 2014 Management Objects  (x64) (HKLM\...\{1F9EB3B6-AED7-4AA7-B8F1-8E314B74B2A5}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft SQL Server 2014 Transact-SQL ScriptDom  (HKLM\...\{020CDFE0-C127-4047-B571-37C82396B662}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft SQL Server 2014 T-SQL Language Service  (HKLM-x32\...\{47D08E7A-92A1-489B-B0BF-415516497BCE}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft SQL Server 2016 LocalDB  (HKLM\...\{E359515A-92E6-4FA3-A2C9-E1BA02D8DE6E}) (Version: 13.0.1601.5 - Microsoft Corporation)
Microsoft SQL Server 2016 Management Objects  (HKLM-x32\...\{0F1C8E2F-199A-4946-B3BF-0906DACFD032}) (Version: 13.0.1601.5 - Microsoft Corporation)
Microsoft SQL Server 2016 Management Objects  (x64) (HKLM\...\{20EA85AA-2A1D-4F11-B09F-4BA2BF3C8989}) (Version: 13.0.1601.5 - Microsoft Corporation)
Microsoft SQL Server 2016 T-SQL Language Service  (HKLM-x32\...\{8BFDE775-C5B8-46DB-84EF-43FFC8A2E8AD}) (Version: 13.0.14500.10 - Microsoft Corporation)
Microsoft SQL Server 2016 T-SQL ScriptDom  (HKLM\...\{D091DE8C-EA0F-49AF-8DE3-BD6C79737C6E}) (Version: 13.0.1601.5 - Microsoft Corporation)
Microsoft SQL Server Compact 4.0 SP1 x64 ENU (HKLM\...\{78909610-D229-459C-A936-25D92283D3FD}) (Version: 4.0.8876.1 - Microsoft Corporation)
Microsoft SQL Server Data Tools - enu (14.0.60519.0) (HKLM-x32\...\{4E27B0EF-7BAB-432A-AF3D-3FC8F3F7353F}) (Version: 14.0.60519.0 - Microsoft Corporation)
Microsoft System CLR Types for SQL Server 2014 (HKLM\...\{FC3BB979-AA54-4B60-BBA3-2C4DA6E08D80}) (Version: 12.0.2402.29 - Microsoft Corporation)
Microsoft System CLR Types for SQL Server 2014 (HKLM-x32\...\{091CE6AA-2753-4F6E-AD1C-0E875744EB54}) (Version: 12.0.2402.29 - Microsoft Corporation)
Microsoft System CLR Types for SQL Server 2016 (HKLM\...\{96EB5054-C775-4BEF-B7B9-AA96A295EDCD}) (Version: 13.0.1601.5 - Microsoft Corporation)
Microsoft System CLR Types for SQL Server 2016 (HKLM-x32\...\{84C23ECA-FE4D-494F-9247-3EBAD57E7F0C}) (Version: 13.0.1601.5 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 (HKLM-x32\...\{d992c12e-cab2-426f-bde3-fb8c53950b0d}) (Version: 14.0.24215.1 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
Microsoft Visual Studio Community 2015 with Updates (HKLM-x32\...\{79b486b9-c5f0-4096-a00c-8351f59587c2}) (Version: 14.0.25420.1 - Microsoft Corporation)
Microsoft Web Deploy 3.6 (HKLM\...\{94E1227C-08A9-4962-B388-1F05D89AEA75}) (Version: 3.1238.1962 - Microsoft Corporation)
Motorsport Manager (HKLM-x32\...\Motorsport Manager_is1) (Version:  - )
MSBuild/NuGet Integration 14.0 (x86) (x32 Version: 14.0.25420 - Microsoft Corporation) Hidden
Multi-Device Hybrid Apps using C# - Templates - ENU (x32 Version: 14.0.23107 - Microsoft Corporation) Hidden
Nik Collection (HKLM-x32\...\Nik Collection) (Version: 1.2.11 - Google)
NVIDIA 3D Vision Driver 376.53 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 376.53 - NVIDIA Corporation)
NVIDIA Graphics Driver 376.53 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 376.53 - NVIDIA Corporation)
NVIDIA HD Audio Driver 1.3.34.17 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.34.17 - NVIDIA Corporation)
Oracle VM VirtualBox 5.1.8 (HKLM\...\{65402252-5DA1-4360-A144-E09BB16AC7A9}) (Version: 5.1.8 - Oracle Corporation)
Outils de vérification linguistique 2016 de Microsoft Office - Français (Version: 16.0.4266.1001 - Microsoft Corporation) Hidden
PreEmptive Analytics Visual Studio Components (x32 Version: 1.2.5134.1 - PreEmptive Solutions) Hidden
Prerequisites for SSDT  (HKLM-x32\...\{21373064-AD95-48DB-A32E-0D9E08EF7355}) (Version: 12.0.2000.8 - Microsoft Corporation)
Prerequisites for SSDT  (HKLM-x32\...\{B7E94916-7AE6-4F7F-A377-7A410A42BA19}) (Version: 13.0.1601.5 - Microsoft Corporation)
Python Tools 2.2.5 for Visual Studio 2015 (HKLM-x32\...\{615045D1-CEF9-482C-AD74-6432A0ACE9E5}) (Version: 2.2.40825.00 - Microsoft Corporation)
RadLight Ogg Media DirectShow filter (remove only) (HKLM-x32\...\RadLight Ogg Media DirectShow filter) (Version:  - "RadLight, LLC.")
Razer Surround (HKLM-x32\...\Razer Surround) (Version: 1.05.26 - Razer Inc.)
Razer Synapse (HKLM-x32\...\{0D78BEE2-F8FF-4498-AF1A-3FF81CED8AC6}) (Version: 2.20.17.302 - Razer Inc.)
Roslyn Language Services - x86 (x32 Version: 14.0.23107 - Microsoft Corporation) Hidden
Roslyn Language Services - x86 (x32 Version: 14.0.25431 - Microsoft Corporation) Hidden
RPG MAKER VX Ace RTP (HKLM-x32\...\RPGVXAce_RTP_is1) (Version: 1.00 - Enterbrain)
SecondLifeViewer (HKLM-x32\...\SecondLifeViewer) (Version: 4.1.2.321518 - Linden Research, Inc.)
Sensual Alchemist (HKLM-x32\...\Sensual Alchemist1.1) (Version: 1.1 - megalol777)
Sexy Beach 3 Platinum Pack (HKLM-x32\...\{BE43FDDD-F003-494F-952A-69731FF82197}) (Version: 1.00.0000 - ILLUSION)
Sexy Beach Premium Resort (HKLM-x32\...\Sexy Beach Premium Resort_is1) (Version:  - )
Skype™ 7.33 (HKLM-x32\...\{3B7E914A-93D5-4A29-92BB-AF8C3F66C431}) (Version: 7.33.105 - Skype Technologies S.A.)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
SteamVR (HKLM\...\Steam App 250820) (Version:  - )
Team Explorer for Microsoft Visual Studio 2015 Update 3.1 (x32 Version: 14.102.25619 - Microsoft) Hidden
TeamViewer 12 (HKLM-x32\...\TeamViewer) (Version: 12.0.72365 - TeamViewer)
Test Tools for Microsoft Visual Studio 2015 (x32 Version: 14.0.23107 - Microsoft Corporation) Hidden
The Klub 17 (HKU\S-1-5-21-1400939329-2555203986-2462190200-1001\...\Klub-7) (Version: 7.5.0 - Team WRK17)
TypeScript Power Tool (x32 Version: 1.8.34.0 - Microsoft Corporation) Hidden
TypeScript Tools for Microsoft Visual Studio 2015 (x32 Version: 1.8.36.0 - Microsoft Corporation) Hidden
UE4 Prerequisites (x64) (Version: 1.0.11.0 - Epic Games, Inc.) Hidden
UE4 Prerequisites (x64) (x32 Version: 1.0.13.0 - Epic Games, Inc.) Hidden
Update for  (KB2504637) (HKLM-x32\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}.KB2504637) (Version: 1 - Microsoft Corporation)
Update_msi (HKLM-x32\...\{59B5A9CD-253D-4C41-A073-B387D4C9672D}) (Version: 1.0.0 - Default Company Name)
Visual Studio 2015 Update 3 (KB3022398) (HKLM-x32\...\{7a68448b-9cf2-4049-bd73-5875f1aa7ba2}) (Version: 14.0.25420 - Microsoft Corporation)
VS Update core components (x32 Version: 14.0.25431 - Microsoft Corporation) Hidden
vs_update3notification (x32 Version: 14.0.25431 - Microsoft Corporation) Hidden
vs2015_redist x86 (x32 Version: 1.0.0.0 - Realnetworks) Hidden
Vulkan Run Time Libraries 1.0.26.0 (HKLM\...\VulkanRT1.0.26.0) (Version: 1.0.26.0 - LunarG, Inc.)
WCF Data Services 5.6.4 Runtime (x32 Version: 5.6.62175.4 - Microsoft Corporation) Hidden
WCF Data Services Tools for Microsoft Visual Studio 2015 (x32 Version: 5.6.62175.4 - Microsoft Corporation) Hidden
Windows 10 Update and Privacy Settings (HKLM\...\{293F2009-0145-450B-B4AA-063D43FB368C}) (Version: 1.0.13.0 - Microsoft Corporation)
WinRAR 5.40 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {04BFD5C5-5B90-4D6B-9EA6-A1247AD96DF5} - System32\Tasks\CreateExplorerShellUnelevatedTask => C:\WINDOWS\Explorer.exe /NOUACCHECK
Task: {0CC7641F-8EE4-465C-B2EA-1F1319F84C76} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-10-19] (Google Inc.)
Task: {16BC555D-8B6D-4A98-9264-CB7A57EC3134} - System32\Tasks\UCBrowserSecureUpdater => C:\Program Files (x86)\UCBrowser\Security\uclauncher.exe [2017-04-23] (UC Web Inc.) <==== ATTENTION
Task: {32F4AF4C-C0E1-4203-A09C-A6A56B0D7842} - System32\Tasks\UCBrowserUpdater => C:\Program Files (x86)\UCBrowser\Application\update_task.exe [2017-03-07] (UCWeb Inc) <==== ATTENTION
Task: {381F7ACC-D7C1-424F-93D2-55E34BE5855B} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => D:\Program Files (x86)\Office16\msoia.exe [2015-07-31] (Microsoft Corporation)
Task: {883F4173-A2FE-48EE-A595-0D497895F71B} - System32\Tasks\Pritc => C:\Users\Kuncavia\AppData\Local\Temp\is-G038A.tmp\Setup.exe [2017-04-21] (Setup) <==== ATTENTION
Task: {C6EC277D-27B0-4B8E-A0B5-28E5F85E33CF} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => D:\Program Files (x86)\Office16\msoia.exe [2015-07-31] (Microsoft Corporation)
Task: {D1C71A8F-50A8-4C5C-834D-AD0B077A52C4} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-10-19] (Google Inc.)
Task: {E94F73A5-C5E2-4CA4-B4E5-BE5336CE2F60} - System32\Tasks\UCBrowserUpdaterCore => C:\Program Files (x86)\UCBrowser\Application\update_task.exe [2017-03-07] (UCWeb Inc) <==== ATTENTION
Task: {FC5A0228-1E46-4070-9C31-9E20CED0265D} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office16\OLicenseHeartbeat.exe [2015-07-31] (Microsoft Corporation)
Task: {FC85D9AB-4157-46E2-A2DC-3F15CCB70AE6} - System32\Tasks\Microsoft\VisualStudio\VSIX Auto Update 14 => C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\VSIXAutoUpdate.exe [2016-06-20] (Microsoft Corporation)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\UCBrowserUpdater.job => C:\Program Files (x86)\UCBrowser\Application\update_task.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\UCBrowserUpdaterCore.job => C:\Program Files (x86)\UCBrowser\Application\update_task.exe <==== ATTENTION

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2017-04-23 17:56 - 2017-04-23 17:56 - 01620992 _____ () C:\ProgramData\service.exe
2016-09-25 01:20 - 2016-09-25 01:21 - 00189264 _____ () C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe
2017-04-19 00:27 - 2016-12-29 15:44 - 00134712 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2016-06-14 06:25 - 2016-06-14 06:25 - 08911552 _____ () D:\Program Files (x86)\Office16\1033\GrooveIntlResource.dll
2017-03-18 23:58 - 2017-03-18 23:58 - 00138000 _____ () C:\WINDOWS\SYSTEM32\inputhost.dll
2017-03-18 23:59 - 2017-03-19 05:30 - 01731072 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-03-14 11:00 - 2017-03-14 11:00 - 00037888 _____ () C:\Program Files\WindowsApps\2414FC7A.Viber_6.6.21745.0_x86__p61zvh252yqyr\Native.Host.exe
2017-03-14 11:00 - 2017-03-14 11:00 - 00019456 _____ () C:\Program Files\WindowsApps\2414FC7A.Viber_6.6.21745.0_x86__p61zvh252yqyr\Viber.Universal.exe
2017-04-23 17:56 - 2017-02-15 13:57 - 02794496 _____ () C:\Users\Kuncavia\AppData\Roaming\gplyra\gplyra\gplyra.exe
2017-04-23 17:56 - 2017-04-23 17:56 - 02072064 _____ () C:\Users\Kuncavia\AppData\Local\Temp\00023036\msiql.exe
2017-04-23 17:56 - 2017-04-19 14:33 - 02904064 _____ () C:\Program Files (x86)\YeaDesktop\YeaDesktop.exe
2017-04-11 05:39 - 2017-04-11 05:39 - 00077312 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.13.133.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2017-04-11 05:39 - 2017-04-11 05:39 - 00189952 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.13.133.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2017-04-11 05:39 - 2017-04-11 05:39 - 42507264 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.13.133.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2017-04-11 05:39 - 2017-04-11 05:39 - 02334184 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.13.133.0_x64__kzf8qxf38zg5c\skypert.dll
2017-01-19 06:22 - 2017-01-19 06:22 - 00298448 _____ () C:\ProgramData\Razer\Synapse\RzStats\RzStats.Manager.exe
2017-04-04 02:26 - 2017-03-29 11:47 - 02885464 _____ () C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\libglesv2.dll
2017-04-04 02:26 - 2017-03-29 11:47 - 00099672 _____ () C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\libegl.dll
2017-03-14 11:00 - 2017-03-14 11:00 - 46234112 _____ () C:\Program Files\WindowsApps\2414FC7A.Viber_6.6.21745.0_x86__p61zvh252yqyr\Viber.Universal.dll
2017-03-14 11:00 - 2017-03-14 11:00 - 06893056 _____ () C:\Program Files\WindowsApps\2414FC7A.Viber_6.6.21745.0_x86__p61zvh252yqyr\PhoneControllerRT.dll
2017-03-14 11:00 - 2017-03-14 11:00 - 00074752 _____ () C:\Program Files\WindowsApps\2414FC7A.Viber_6.6.21745.0_x86__p61zvh252yqyr\Native.Utils.dll
2017-03-14 11:00 - 2017-03-14 11:00 - 00732160 _____ () C:\Program Files\WindowsApps\2414FC7A.Viber_6.6.21745.0_x86__p61zvh252yqyr\Native.SQLite.dll
2017-03-14 11:00 - 2017-03-14 11:00 - 00081920 _____ () C:\Program Files\WindowsApps\2414FC7A.Viber_6.6.21745.0_x86__p61zvh252yqyr\Native.Host.Proxy.dll
2017-03-14 11:00 - 2017-03-14 11:00 - 00686080 _____ () C:\Program Files\WindowsApps\2414FC7A.Viber_6.6.21745.0_x86__p61zvh252yqyr\LinkParserRT.dll
2017-01-04 16:18 - 2017-01-04 16:18 - 40132536 _____ () C:\WINDOWS\system32\nvcompiler.dll
2016-10-19 19:25 - 2017-03-10 03:13 - 00674592 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2016-10-19 19:25 - 2016-09-01 04:02 - 04969248 _____ () C:\Program Files (x86)\Steam\v8.dll
2016-10-19 19:24 - 2016-09-01 04:02 - 01563936 _____ () C:\Program Files (x86)\Steam\icui18n.dll
2016-10-19 19:24 - 2016-09-01 04:02 - 01195296 _____ () C:\Program Files (x86)\Steam\icuuc.dll
2016-10-19 19:24 - 2017-03-23 03:52 - 02465056 _____ () C:\Program Files (x86)\Steam\video.dll
2016-10-19 19:24 - 2016-01-27 10:49 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll
2016-10-19 19:24 - 2016-01-27 10:49 - 00442880 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll
2016-10-19 19:24 - 2016-01-27 10:49 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll
2016-10-19 19:24 - 2016-01-27 10:49 - 02549760 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll
2016-10-19 19:24 - 2016-01-27 10:49 - 00491008 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll
2016-10-19 19:25 - 2017-03-31 01:46 - 00848672 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2016-10-19 19:24 - 2016-07-05 01:17 - 00266560 _____ () C:\Program Files (x86)\Steam\openvr_api.dll
2017-01-30 12:52 - 2017-01-30 12:52 - 01926632 ____R () C:\Program Files (x86)\Skype\Phone\roottools.dll
2017-01-16 14:40 - 2017-01-16 14:40 - 00143824 _____ () C:\ProgramData\Razer\Synapse\CrashReporter\CrashRpt1402.dll
2016-12-23 19:56 - 2017-01-31 00:41 - 68875552 _____ () C:\Program Files (x86)\Steam\bin\cef\cef.win7\libcef.dll
2017-04-17 22:34 - 2016-10-08 10:13 - 50656768 _____ () C:\Users\Kuncavia\AppData\Local\razer\InGameEngine\cache\RzStats.Manager\cef\libcef.dll
2017-04-17 22:34 - 2016-10-08 10:13 - 01874944 _____ () C:\Users\Kuncavia\AppData\Local\razer\InGameEngine\cache\RzStats.Manager\cef\libglesv2.dll
2017-04-17 22:34 - 2016-10-08 10:13 - 00075264 _____ () C:\Users\Kuncavia\AppData\Local\razer\InGameEngine\cache\RzStats.Manager\cef\libegl.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\WINDOWS\system32\drivers:ucdrv-x64.sys [25444]
AlternateDataStreams: C:\WINDOWS\system32\drivers:x64 [1498914]
AlternateDataStreams: C:\WINDOWS\system32\drivers:x86 [1223458]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetSetupSvc => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2015-10-30 10:24 - 2017-03-05 14:10 - 00000027 ____A C:\WINDOWS\system32\Drivers\etc\hosts

127.0.0.1       localhost

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1400939329-2555203986-2462190200-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Kuncavia\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\wall-1.jpg
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{B7E30D3F-BA77-454A-B097-CDBBA6B52962}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{47844A0E-114B-453C-987A-BBD4ABFF7EF5}] => (Allow) D:\Program Files (x86)\Office16\outlook.exe
FirewallRules: [{BC1C053F-0123-4A20-85CC-F7DB6A58068A}] => (Allow) D:\Program Files (x86)\Office16\UcMapi.exe
FirewallRules: [{00BF4E7D-D242-4213-9F05-578E68A70738}] => (Allow) D:\Program Files (x86)\Office16\UcMapi.exe
FirewallRules: [{A9F4B912-AE5A-4EAB-ABB6-E7C5D25A0971}] => (Allow) D:\Program Files (x86)\Office16\lync.exe
FirewallRules: [{15CC7E08-64D6-4042-86D3-78D6671E0CF8}] => (Allow) D:\Program Files (x86)\Office16\lync.exe
FirewallRules: [{1B15D585-BAE4-42B7-BAE7-E0F3776A08A5}] => (Allow) D:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{9A42827B-2AA8-4439-A425-4E1309FA86BA}] => (Allow) D:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{E7A8CAF9-B6BF-467B-A81C-C2F5B7FC03D3}] => (Allow) D:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{5F39178B-490C-4BE4-9344-953F7DC15D2C}] => (Allow) D:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{A562E942-5946-4AA1-A462-6D4723037E32}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\SteamVR\tools\bin\win32\vrmonitor.exe
FirewallRules: [{0A8285D1-08CA-4816-9024-58D3657621D8}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\SteamVR\tools\bin\win32\vrmonitor.exe
FirewallRules: [{EAAE4DEC-5F68-4987-B76B-4DC9BCA99E50}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{9EB5A4DC-28E1-4B97-919B-93099CC18336}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{F220924B-26E6-4C34-8567-3C8A247D21A5}] => (Allow) C:\Program Files (x86)\uTorrent\uTorrent.exe
FirewallRules: [{39917C2A-5889-419C-8D50-2F2FBDFE52E2}] => (Allow) C:\Program Files (x86)\uTorrent\uTorrent.exe
FirewallRules: [UDP Query User{3AA833EC-B638-407A-8C3F-638B71E801AB}C:\program files (x86)\secondlifeviewer\slvoice.exe] => (Allow) C:\program files (x86)\secondlifeviewer\slvoice.exe
FirewallRules: [TCP Query User{CBB4D8F5-5E6D-43BD-968A-0E25DFFAA6C7}C:\program files (x86)\secondlifeviewer\slvoice.exe] => (Allow) C:\program files (x86)\secondlifeviewer\slvoice.exe
FirewallRules: [{0D737E41-125B-4DB5-B505-272E6543DD21}] => (Allow) C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\devenv.exe
FirewallRules: [{C77C83AC-D936-43B3-9718-8DC0B839AA14}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{3C3AF047-42E6-417A-81B3-AEE1CDB7F2AA}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{0D43AC2D-5A45-47EA-A2C9-9BAB5E683599}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{7F26990A-AAFA-41A1-9425-A348E1A1B5E4}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{C431C447-E6DE-4AA3-802E-A30B7E083D36}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{4D3710D4-A282-45F2-8ADF-30903BFDC34F}] => (Allow) C:\Program Files (x86)\UCBrowser\Application\UCBrowser.exe
FirewallRules: [{61EBD854-6A2C-486E-90E2-DA8F6A941692}] => (Allow) C:\Program Files (x86)\UCBrowser\Application\Downloader\download\MiniThunderPlatform.exe
FirewallRules: [{70695BF8-A64C-43BA-AE1D-25829619E634}] => (Allow) C:\Program Files (x86)\UCBrowser\Application\UCBrowser.exe
FirewallRules: [{2CE93FDB-A1E6-43D9-B864-430041E835FA}] => (Allow) C:\Users\Kuncavia\AppData\Local\Temp\FlowSpritSetup_slnt_5016.exe
FirewallRules: [{D1DCC5DF-F130-4867-B415-E95493E34BC7}] => (Allow) C:\Users\Kuncavia\AppData\Local\Temp\setuppacket_bin_185482d7\FlowSpritSetup_slnt_5009.exe

==================== Restore Points =========================

19-04-2017 19:40:03 Windows Update

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (04/23/2017 06:10:12 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program FRST64 (1).exe version 23.4.2017.1 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

Process ID: 11b4

Start Time: 01d2bc43ab9cb2f3

Termination Time: 4294967295

Application Path: D:\Users\Kuncavia\Downloads\FRST64 (1).exe

Report Id: 057e2977-5d5f-4b67-bafd-0f8d821cde5a

Faulting package full name: 

Faulting package-relative application ID:

Error: (04/23/2017 06:08:42 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program FRST64 (1).exe version 23.4.2017.1 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

Process ID: 528

Start Time: 01d2bc435c416213

Termination Time: 4294967295

Application Path: D:\Users\Kuncavia\Downloads\FRST64 (1).exe

Report Id: ea48f892-4211-43b9-895f-a0fb655fe97e

Faulting package full name: 

Faulting package-relative application ID:

Error: (04/23/2017 05:58:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: FlowSpritSetup_slnt_5009.exe, version: 1.0.1.8, time stamp: 0x58a26328
Faulting module name: KERNEL32.DLL, version: 10.0.15063.0, time stamp: 0x44ba4b0a
Exception code: 0xc0000005
Fault offset: 0x00016850
Faulting process id: 0x1340
Faulting application start time: 0x01d2bc4211bf8b9a
Faulting application path: C:\Users\Kuncavia\AppData\Local\Temp\setuppacket_bin_185482d7\FlowSpritSetup_slnt_5009.exe
Faulting module path: C:\WINDOWS\System32\KERNEL32.DLL
Report Id: f6a2ad5c-1a99-4f81-89ae-1b9876d53e67
Faulting package full name: 
Faulting package-relative application ID:

Error: (04/23/2017 05:58:18 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: FlowSpritSetup_slnt_5016.exe, version: 1.0.1.8, time stamp: 0x58a26328
Faulting module name: KERNEL32.DLL, version: 10.0.15063.0, time stamp: 0x44ba4b0a
Exception code: 0xc0000005
Fault offset: 0x00016850
Faulting process id: 0x784
Faulting application start time: 0x01d2bc41fd7fa21b
Faulting application path: C:\Users\Kuncavia\AppData\Local\Temp\FlowSpritSetup_slnt_5016.exe
Faulting module path: C:\WINDOWS\System32\KERNEL32.DLL
Report Id: 98861273-cba5-4e82-ba79-90451b139bd3
Faulting package full name: 
Faulting package-relative application ID:

Error: (04/23/2017 05:57:03 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: KuaiZip_Setup_3053270226_zzlm_013.exe, version: 2.8.28.3, time stamp: 0x58f03fc7
Faulting module name: KERNEL32.DLL, version: 10.0.15063.0, time stamp: 0x44ba4b0a
Exception code: 0xc0000005
Fault offset: 0x00016850
Faulting process id: 0x23d0
Faulting application start time: 0x01d2bc41de278c3b
Faulting application path: C:\Users\Kuncavia\AppData\Local\Temp\00023124\KuaiZip_Setup_3053270226_zzlm_013.exe
Faulting module path: C:\WINDOWS\System32\KERNEL32.DLL
Report Id: 190c70c7-b9db-41f2-aaab-fa5ba52bbac0
Faulting package full name: 
Faulting package-relative application ID:

Error: (04/23/2017 05:55:53 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: ic-0.0ab7f3b1f36208.exe, version: 0.0.0.0, time stamp: 0x58fcbb3a
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc00001a5
Fault offset: 0x02a7eba2
Faulting process id: 0x23c4
Faulting application start time: 0x01d2bc41b36e000c
Faulting application path: C:\Users\Kuncavia\AppData\Local\Temp\407995046\ic-0.0ab7f3b1f36208.exe
Faulting module path: unknown
Report Id: ed295db0-8b2b-4a91-873c-2950a591ccfb
Faulting package full name: 
Faulting package-relative application ID:

Error: (04/22/2017 10:56:16 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program GOM.EXE version 2.3.10.5266 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

Process ID: 1de0

Start Time: 01d2bba2753f24bf

Termination Time: 8

Application Path: D:\Program Files (x86)\GRETECH\GomPlayer\GOM.EXE

Report Id: fd4a6901-776c-410f-859f-cafae1d30bf6

Faulting package full name: 

Faulting package-relative application ID:

Error: (04/22/2017 01:24:29 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-AHN0OIH)
Description: Activation of app Microsoft.BingWeather_8wekyb3d8bbwe!App failed with error: -2144927148 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (04/22/2017 12:41:21 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: Viber.Universal.exe, version: 1.0.0.0, time stamp: 0x58b8300a
Faulting module name: SharedLibrary.dll, version: 1.4.24201.0, time stamp: 0x574e6d5c
Exception code: 0x00001007
Fault offset: 0x003ae8bd
Faulting process id: 0x22e8
Faulting application start time: 0x01d2b924c3593340
Faulting application path: C:\Program Files\WindowsApps\2414FC7A.Viber_6.6.21745.0_x86__p61zvh252yqyr\Viber.Universal.exe
Faulting module path: C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\SharedLibrary.dll
Report Id: 9afb1a65-3608-4f0d-9308-eb09d8187f9d
Faulting package full name: 2414FC7A.Viber_6.6.21745.0_x86__p61zvh252yqyr
Faulting package-relative application ID: Viber.Universal

Error: (04/19/2017 12:38:50 AM) (Source: Windows Search Service) (EventID: 1019) (User: )
Description: Windows Search Service failed to process the list of included and excluded locations with the error <30, 0x80004005, "file:///D:\[1c4db113-876e-40cd-92fd-07ffc4c53f38]\Users\Kuncavia\Videos\">.

System errors:
=============
Error: (04/23/2017 06:10:49 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The CldFlt service failed to start due to the following error: 
The request is not supported.

Error: (04/23/2017 06:10:30 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-AHN0OIH)
Description: The server {9BA05972-F6A8-11CF-A442-00A0C90A8F39} did not register with DCOM within the required timeout.

Error: (04/23/2017 06:10:30 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-AHN0OIH)
Description: The server {9BA05972-F6A8-11CF-A442-00A0C90A8F39} did not register with DCOM within the required timeout.

Error: (04/23/2017 06:10:27 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-AHN0OIH)
Description: The server {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} did not register with DCOM within the required timeout.

Error: (04/23/2017 06:10:27 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-AHN0OIH)
Description: The server {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} did not register with DCOM within the required timeout.

Error: (04/23/2017 06:10:27 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-AHN0OIH)
Description: The server {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} did not register with DCOM within the required timeout.

Error: (04/23/2017 06:10:27 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-AHN0OIH)
Description: The server {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} did not register with DCOM within the required timeout.

Error: (04/23/2017 06:10:27 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-AHN0OIH)
Description: The server {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} did not register with DCOM within the required timeout.

Error: (04/23/2017 06:10:27 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-AHN0OIH)
Description: The server {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} did not register with DCOM within the required timeout.

Error: (04/23/2017 06:10:27 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-AHN0OIH)
Description: The server {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} did not register with DCOM within the required timeout.

CodeIntegrity:
===================================
  Date: 2017-04-20 23:09:58.676
  Description: Code Integrity determined that a process (\Device\HarddiskVolume7\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume7\Program Files\Common Files\microsoft shared\OFFICE16\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-2500 CPU @ 3.30GHz
Percentage of memory in use: 41%
Total physical RAM: 8173.23 MB
Available physical RAM: 4748.91 MB
Total Virtual: 9453.23 MB
Available Virtual: 5635.07 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:223.02 GB) (Free:110.76 GB) NTFS
Drive d: (Drive) (Fixed) (Total:1374.61 GB) (Free:899.69 GB) NTFS
Drive f: (SB3_PP_ENG) (CDROM) (Total:1.95 GB) (Free:0 GB) CDFS
Drive g: (Games) (Fixed) (Total:488.28 GB) (Free:488.12 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 00000000)

Partition: GPT.

========================================================
Disk: 1 (Size: 223.6 GB) (Disk ID: 00000000)

Partition: GPT.

==================== End of Addition.txt ============================

 

 

След рестарта, отново тази гад реши да тормози процесора. 

 

EDIT: Файла, който не можех да деинсталриам, го разкарах с geek

Това е bitcoinminer. Утре ще напиша скрипт, но искам нови логове от FRST, защото след като сте правили неща на своя глава лог файловете вече няма да са актуални.

Поздрави!

Добро утро,

Прилагам новите логове и един screen от Windows Defender (не съм правил нови действия)

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 23-04-2017 01
Ran by Kuncavia (administrator) on DESKTOP-AHN0OIH (24-04-2017 07:43:12)
Running from D:\Users\Kuncavia\Desktop
Loaded Profiles: Kuncavia (Available Profiles: Kuncavia)
Platform: Windows 10 Pro Version 1703 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(Microsoft Corporation) C:\Windows\System32\SecurityHealthService.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
() C:\ProgramData\service.exe
(Razer Inc) C:\ProgramData\Razer\Synapse\Devices\Razer Surround\Driver\RzSurroundVADStreamingService.exe
() C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(TeamViewer GmbH) D:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
() C:\Program Files\WindowsApps\2414FC7A.Viber_6.6.21745.0_x86__p61zvh252yqyr\Native.Host.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.3\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.3\GoogleCrashHandler64.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
() C:\Program Files\WindowsApps\2414FC7A.Viber_6.6.21745.0_x86__p61zvh252yqyr\Viber.Universal.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Disc Soft Ltd) D:\Program Files (x86)\DAEMON Tools Lite\DTAgent.exe
(Disc Soft Ltd) D:\Program Files (x86)\DAEMON Tools Lite\DiscSoftBusServiceLite.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OFFICE16\CSISYNCCLIENT.EXE
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
() C:\Users\Kuncavia\AppData\Local\Temp\00023036\msiql.exe
(Razer Inc.) C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe
(Skype Technologies) C:\Program Files (x86)\Skype\Browser\SkypeBrowserHost.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.13.133.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
() C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
(Microsoft Corporation) C:\Windows\System32\GameBarPresenceWriter.exe
(Valve Corporation) C:\Program Files (x86)\Steam\GameOverlayUI.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\Taskmgr.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(UCWeb Inc.) C:\Program Files (x86)\UCBrowser\Application\UCBrowser.exe
(UCWeb Inc.) C:\Program Files (x86)\UCBrowser\Application\UCBrowser.exe
(UCWeb Inc.) C:\Program Files (x86)\UCBrowser\Application\UCBrowser.exe
(UCWeb Inc.) C:\Program Files (x86)\UCBrowser\Application\UCBrowser.exe
(UCWeb Inc.) C:\Program Files (x86)\UCBrowser\Application\UCBrowser.exe
(UCWeb Inc.) C:\Program Files (x86)\UCBrowser\Application\UCBrowser.exe
(UCWeb Inc.) C:\Program Files (x86)\UCBrowser\Application\UCBrowser.exe
(UCWeb Inc.) C:\Program Files (x86)\UCBrowser\Application\UCBrowser.exe
(UCWeb Inc.) C:\Program Files (x86)\UCBrowser\Application\UCBrowser.exe
(UCWeb Inc.) C:\Program Files (x86)\UCBrowser\Application\UCBrowser.exe
(UCWeb Inc.) C:\Program Files (x86)\UCBrowser\Application\UCBrowser.exe
(UCWeb Inc.) C:\Program Files (x86)\UCBrowser\Application\UCBrowser.exe
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_17.313.10010.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
(UCWeb Inc.) C:\Program Files (x86)\UCBrowser\Application\UCBrowser.exe
(UCWeb Inc.) C:\Program Files (x86)\UCBrowser\Application\UCBrowser.exe
(UCWeb Inc.) C:\Program Files (x86)\UCBrowser\Application\UCBrowser.exe
(UCWeb Inc.) C:\Program Files (x86)\UCBrowser\Application\UCBrowser.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [629152 2017-03-18] (Microsoft Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [558496 2014-02-27] (Adobe Systems Incorporated)
HKLM\...\Run: [gplyra] => C:\Users\Kuncavia\AppData\Roaming\gplyra\gplyra\start.cmd [216 2017-01-10] ()
HKLM-x32\...\Run: [Razer Synapse] => C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe [596640 2017-03-02] (Razer Inc.)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-1400939329-2555203986-2462190200-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3019552 2017-03-23] (Valve Corporation)
HKU\S-1-5-21-1400939329-2555203986-2462190200-1001\...\Run: [DAEMON Tools Lite Automount] => D:\Program Files (x86)\DAEMON Tools Lite\DTAgent.exe [4701888 2016-12-22] (Disc Soft Ltd)
HKU\S-1-5-21-1400939329-2555203986-2462190200-1001\...\Run: [Pritc] => C:\Users\Kuncavia\AppData\Local\Temp\is-G038A.tmp\Setup.exe [1431040 2017-04-21] (Setup) <===== ATTENTION
HKU\S-1-5-21-1400939329-2555203986-2462190200-1001\...\Run: [msiql] => C:\Users\Kuncavia\AppData\Local\Temp\00023036\msiql.exe [2072064 2017-04-23] () <===== ATTENTION
HKU\S-1-5-21-1400939329-2555203986-2462190200-1001\...\Run: [svchost0] => "C:\Program Files (x86)\UCBrowser\Application\UCBrowser.exe"\UUC0789.exe
HKU\S-1-5-21-1400939329-2555203986-2462190200-1001\...\Run: [apphide] => C:\Program Files (x86)\lll\uc.exe [176128 2017-04-22] (Unauthorized copy)
IFEO\SppExtComObj.exe: [Debugger] SppExtComObjPatcher.exe
ShellExecuteHooks: No Name - {5F51FFFE-7463-4220-B711-E5B9ACB8EDFE} - C:\ProgramData\igfxDH.dll [1032192 2017-04-20] ()
ShellIconOverlayIdentifiers: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => D:\Program Files (x86)\Office16\GROOVEEX.DLL [2016-06-15] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => D:\Program Files (x86)\Office16\GROOVEEX.DLL [2016-06-15] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => D:\Program Files (x86)\Office16\GROOVEEX.DLL [2016-06-15] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{9237b0bd-1bf5-42d4-bd43-41e4d4e02739}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\S-1-5-21-1400939329-2555203986-2462190200-1001\Software\Microsoft\Internet Explorer\Main,Start Page = 
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> D:\Program Files (x86)\Office16\OCHelper.dll [2016-07-12] (Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> D:\Program Files (x86)\Office16\GROOVEEX.DLL [2016-06-15] (Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office16\OCHelper.dll [2015-07-31] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\ssv.dll [2016-10-27] (Oracle Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office16\GROOVEEX.DLL [2016-06-15] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\jp2ssv.dll [2016-10-27] (Oracle Corporation)
Handler: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - D:\Program Files (x86)\Office16\MSOSB.DLL [2016-06-14] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2016-06-14] (Microsoft Corporation)
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - D:\Program Files (x86)\Office16\MSOSB.DLL [2016-06-14] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2016-06-14] (Microsoft Corporation)

Edge: 
======
Edge HomeButtonPage: HKU\S-1-5-21-1400939329-2555203986-2462190200-1001 -> hxxp://www.google.com

FireFox:
========
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> D:\Program Files (x86)\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2014-04-29] (Adobe Systems)
FF Plugin-x32: @java.com/DTPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\dtplugin\npDeployJava1.dll [2016-10-27] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\plugin2\npjp2.dll [2016-10-27] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-07-12] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll [2013-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2016-12-29] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2016-12-29] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.3\npGoogleUpdate3.dll [2017-04-11] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.3\npGoogleUpdate3.dll [2017-04-11] (Google Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2014-04-29] (Adobe Systems)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2016-07-12] (Microsoft Corporation)

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.msn.com/?pc=UP97&ocid=UP97DHP
CHR StartupUrls: Default -> "hxxp://www.delta-homes.com/?type=hp&ts=1432154289&z=307ceb3f219562f7502f7d4g2z0c5o1g3wczcoebcq&from=wpm05203&uid=ST31000524AS_5VPA2KTPXXXX5VPA2KTP","hxxp://www.youndoo.com/?z=915179240d88490a1114960gfz0bfbez5b6qcc8q5e&from=amz&uid=ST2000DM001-1ER164_W4Z1764SXXXXW4Z1764S&type=hp"
CHR Profile: C:\Users\Kuncavia\AppData\Local\Google\Chrome\User Data\Default [2017-04-24]
CHR Extension: (Google Slides) - C:\Users\Kuncavia\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-03-05]
CHR Extension: (Google Docs) - C:\Users\Kuncavia\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-03-05]
CHR Extension: (Google Drive) - C:\Users\Kuncavia\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-03-05]
CHR Extension: (YouTube) - C:\Users\Kuncavia\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-03-05]
CHR Extension: (Video Downloader professional) - C:\Users\Kuncavia\AppData\Local\Google\Chrome\User Data\Default\Extensions\elicpjhcidhpjomhibiffojpinpmmpil [2017-03-05]
CHR Extension: (Photo Zoom for Facebook) - C:\Users\Kuncavia\AppData\Local\Google\Chrome\User Data\Default\Extensions\elioihkkcdgakfbahdoddophfngopipi [2017-03-05]
CHR Extension: (Google Sheets) - C:\Users\Kuncavia\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-03-05]
CHR Extension: (Facebook™ Chat Privacy) - C:\Users\Kuncavia\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfpgaanechfneiboempkfjghninbibjn [2017-03-05]
CHR Extension: (Google Docs Offline) - C:\Users\Kuncavia\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-03-05]
CHR Extension: (Avast Online Security) - C:\Users\Kuncavia\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2017-04-14]
CHR Extension: (anonymoX) - C:\Users\Kuncavia\AppData\Local\Google\Chrome\User Data\Default\Extensions\icpklikeghomkemdellmmkoifgfbakio [2017-03-05]
CHR Extension: (Ghostery) - C:\Users\Kuncavia\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlomiejdfkolichcflejclcbmpeaniij [2017-03-05]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Kuncavia\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-09]
CHR Extension: (Gmail) - C:\Users\Kuncavia\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-03-05]
CHR Extension: (Chrome Media Router) - C:\Users\Kuncavia\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-04-14]
HKU\S-1-5-21-1400939329-2555203986-2462190200-1001\...\StartMenuInternet\ChromeHTML: -> C:\Program Files (x86)\Legass\Application\chrome.exe <==== ATTENTION

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 Disc Soft Lite Bus Service; D:\Program Files (x86)\DAEMON Tools Lite\DiscSoftBusServiceLite.exe [1471168 2016-12-22] (Disc Soft Ltd)
R2 GoogleChromeUpService; C:\ProgramData\service.exe [1620992 2017-04-23] () [File not signed] <==== ATTENTION
R2 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [458176 2016-12-29] (NVIDIA Corporation)
R2 Razer Game Scanner Service; C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [189264 2016-09-25] ()
R2 RzSurroundVADStreamingService; C:\ProgramData\Razer\Synapse\Devices\Razer Surround\Driver\RzSurroundVADStreamingService.exe [4261344 2016-11-04] (Razer Inc)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [3913064 2017-03-19] (Microsoft Corporation)
R2 TeamViewer; D:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [10351856 2016-12-15] (TeamViewer GmbH)
S3 VSStandardCollectorService140; C:\Program Files (x86)\Microsoft Visual Studio 14.0\Team Tools\DiagnosticsHub\Collector\StandardCollector.Service.exe [108776 2016-09-06] (Microsoft Corporation)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [342264 2017-03-18] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [102816 2017-03-18] (Microsoft Corporation)
S3 wlpasvc; C:\WINDOWS\System32\lpasvc.dll [1295360 2017-03-18] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 cryptfd; C:\WINDOWS\System32\drivers\cryptfd.sys [193448 2017-03-03] ()
R3 dtlitescsibus; C:\WINDOWS\System32\drivers\dtlitescsibus.sys [30264 2016-10-31] (Disc Soft Ltd)
R3 dtliteusbbus; C:\WINDOWS\System32\drivers\dtliteusbbus.sys [47672 2017-01-19] (Disc Soft Ltd)
S3 iaLPSS2i_GPIO2_BXT_P; C:\WINDOWS\System32\drivers\iaLPSS2i_GPIO2_BXT_P.sys [85504 2017-03-18] (Intel Corporation)
S3 iaLPSS2i_I2C_BXT_P; C:\WINDOWS\System32\drivers\iaLPSS2i_I2C_BXT_P.sys [168448 2017-03-18] (Intel Corporation)
R3 nvlddmkm; C:\WINDOWS\System32\DriverStore\FileRepository\nv_dispiwu.inf_amd64_b67dc924fff8de6d\nvlddmkm.sys [14199224 2017-01-04] (NVIDIA Corporation)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [604160 2017-03-18] (Realtek                                            )
R2 rzpmgrk; C:\WINDOWS\system32\drivers\rzpmgrk.sys [44144 2016-09-17] (Razer, Inc.)
R2 rzpnk; C:\WINDOWS\system32\drivers\rzpnk.sys [137840 2016-09-07] (Razer, Inc.)
R3 RZSURROUNDVADService; C:\WINDOWS\system32\drivers\RzSurroundVAD.sys [49176 2016-10-16] (Windows (R) Win 7 DDK provider)
S3 SDFRd; C:\WINDOWS\System32\drivers\SDFRd.sys [31128 2017-03-18] ()
R3 SensorsSimulatorDriver; C:\WINDOWS\System32\drivers\WUDFRd.sys [220672 2017-03-18] (Microsoft Corporation)
R1 ucdrv; C:\Program Files (x86)\UCBrowser\Security:ucdrv-x64.sys [25444 ] (UC Web Inc.) <==== ATTENTION
R1 VBoxNetAdp; C:\WINDOWS\system32\DRIVERS\VBoxNetAdp6.sys [132120 2016-10-18] (Oracle Corporation)
R1 VBoxNetLwf; C:\WINDOWS\system32\DRIVERS\VBoxNetLwf.sys [206416 2016-10-18] (Oracle Corporation)
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44632 2017-03-18] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [294816 2017-03-18] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [121248 2017-03-18] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

NETSVCx32: TokenBroker -> C:\Windows\SysWOW64\TokenBroker.dll (Microsoft Corporation)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-04-23 19:16 - 2017-04-23 19:17 - 00000000 ____D C:\Users\Kuncavia\AppData\Roaming\Geek Uninstaller
2017-04-23 18:14 - 2017-04-24 07:43 - 00000000 ____D C:\FRST
2017-04-23 18:12 - 2017-04-23 18:12 - 00000000 ___HD C:\OneDriveTemp
2017-04-23 17:58 - 2017-04-23 18:11 - 00001617 _____ C:\Users\Kuncavia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\UC浏览器.lnk
2017-04-23 17:58 - 2017-04-23 18:11 - 00000000 ____D C:\Users\Kuncavia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\UC浏览器
2017-04-23 17:57 - 2017-04-24 07:32 - 00002744 _____ C:\WINDOWS\System32\Tasks\UCBrowserUpdaterCore
2017-04-23 17:57 - 2017-04-24 07:32 - 00000330 _____ C:\WINDOWS\Tasks\UCBrowserUpdaterCore.job
2017-04-23 17:57 - 2017-04-23 18:10 - 00000494 _____ C:\WINDOWS\Tasks\UCBrowserUpdater.job
2017-04-23 17:57 - 2017-04-23 18:09 - 00003476 _____ C:\WINDOWS\System32\Tasks\UCBrowserSecureUpdater
2017-04-23 17:57 - 2017-04-23 18:09 - 00000000 ____D C:\Program Files (x86)\UCBrowser
2017-04-23 17:57 - 2017-04-23 17:57 - 00003518 _____ C:\WINDOWS\System32\Tasks\UCBrowserUpdater
2017-04-23 17:57 - 2017-04-23 17:57 - 00000000 __SHD C:\Users\Kuncavia\AppData\Local\svchost
2017-04-23 17:57 - 2017-04-23 17:57 - 00000000 __SHD C:\Users\Kuncavia\AppData\Local\kemgadeojglibflomicgnfeopkdfflnw
2017-04-23 17:57 - 2017-04-23 17:57 - 00000000 ____D C:\Users\Kuncavia\AppData\Local\UCBrowser
2017-04-23 17:57 - 2017-04-20 21:59 - 01032192 ___SH C:\ProgramData\igfxDH.dll
2017-04-23 17:56 - 2017-04-23 18:11 - 00003662 _____ C:\WINDOWS\System32\Tasks\CreateExplorerShellUnelevatedTask
2017-04-23 17:56 - 2017-04-23 17:56 - 01620992 _____ C:\ProgramData\service.exe
2017-04-23 17:56 - 2017-04-23 17:56 - 00003070 _____ C:\WINDOWS\System32\Tasks\Pritc
2017-04-23 17:56 - 2017-04-23 17:56 - 00000000 ____D C:\Users\Kuncavia\AppData\Roaming\UCChannel
2017-04-23 17:56 - 2017-04-23 17:56 - 00000000 ____D C:\Users\Kuncavia\AppData\Roaming\gplyra
2017-04-23 17:56 - 2017-04-23 17:56 - 00000000 ____D C:\Program Files (x86)\lll
2017-04-23 17:55 - 2017-04-23 17:55 - 00140288 _____ C:\Users\Kuncavia\AppData\Roaming\Installer.dat
2017-04-23 17:55 - 2017-04-23 17:55 - 00011568 _____ C:\Users\Kuncavia\AppData\Roaming\InstallationConfiguration.xml
2017-04-22 00:41 - 2017-04-22 00:41 - 00000000 ____D C:\Users\Kuncavia\AppData\Local\DBG
2017-04-19 18:50 - 2017-04-19 18:50 - 00000000 ____D C:\ProgramData\Microsoft OneDrive
2017-04-19 18:48 - 2017-04-19 18:48 - 00000020 ___SH C:\Users\Kuncavia\ntuser.ini
2017-04-19 11:24 - 2017-04-19 11:24 - 23680512 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 23675392 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 20505600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 19334144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 12787200 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 11869696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 08319392 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2017-04-19 11:24 - 2017-04-19 11:24 - 08247296 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 07904784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 06756920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 06296064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 05477088 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneCoreUAPCommonProxyStub.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 03672064 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2017-04-19 11:24 - 2017-04-19 11:24 - 02957824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2017-04-19 11:24 - 2017-04-19 11:24 - 02444184 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2017-04-19 11:24 - 2017-04-19 11:24 - 02085280 _____ (Microsoft Corporation) C:\WINDOWS\system32\UpdateAgent.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 01760264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 01657344 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsPrint.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 01605632 _____ (Microsoft Corporation) C:\WINDOWS\system32\quartz.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 01604312 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 01518088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 01506816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\quartz.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 01411640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 01356800 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 01323880 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 01147296 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2017-04-19 11:24 - 2017-04-19 11:24 - 01060352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsPrint.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 01024416 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2017-04-19 11:24 - 2017-04-19 11:24 - 00986592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00805376 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieproxy.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00750560 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2017-04-19 11:24 - 2017-04-19 11:24 - 00626520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2017-04-19 11:24 - 2017-04-19 11:24 - 00624640 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00545792 _____ (Microsoft Corporation) C:\WINDOWS\system32\winspool.drv
2017-04-19 11:24 - 2017-04-19 11:24 - 00433664 _____ (Microsoft Corporation) C:\WINDOWS\system32\msIso.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00429568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winspool.drv
2017-04-19 11:24 - 2017-04-19 11:24 - 00409504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2017-04-19 11:24 - 2017-04-19 11:24 - 00382368 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00364032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00357888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieproxy.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00354360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcryptprimitives.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00347136 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsDocumentTargetPrint.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00311192 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00252928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsDocumentTargetPrint.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00205728 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00119296 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataTimeUtil.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00094720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataTimeUtil.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmjpegdec.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00087552 _____ (Microsoft Corporation) C:\WINDOWS\system32\asycfilt.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00081408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmjpegdec.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00078336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\asycfilt.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00047104 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00038912 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2017-04-19 11:24 - 2017-04-19 11:24 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\BasicRender.sys
2017-04-19 11:24 - 2017-04-19 11:24 - 00032004 _____ C:\WINDOWS\system32\edgehtmlpluginpolicy.bin
2017-04-19 11:24 - 2017-04-19 11:24 - 00000000 ____D C:\Windows.old
2017-04-19 11:23 - 2017-04-19 11:23 - 00543648 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe
2017-04-19 11:23 - 2017-04-19 11:23 - 00388000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS
2017-04-19 11:23 - 2017-03-18 09:48 - 00094720 _____ (Microsoft Corporation) C:\WINDOWS\system32\DxToolsReportGenerator.dll
2017-04-19 11:23 - 2017-03-18 09:08 - 17777152 _____ (Microsoft Corporation) C:\WINDOWS\system32\DXCaptureReplay.dll
2017-04-19 11:23 - 2017-03-18 09:05 - 00094720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DxToolsReportGenerator.dll
2017-04-19 11:23 - 2017-03-18 09:02 - 00393216 _____ (Windows (R) Win 7 DDK provider) C:\WINDOWS\system32\DXCpl.exe
2017-04-19 11:23 - 2017-03-18 08:59 - 04164608 _____ (Microsoft Corporation) C:\WINDOWS\system32\NlsLexicons0002.dll
2017-04-19 11:23 - 2017-03-18 08:59 - 00091136 _____ (Microsoft Corporation) C:\WINDOWS\system32\VsGraphicsProxyStub.dll
2017-04-19 11:23 - 2017-03-18 08:59 - 00079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\VSD3DWARP12Debug.dll
2017-04-19 11:23 - 2017-03-18 08:57 - 00059392 _____ (Microsoft Corporation) C:\WINDOWS\system32\VSD3DWARPDebug.dll
2017-04-19 11:23 - 2017-03-18 08:55 - 00164864 _____ (Microsoft Corporation) C:\WINDOWS\system32\NlsData0002.dll
2017-04-19 11:23 - 2017-03-18 08:54 - 01914368 _____ (Microsoft Corporation) C:\WINDOWS\system32\MLS2.dll
2017-04-19 11:23 - 2017-03-18 08:53 - 00334848 _____ (Microsoft Corporation) C:\WINDOWS\system32\DXGIDebug.dll
2017-04-19 11:23 - 2017-03-18 08:52 - 04897280 _____ (Microsoft Corporation) C:\WINDOWS\system32\VsGraphicsRemoteEngine.exe
2017-04-19 11:23 - 2017-03-18 08:51 - 05776384 _____ (Microsoft Corporation) C:\WINDOWS\system32\VsGraphicsDesktopEngine.exe
2017-04-19 11:23 - 2017-03-18 08:49 - 01309184 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11_3SDKLayers.dll
2017-04-19 11:23 - 2017-03-18 08:49 - 00498176 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1debug3.dll
2017-04-19 11:23 - 2017-03-18 08:48 - 13785600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DXCaptureReplay.dll
2017-04-19 11:23 - 2017-03-18 08:47 - 06806016 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d12warp.dll
2017-04-19 11:23 - 2017-03-18 08:46 - 02617344 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d12SDKLayers.dll
2017-04-19 11:23 - 2017-03-18 08:46 - 00370176 _____ (Windows (R) Win 7 DDK provider) C:\WINDOWS\SysWOW64\DXCpl.exe
2017-04-19 11:23 - 2017-03-18 08:44 - 01977344 _____ (Microsoft Corporation) C:\WINDOWS\system32\DXToolsOfflineAnalysis.dll
2017-04-19 11:23 - 2017-03-18 08:44 - 01174528 _____ (Microsoft Corporation) C:\WINDOWS\system32\DXCap.exe
2017-04-19 11:23 - 2017-03-18 08:44 - 00283648 _____ (Microsoft Corporation) C:\WINDOWS\system32\VsGraphicsExperiment.dll
2017-04-19 11:23 - 2017-03-18 08:44 - 00163328 _____ (Microsoft Corporation) C:\WINDOWS\system32\VsGraphicsCapture.dll
2017-04-19 11:23 - 2017-03-18 08:43 - 04164608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NlsLexicons0002.dll
2017-04-19 11:23 - 2017-03-18 08:43 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\system32\DXToolsMonitor.dll
2017-04-19 11:23 - 2017-03-18 08:43 - 00176128 _____ (Microsoft Corporation) C:\WINDOWS\system32\DXToolsReporting.dll
2017-04-19 11:23 - 2017-03-18 08:43 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VSD3DWARP12Debug.dll
2017-04-19 11:23 - 2017-03-18 08:43 - 00041984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VsGraphicsProxyStub.dll
2017-04-19 11:23 - 2017-03-18 08:41 - 00058880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VSD3DWARPDebug.dll
2017-04-19 11:23 - 2017-03-18 08:40 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NlsData0002.dll
2017-04-19 11:23 - 2017-03-18 08:39 - 01868288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MLS2.dll
2017-04-19 11:23 - 2017-03-18 08:39 - 00236544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DXGIDebug.dll
2017-04-19 11:23 - 2017-03-18 08:38 - 00348672 _____ (Microsoft Corporation) C:\WINDOWS\system32\perf_gputiming.dll
2017-04-19 11:23 - 2017-03-18 08:36 - 04544000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VsGraphicsDesktopEngine.exe
2017-04-19 11:23 - 2017-03-18 08:35 - 01060864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11_3SDKLayers.dll
2017-04-19 11:23 - 2017-03-18 08:35 - 00430080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1debug3.dll
2017-04-19 11:23 - 2017-03-18 08:33 - 05141504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d12warp.dll
2017-04-19 11:23 - 2017-03-18 08:33 - 03648000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VsGraphicsRemoteEngine.exe
2017-04-19 11:23 - 2017-03-18 08:32 - 02102272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d12SDKLayers.dll
2017-04-19 11:23 - 2017-03-18 08:30 - 01480704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DXToolsOfflineAnalysis.dll
2017-04-19 11:23 - 2017-03-18 08:30 - 00926208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DXCap.exe
2017-04-19 11:23 - 2017-03-18 08:30 - 00220160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VsGraphicsExperiment.dll
2017-04-19 11:23 - 2017-03-18 08:30 - 00123904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VsGraphicsCapture.dll
2017-04-19 11:23 - 2017-03-18 08:29 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DXToolsMonitor.dll
2017-04-19 11:23 - 2017-03-18 08:29 - 00121344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DXToolsReporting.dll
2017-04-19 11:23 - 2017-03-18 08:25 - 00269824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\perf_gputiming.dll
2017-04-19 11:22 - 2017-04-19 11:22 - 00008192 _____ C:\WINDOWS\system32\config\userdiff
2017-04-19 11:22 - 2017-04-19 11:22 - 00000000 ____D C:\Program Files\Reference Assemblies
2017-04-19 11:22 - 2017-04-19 11:22 - 00000000 ____D C:\Program Files\MSBuild
2017-04-19 11:22 - 2017-04-19 11:22 - 00000000 ____D C:\Program Files (x86)\Reference Assemblies
2017-04-19 11:22 - 2017-04-19 00:29 - 00000000 ____D C:\Program Files (x86)\MSBuild
2017-04-19 11:22 - 2017-04-19 00:26 - 00000000 ____D C:\WINDOWS\ServiceProfiles
2017-04-19 11:21 - 2017-02-10 22:26 - 01166520 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationNative_v0300.dll
2017-04-19 11:21 - 2017-02-10 22:26 - 00124624 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2017-04-19 11:21 - 2017-02-10 22:26 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe
2017-04-19 11:21 - 2017-02-10 22:21 - 00778936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationNative_v0300.dll
2017-04-19 11:21 - 2017-02-10 22:21 - 00103120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2017-04-19 11:21 - 2017-02-10 22:21 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe
2017-04-19 00:45 - 2017-04-19 00:45 - 00000000 ____D C:\ProgramData\USOShared
2017-04-19 00:38 - 2017-04-19 00:38 - 00000000 _SHDL C:\Users\Default\My Documents
2017-04-19 00:37 - 2017-04-19 00:37 - 00007623 _____ C:\WINDOWS\diagwrn.xml
2017-04-19 00:37 - 2017-04-19 00:37 - 00007623 _____ C:\WINDOWS\diagerr.xml
2017-04-19 00:36 - 2017-04-24 02:27 - 00004174 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{53F05FE1-2F08-40FE-8B7B-BBF7E672BC99}
2017-04-19 00:36 - 2017-04-23 18:10 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-04-19 00:36 - 2017-04-19 18:50 - 00003296 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task v2
2017-04-19 00:36 - 2017-04-19 00:36 - 00003444 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2017-04-19 00:36 - 2017-04-19 00:36 - 00003220 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2017-04-19 00:36 - 2017-04-19 00:36 - 00000000 ____D C:\WINDOWS\System32\Tasks\OfficeSoftwareProtectionPlatform
2017-04-19 00:34 - 2017-04-19 00:34 - 00001576 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2017-04-19 00:28 - 2017-04-19 00:34 - 00000000 ____D C:\WINDOWS\system32\config\bbimigrate
2017-04-19 00:28 - 2017-03-18 23:56 - 02233344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2017-04-19 00:27 - 2017-04-23 18:16 - 00990826 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-04-19 00:27 - 2017-04-23 18:11 - 00000000 ____D C:\Users\Kuncavia
2017-04-19 00:27 - 2017-04-19 00:29 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2017-04-19 00:27 - 2017-04-19 00:29 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2017-04-19 00:27 - 2017-04-19 00:29 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2017-04-19 00:27 - 2017-04-19 00:27 - 00939752 _____ C:\WINDOWS\SysWOW64\PerfStringBackup.INI
2017-04-19 00:27 - 2017-04-19 00:27 - 00000000 _SHDL C:\Users\Kuncavia\My Documents
2017-04-19 00:27 - 2016-12-29 15:44 - 06386232 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcpl.dll
2017-04-19 00:27 - 2016-12-29 15:44 - 02477624 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvsvc64.dll
2017-04-19 00:27 - 2016-12-29 15:44 - 01762752 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvsvcr.dll
2017-04-19 00:27 - 2016-12-29 15:44 - 00546752 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nv3dappshext.dll
2017-04-19 00:27 - 2016-12-29 15:44 - 00392128 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvmctray.dll
2017-04-19 00:27 - 2016-12-29 15:44 - 00083512 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nv3dappshextr.dll
2017-04-19 00:27 - 2016-12-29 15:44 - 00069568 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvshext.dll
2017-04-19 00:27 - 2016-12-19 10:26 - 07651057 _____ C:\WINDOWS\system32\nvcoproc.bin
2017-04-19 00:26 - 2017-04-24 07:27 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2017-04-19 00:26 - 2017-04-23 18:10 - 00392968 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2017-04-18 18:53 - 2017-04-18 18:53 - 00000000 ____D C:\Users\Kuncavia\AppData\LocalLow\CipciuGames
2017-04-18 18:27 - 2017-04-18 18:27 - 00000000 ____D C:\Users\Kuncavia\AppData\LocalLow\Ripened Peach Entertainment
2017-04-18 08:15 - 2017-04-19 18:48 - 00000000 ___DC C:\WINDOWS\Panther
2017-04-14 23:28 - 2017-04-14 23:28 - 00000000 ____D C:\Users\Kuncavia\AppData\Local\Kalyskah_RPG
2017-04-14 08:37 - 2017-04-14 08:37 - 00000000 ____D C:\Users\Kuncavia\AppData\Local\UNP
2017-04-14 08:31 - 2017-04-19 00:34 - 00000000 ____D C:\WINDOWS\system32\UNP
2017-04-14 08:31 - 2017-04-14 08:32 - 00000000 ____D C:\Program Files\UNP
2017-04-12 17:21 - 2017-03-28 08:37 - 00031232 _____ (Microsoft Corporation) C:\WINDOWS\system32\DdcWnsListener.dll
2017-04-12 17:21 - 2017-03-28 08:28 - 00261632 _____ (Microsoft Corporation) C:\WINDOWS\system32\indexeddbserver.dll
2017-04-04 15:29 - 2017-04-19 00:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2017-04-04 15:29 - 2017-04-04 15:29 - 00000000 ___RD C:\Program Files (x86)\Skype
2017-04-02 08:15 - 2017-04-02 08:15 - 00087904 _____ (Microsoft Corporation) C:\WINDOWS\system32\UNPUXWorker.exe
2017-03-29 19:44 - 2017-03-29 19:44 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-03-29 19:42 - 2017-04-19 00:34 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2016 Tools
2017-03-29 19:42 - 2017-03-29 19:42 - 00002729 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook 2016.lnk
2017-03-29 19:42 - 2017-03-29 19:42 - 00002662 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneDrive for Business.lnk
2017-03-29 19:42 - 2017-03-29 19:42 - 00002656 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Word 2016.lnk
2017-03-29 19:42 - 2017-03-29 19:42 - 00002656 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype for Business 2016.lnk
2017-03-29 19:42 - 2017-03-29 19:42 - 00002656 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access 2016.lnk
2017-03-29 19:42 - 2017-03-29 19:42 - 00002648 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneNote 2016.lnk
2017-03-29 19:42 - 2017-03-29 19:42 - 00002648 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel 2016.lnk
2017-03-29 19:42 - 2017-03-29 19:42 - 00002642 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerPoint 2016.lnk
2017-03-29 19:42 - 2017-03-29 19:42 - 00002628 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Publisher 2016.lnk
2017-03-29 19:41 - 2017-03-29 19:41 - 00000000 ____D C:\Program Files\Common Files\DESIGNER
2017-03-29 19:40 - 2017-03-29 19:40 - 00000000 ____D C:\Program Files\Microsoft Analysis Services
2017-03-29 19:40 - 2017-03-29 19:40 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2017-03-29 19:40 - 2017-03-29 19:40 - 00000000 ____D C:\Program Files (x86)\Microsoft Analysis Services
2017-03-27 18:42 - 2017-03-27 19:58 - 00000000 ____D C:\Users\Kuncavia\AppData\Local\tyranoscript

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-04-24 07:41 - 2016-10-26 11:34 - 00000000 _____ C:\WINDOWS\system32\RzSurroundVADAudioDeviceManager_log.txt
2017-04-24 07:39 - 2016-10-20 18:29 - 00000000 ____D C:\Users\Kuncavia\AppData\Roaming\Skype
2017-04-24 04:37 - 2017-03-19 00:01 - 00000000 ____D C:\WINDOWS\INF
2017-04-23 20:19 - 2016-10-19 19:21 - 00000000 ____D C:\Program Files (x86)\Steam
2017-04-23 18:12 - 2016-10-19 14:02 - 00000000 ___RD C:\Users\Kuncavia\OneDrive
2017-04-23 18:10 - 2017-03-18 14:40 - 00786432 _____ C:\WINDOWS\system32\config\BBI
2017-04-23 18:10 - 2016-12-11 13:44 - 00000000 ____D C:\Users\Kuncavia\AppData\Roaming\uTorrent
2017-04-23 18:10 - 2016-10-24 03:50 - 00000000 ____D C:\ProgramData\NVIDIA
2017-04-23 13:27 - 2017-03-19 00:03 - 00000000 ___HD C:\Program Files\WindowsApps
2017-04-23 13:27 - 2017-03-19 00:03 - 00000000 ____D C:\WINDOWS\AppReadiness
2017-04-21 23:05 - 2016-10-27 18:32 - 00000000 ____D C:\Users\Kuncavia\AppData\Roaming\RenPy
2017-04-20 04:58 - 2017-03-19 00:03 - 00000000 ____D C:\WINDOWS\appcompat
2017-04-19 19:40 - 2017-03-18 23:51 - 00000000 ____D C:\WINDOWS\CbsTemp
2017-04-19 19:05 - 2016-10-19 14:01 - 00000000 ____D C:\Users\Kuncavia\AppData\Local\Packages
2017-04-19 18:50 - 2016-10-24 07:33 - 00000000 ____D C:\Users\Kuncavia\AppData\Local\ConnectedDevicesPlatform
2017-04-19 18:50 - 2016-10-19 14:02 - 00002376 _____ C:\Users\Kuncavia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2017-04-19 18:48 - 2017-03-19 00:03 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2017-04-19 18:48 - 2016-11-15 18:12 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 11.0
2017-04-19 18:48 - 2016-11-15 18:05 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 12.0
2017-04-19 18:48 - 2016-11-15 18:03 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 14.0
2017-04-19 18:48 - 2016-10-19 14:01 - 00000000 __RHD C:\Users\Public\AccountPictures
2017-04-19 11:25 - 2017-03-19 00:03 - 00028672 _____ C:\WINDOWS\system32\config\BCD-Template
2017-04-19 11:24 - 2017-03-19 00:06 - 00000000 ____D C:\WINDOWS\Setup
2017-04-19 11:23 - 2017-03-19 05:30 - 00000000 ____D C:\WINDOWS\OCR
2017-04-19 00:45 - 2017-03-19 00:03 - 00000000 ____D C:\ProgramData\USOPrivate
2017-04-19 00:39 - 2017-03-19 00:03 - 00000000 ____D C:\WINDOWS\rescache
2017-04-19 00:38 - 2017-03-19 00:03 - 00000000 ____D C:\WINDOWS\system32\WinBioDatabase
2017-04-19 00:37 - 2017-03-19 00:03 - 00000000 ____D C:\WINDOWS\Registration
2017-04-19 00:37 - 2017-03-19 00:03 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2017-04-19 00:37 - 2017-03-18 14:40 - 00032768 _____ C:\WINDOWS\system32\config\ELAM
2017-04-19 00:37 - 2017-03-03 00:30 - 00002272 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-04-19 00:37 - 2016-07-16 14:47 - 00000000 ____D C:\WINDOWS\system32\Tasks_Migrated
2017-04-19 00:36 - 2017-03-19 05:31 - 00000000 ____D C:\WINDOWS\HoloShell
2017-04-19 00:36 - 2017-03-19 00:03 - 00000000 __RHD C:\Users\Public\Libraries
2017-04-19 00:36 - 2016-10-24 03:54 - 00022840 _____ C:\WINDOWS\system32\emptyregdb.dat
2017-04-19 00:34 - 2017-01-04 22:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOM
2017-04-19 00:34 - 2016-12-27 01:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoHotkey
2017-04-19 00:34 - 2016-12-03 00:00 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Second Life Viewer
2017-04-19 00:34 - 2016-11-15 18:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Python Tools for Visual Studio 2015
2017-04-19 00:34 - 2016-11-15 18:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2017-04-19 00:34 - 2016-11-15 18:04 - 00000000 ____D C:\WINDOWS\SysWOW64\1033
2017-04-19 00:34 - 2016-11-15 18:03 - 00000000 ____D C:\WINDOWS\system32\1033
2017-04-19 00:34 - 2016-11-07 21:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CC 2014
2017-04-19 00:34 - 2016-11-03 23:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOM Player
2017-04-19 00:34 - 2016-10-31 12:46 - 00000000 ____D C:\WINDOWS\SHELLNEW
2017-04-19 00:34 - 2016-10-27 18:30 - 00000000 ____D C:\Users\Kuncavia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2017-04-19 00:34 - 2016-10-27 18:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2017-04-19 00:34 - 2016-10-19 19:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2017-04-19 00:30 - 2017-03-19 00:03 - 00000000 ____D C:\WINDOWS\system32\spool
2017-04-19 00:30 - 2017-03-03 00:30 - 00000000 ____D C:\WINDOWS\system32\appmgmt
2017-04-19 00:29 - 2017-03-19 00:03 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2017-04-19 00:29 - 2017-03-19 00:03 - 00000000 ____D C:\Program Files\Common Files\System
2017-04-19 00:29 - 2017-03-19 00:03 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2017-04-19 00:29 - 2017-02-08 09:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2017-04-19 00:29 - 2017-01-19 19:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ILLUSION
2017-04-19 00:29 - 2016-11-15 18:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Expression
2017-04-19 00:29 - 2016-11-15 18:05 - 00000000 ____D C:\Program Files\IIS
2017-04-19 00:29 - 2016-11-15 18:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Visual Studio 2015
2017-04-19 00:29 - 2016-10-26 11:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razer
2017-04-19 00:28 - 2015-10-30 10:24 - 00000000 ___HD C:\WINDOWS\system32\GroupPolicy
2017-04-19 00:27 - 2017-03-19 00:03 - 00000000 ____D C:\WINDOWS\Help
2017-04-19 00:27 - 2017-03-18 14:40 - 00000000 ____D C:\WINDOWS\system32\Sysprep
2017-04-19 00:15 - 2017-03-19 06:20 - 00000000 ___HD C:\$WINDOWS.~BT
2017-04-17 22:34 - 2016-10-26 11:34 - 00000000 _____ C:\WINDOWS\SysWOW64\RzSurroundVADAudioDeviceManager_log.txt
2017-04-14 23:28 - 2016-10-27 20:02 - 00000000 ____D C:\Users\Kuncavia\AppData\Local\UnrealEngine
2017-04-12 19:32 - 2016-10-19 20:34 - 00000000 ____D C:\WINDOWS\system32\MRT
2017-04-12 19:30 - 2016-10-19 13:59 - 148601744 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2017-04-08 17:27 - 2016-10-19 14:00 - 00532136 _____ (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2017-04-04 15:29 - 2016-10-20 20:10 - 00000000 ____D C:\ProgramData\Skype
2017-04-03 19:56 - 2017-03-19 00:06 - 00835576 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2017-04-03 19:56 - 2017-03-19 00:06 - 00177656 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2017-03-29 19:40 - 2015-10-30 10:24 - 00000167 _____ C:\WINDOWS\win.ini
2017-03-29 19:33 - 2016-10-31 12:47 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2017-03-28 19:01 - 2017-03-01 20:34 - 00000000 ____D C:\Users\Kuncavia\AppData\Roaming\Thinstall
2017-03-25 22:29 - 2017-02-13 10:30 - 00000000 ____D C:\Users\Kuncavia\AppData\Local\CrashDumps

==================== Files in the root of some directories =======

2017-04-23 17:55 - 2017-04-23 17:55 - 0011568 _____ () C:\Users\Kuncavia\AppData\Roaming\InstallationConfiguration.xml
2017-04-23 17:55 - 2017-04-23 17:55 - 0140288 _____ () C:\Users\Kuncavia\AppData\Roaming\Installer.dat
2017-04-23 17:57 - 2017-04-20 21:59 - 1032192 ___SH () C:\ProgramData\igfxDH.dll
2017-04-23 17:56 - 2017-04-23 17:56 - 1620992 _____ () C:\ProgramData\service.exe

Files to move or delete:
====================
C:\Users\Kuncavia\AppData\Local\Temp\is-G038A.tmp\Setup.exe
C:\Users\Kuncavia\AppData\Local\Temp\00023036\msiql.exe
C:\ProgramData\igfxDH.dll
C:\ProgramData\service.exe

Some files in TEMP:
====================
2017-04-23 17:56 - 2017-04-23 17:57 - 51185040 _____ (UCWeb Inc.) C:\Users\Kuncavia\AppData\Local\Temp\Browser_V6.0.1471.913_f_4730_(Build1702151518).exe
2017-04-23 17:57 - 2017-04-23 17:57 - 1958888 _____ (深圳市史宾赛科技有限公司) C:\Users\Kuncavia\AppData\Local\Temp\FlowSpritSetup_slnt_5016.exe
2017-04-23 19:16 - 2017-04-23 19:16 - 3958296 _____ (Geek Unіnstaller) C:\Users\Kuncavia\AppData\Local\Temp\geek64.exe
2017-04-23 17:58 - 2017-04-23 17:58 - 2983626 _____ () C:\Users\Kuncavia\AppData\Local\Temp\MagicDiskSetup.exe
2017-04-23 17:58 - 2017-04-23 17:58 - 1006592 _____ (湖南七度网络科技有限公司) C:\Users\Kuncavia\AppData\Local\Temp\PSoft_4010_1.0.0.104_Setup.exe
2017-04-18 09:48 - 2017-04-18 09:48 - 2982680 _____ (Chengdu Xingju Infinite Technology Co.,Ltd.) C:\Users\Kuncavia\AppData\Local\Temp\setup.3.16.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-04-19 00:26

==================== End of FRST.txt ============================

Addition.txt

Здравейте.

Сега изтеглете fixlist.txt и го запазете на в папката, където сте свалили FRST64.exe. При вас е тук => D:\Users\Kuncavia\Downloads

Рестартирайте системата си в Safe Mode. Ето някои начини ако не знаете как да го направите:

http://www.technicalnotes.org/5-ways-to-boot-into-safe-mode-in-windows-10/

http://www.intowindows.com/5-ways-to-start-windows-10-in-safe-mode/

След като системата зареди в Safe Mode стартирайте FRST64.exe и натиснете бутона Fix веднъж!

След като приключи, ако ви поиска рестарт - съгласете се. След рестарта заредете отново в Normal Mode и публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.
 
Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

Пишете и как е положението след това.

Поздрави!

Здравейте,

Приложено изпращам filog-а. Бях предвидил TW за да го направя от работата, но рестарта в първа стъпка ме изненада

Fixlog.txt

Е няма как да се работи през TW освен ако не се сетне след рестарта да се използва същата парола и ID.

Дотук добре. Сега изтеглете fixlist.txt и го запазете на в папката, където сте свалили FRST64.exe. При вас е тук => D:\Users\Kuncavia\Downloads

Този път рестартиране в Safe Mode не е необходимо. Стартирайте FRST64.exe и натиснете бутона Fix веднъж!

След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.
 
Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

Пишете и как е положението след това.

Поздрави!

Акаунта е настроен да се логва автоматично на TW, но няма кой да въведе паролата на Windows 

Приложено изпращам лога. Още от предния fix, спря да се появява браузъра, миньора не се е включвал. Какъв им е смисъла да ме спамят с японско/китайски реклами, освен да дразнят, не ми е много ясно, но майнера си е добър удар. 

Fixlog.txt

Да, знам. С предния fix почистихме гадините + нежеланото приложение UCBrowser. Миньора няма как да стартира след като вече е премахнат. С новия fix оправяме други остатъчни поражения по Windows.

Сега е време да проверим за остатъци:

 

СТЪПКА 1

 

• Изтеглете и стартирайте AdwCleaner.exe
• Натиснете бутона Scan.
• AdwCleaner ще започне да проверява компютъра.
• След като проверката приключи натиснете бутона Clean.
• Програмата ще затвори всички излишни процеси и след почистването ще иска да рестартира машината. Съгласете се.
• Ще се появи автоматично лог файл с името (AdwCleaner[S0].txt и  AdwCleaner[С0].txt) в C:\Adwcleaner
• Публикувайте съдържанието на  AdwCleaner[С0].txt в следващия си коментар.

 

СТЪПКА 2

 

Моля изтеглете Malwarebytes Anti-Malware 2.2.1.1043 Final и я запазете на вашия десктоп.

• Стартирайте файла mbam-setup-2.2.1.1043.exe и следвайте указанията за да инсталирате програмата.
• След като инсталацията приключи се уверете че сте сложили отметка пред:
• Launch Malwarebytes Anti-Malware
• Отметката активираща пробния 14 дневен период също е маркиран по-подразбиране. Ако не желаете да тествате защитата в реално време на програмата през следващите 14 дни тогава премахнете отметката. Т.е. премахнете първата отметка:

• Натиснете бутона Finish.
• Отидете до табът Settings > Detection and Protection > и под категорията Detection Options включете опцията "Scan for rootkits".
• Отидете до табът Scan, сложете радио-бутона пред Threat Scan и след това натиснете бутона Scan Now >> . Ако е намерена актуализация тогава натиснете бутона Update Now.
• Ще започне проверка за зловреден софтуер.
• При някои инфекции можете да видите съобщението:
• "Could not load DDA driver"
• Натиснете "Yes" на това съобщение за да позволите драйвера да се зареди след рестарт.
• Разрешете на компютъра да се рестартира и след това продължете с останалите инструкции.
• След като проверката приключи натиснете бутона Apply Actions.
• Изчакайте да се появи прозореца подканващ ви да рестартирате и след това натиснете бутона Yes.
• След рестарта, когато се появи десктопа MBAM ще се зареди още веднъж.
• Отидете то табът History > Application Logs.

• Отворете рапорта с последната дата и час и натиснете бутона "Copy to Clipboard"
• Сега вече поставете съдържанието на лог файла с клавишната комбинация Ctrl + V и го публикувайте в следващия си коментар.

 

Поздрави!

С леко закъснение: 

 

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 26.04.2017
Scan Time: 18:34
Logfile: 
Administrator: Yes

Version: 2.2.1.1043
Malware Database: v2017.04.26.05
Rootkit Database: v2017.04.02.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 10
CPU: x64
File System: NTFS
User: Kuncavia

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 327644
Time Elapsed: 8 min, 59 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 3
Adware.Elex.SHHKRST, HKLM\SOFTWARE\CLASSES\CLSID\{5F51FFFE-7463-4220-B711-E5B9ACB8EDFE}, Quarantined, [703da84d9f091e18f3e16506b94757a9], 
PUP.Optional.BitCoinMiner, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\gplyra, Quarantined, [3f6ea3523276290d5d1ae82aac54c63a], 
PUP.Optional.160Wifi, HKLM\SOFTWARE\WOW6432NODE\DTLSOFT\160wifi, Quarantined, [9d1039bcecbc06304f49d5c7c04101ff], 

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)

(end)

AdwCleaner[C0].txt

Дотук добре.

Предпоследните стъпки са както следват:

 

СТЪПКА 1

 

1.Изтеглете Hitman Pro.

За 32-битова система - .
За 64-битова система -

2.Стартирайте програмата.
3.След като сте стартирали програмата като кликнете върху иконата и натиснете бутона „Напред“ като се съгласите с лицензионното споразумение (EULA).

4.Сложете отметка пред "Не, искам да завърша еднократно сканиране на компютъра".

5.Натиснете бутона „Напред“.

6.Програмата ще започне да сканира. Времето за сканиране е около 2 минути.

7.След завършване на сканирането от списъка с намерените неща (ако има такива) изберете Apply to all => Ignore.

8.Натиснете "Next" и след това натиснете "Изнеси резултата в XML file" и запазете лог файла на десктопа.

9.Архивирайте файла и го прикачете в следващия си коментар или копирайте съдържанието му в следващия си коментар.
 
Забележка: Ако няма падащо меню, където да изберете ignore както на снимката:
 

 
Тогава просто затворете програмата след края на проверката (без да премахвате нищо)...след това отворете C:\Programdata\HitmanPro\Logs, отворете и публикувайте съдържанието на лог файла в следващия си коментар. Пак повтарям, не трийте нищо с програмата, защото е доста мощна и може да бъде опасна!

Забележка: Папката C:\ProgramData е скрита и затова трябва да направите скритите файлове видими по-следния начин:

От My Computer => Tools => Folder Options => View:

Сложете отметка пред "Show hidden files, folders and drives"

и махнете отметката пред "Hide protected operating system files (recommended)".

Натиснете Apply.

Сега проверете за лог файла в папката C:\Programdata\HitmanPro\Logs и го прикачете в следващия си коментар.

 

СТЪПКА 2

 

• Моля изтеглете EmsisoftEmergencyKit, стартирайте exe файла и посочете къде да се разархивира програмата - например в (C:\EEK), натискайки бутона Extract.
• Стартирайте иконата на файла Start Emsisoft Emergency Kit от десктопа за да стартирате приложението.
• Натиснете бутона"Yes", когато бъдете подканени да обновите дефинициите на програмата.
• След като процеса по обновяването на дефинициите приключи натиснете бутона "Scan".
• Натиснете бутона "Yes", когато бъдете попитани дали да програмата да включи засичането на потенциално нежелани приложения (Potentially Unwanted Applications).
• Сега вече изберете бутона Custom Scan. Премахнете от списъка всички дялове без C:\ (т.е. нека да остане само дял C:\ в списъка).
• Натиснете Next за да започне проверката.
• Когато проверката приключи натиснете бутона View Report.
• Копирайте съдържанието на лог файла в следващия си коментар.

 

СТЪПКА 3

 

За финал искам да направим и една последна проверка за всеки случай:
 

• Моля изтеглете и стартирайте изпълнимия файл от линка: ESET Online Scanner
• Сложете отметката пред (ако опцията е налична) и натиснете бутона .

• Добре е да изключите вашата антивирусна преди началото на проверката. За да видите списъка с инсталираната от вас антивирусна програма, която трябва да изключите натиснете бутона .
• Ще се появи списък с инсталираната от вас антивирусна програма:

• Изключете антивирусната си програма.

• Сложете отметката пред: Enable detection of potentially unwanted applications.
• Сега кликнете на Advanced Settings и се уверете, че опцията Clean threats automatically не е маркирана, а следните са маркирани:

 

• Enable detection of potentially unsafe applications
• Enable detection of suspicious applications
• Scan archives
• Enable Anti-Stealth Technology

 

• Изберете сега бутона Change и поставете отметки пред следните обекти Operating memory, Autostart locations и дял C:\

• Натиснете бутона за да започне проверката.
• ESET ще започне да сваля и инсталира актуализации за вирусните дефиниции и след това ще започне да сканира компютъра. Бъдете търпеливи, защото процеса е бавен и може да отнеме доста време.

• След като проверката приключи списъка с намерените зарази ще се отвори автоматично (ако такива са намерени).

• Натиснете бутона и запазете файла на десктопа с име по избор като например (ESETScan.txt). Копирайте резултата в следващия си коментар.
• Натиснете бутона
• Сложете отметка пред за да почистите следите от приложението след затварянето му.
• Натиснете бутона  и след това затворете приложението от хикса в горния десен ъгъл.

 

Поздрави!

Изпитвате ли затруднение с изпълнението на стъпките?

Поздрави!

Маркирам случая като решен, защото проблема бе отстранен още след първия скрипт. Останалите стъпки бяха само за всеки случай.

Поздрави!

С огромно закъснение искам да благодаря за помощта. Много се радвам, че има хора като вас, които влизат в мъки, за да спестят мъките на другите.

Поздрави,