Съмнения за вирус

18 ноември 20178 г.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 18-11-2017
Ran by симо7 (administrator) on СИМО (18-11-2017 18:05:13)
Running from C:\Users\симо7\Desktop
Loaded Profiles: симо7 (Available Profiles: симо7)
Platform: Windows 8.1 Pro (Update) (X64) Language: Български (България)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe
(@ByELDI) C:\Program Files\KMSpico\Service_KMS.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Node.js) C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(BitTorrent Inc.) C:\Users\симо7\AppData\Roaming\uTorrent\uTorrent.exe
(BitTorrent Inc.) C:\Users\симо7\AppData\Roaming\uTorrent\updates\3.4.9_43388\utorrentie.exe
(BitTorrent Inc.) C:\Users\симо7\AppData\Roaming\uTorrent\updates\3.4.9_43388\utorrentie.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Innovative Digital Technologies) C:\Users\симо7\AppData\Roaming\ACEStream\player\ace_player.exe
(Innovative Digital Technologies) C:\Users\симо7\AppData\Roaming\ACEStream\engine\ace_engine.exe
(Innovative Digital Technologies) C:\Users\симо7\AppData\Roaming\ACEStream\engine\ace_engine.exe
() C:\Users\симо7\AppData\Roaming\ACEStream\updater\ace_update.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [253344 2017-11-10] (AVAST Software)
HKLM-x32\...\Run: [PowerDVD17Agent] => C:\Program Files (x86)\CyberLink\PowerDVD17\PowerDVD17Agent.exe [526376 2017-02-18] (CyberLink Corp.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-976013588-1774182616-1790962854-1001\...\Run: [uTorrent] => C:\Users\симо7\AppData\Roaming\uTorrent\uTorrent.exe [2405056 2017-03-18] (BitTorrent Inc.)
HKU\S-1-5-21-976013588-1774182616-1790962854-1001\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3672640 2013-03-14] (Disc Soft Ltd)
HKU\S-1-5-21-976013588-1774182616-1790962854-1001\...\Policies\Explorer: [NolowDiskSpaceChecks] 1
HKU\S-1-5-21-976013588-1774182616-1790962854-1001\...\MountPoints2: {2f40cbec-ac01-11e7-82a5-2cd4449354ae} - "H:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-976013588-1774182616-1790962854-1001\...\MountPoints2: {a28ae7af-ab96-11e7-82a5-2cd4449354ae} - "H:\HiSuiteDownLoader.exe"
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [171896 2017-10-27] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [149552 2017-10-27] (NVIDIA Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: 127.0.0.1 cap.cyberlink.com
Tcpip\Parameters: [DhcpNameServer] 172.16.1.1
Tcpip\..\Interfaces\{7D160F40-690F-4016-ADAE-E09D926443B7}: [DhcpNameServer] 172.16.1.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =
HKU\S-1-5-21-976013588-1774182616-1790962854-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKU\S-1-5-21-976013588-1774182616-1790962854-1001 -> DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxps://mysearch.avg.com/search?cid={6635F779-B341-4CBB-990E-8F4791163F39}&mid=bac4c002c20547cfa1cbfd9d0277bd5d-a68b7eea2a876e0ede82853fb0728bad9cd94760&lang=en&ds=AVG&coid=avgtbavg&cmpid=0516piz&pr=fr&d=2016-12-28 06:22:29&v=4.3.6.255&pid=wtu&sg=&sap=dsp&q={searchTerms}
SearchScopes: HKU\S-1-5-21-976013588-1774182616-1790962854-1001 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxps://mysearch.avg.com/search?cid={6635F779-B341-4CBB-990E-8F4791163F39}&mid=bac4c002c20547cfa1cbfd9d0277bd5d-a68b7eea2a876e0ede82853fb0728bad9cd94760&lang=en&ds=AVG&coid=avgtbavg&cmpid=0516piz&pr=fr&d=2016-12-28 06:22:29&v=4.3.6.255&pid=wtu&sg=&sap=dsp&q={searchTerms}
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2017-11-10] (AVAST Software)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2016-07-12] (Microsoft Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2017-11-10] (AVAST Software)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2017-08-15] (Microsoft Corporation)

FireFox:
========
FF DefaultProfile: r1btu8zo.default
FF ProfilePath: C:\Users\симо7\AppData\Roaming\Mozilla\Firefox\Profiles\r1btu8zo.default [2017-11-18]
FF Homepage: Mozilla\Firefox\Profiles\r1btu8zo.default -> https://www.google.bg/?gws_rd=ssl
FF Extension: (FEBE) - C:\Users\симо7\AppData\Roaming\Mozilla\Firefox\Profiles\r1btu8zo.default\Extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3} [2017-11-14] [Lagacy]
FF Extension: (Adblock Plus) - C:\Users\симо7\AppData\Roaming\Mozilla\Firefox\Profiles\r1btu8zo.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2017-11-14]
FF HKU\S-1-5-21-976013588-1774182616-1790962854-1001\...\Firefox\Extensions: [[email protected]] - C:\Users\симо7\AppData\Roaming\ACEStream\extensions\awe\firefox\acewebextension_unlisted.xpi => not found
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_27_0_0_130.dll [2017-09-18] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_27_0_0_130.dll [2017-09-18] ()
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-21] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2017-10-27] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2017-10-27] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-14] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-14] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin HKU\S-1-5-21-976013588-1774182616-1790962854-1001: @acestream.net/acestreamplugin,version=3.1.16 -> C:\Users\симо7\AppData\Roaming\ACEStream\player\npace_plugin.dll [2017-01-31] (Innovative Digital Technologies)
FF Plugin HKU\S-1-5-21-976013588-1774182616-1790962854-1001: @acestream.net/acestreamplugin,version=3.1.2 -> C:\Users\симо7\AppData\Roaming\ACEStream\player\npace_plugin.dll [2017-01-31] (Innovative Digital Technologies)
FF Plugin HKU\S-1-5-21-976013588-1774182616-1790962854-1001: @acestream.net/acestreamplugin,version=3.1.7 -> C:\Users\симо7\AppData\Roaming\ACEStream\player\npace_plugin.dll [2017-01-31] (Innovative Digital Technologies)

Chrome:
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> mysearch.avg.com/?rvt=1
CHR StartupUrls: Default -> "hxxp://www.google.bg/"
CHR Profile: C:\Users\симо7\AppData\Local\Google\Chrome\User Data\Default [2017-11-18]
CHR Extension: (Презентации) - C:\Users\симо7\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-12]
CHR Extension: (Документи) - C:\Users\симо7\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-12]
CHR Extension: (Google Диск) - C:\Users\симо7\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-08-08]
CHR Extension: (YouTube) - C:\Users\симо7\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-08-08]
CHR Extension: (Adblock Plus) - C:\Users\симо7\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2017-09-26]
CHR Extension: (Avast SafePrice) - C:\Users\симо7\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2017-10-17]
CHR Extension: (Таблици) - C:\Users\симо7\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-12]
CHR Extension: (Google Документи офлайн) - C:\Users\симо7\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-08-08]
CHR Extension: (Плащания в уеб магазина на Chrome) - C:\Users\симо7\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-08-22]
CHR Extension: (Gmail) - C:\Users\симо7\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-08-08]
CHR Extension: (Chrome Media Router) - C:\Users\симо7\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-11-15]
CHR Extension: (Dealicious (Verified)) - C:\Users\симо7\AppData\Local\Google\Chrome\User Data\Default\Extensions\pplphlbogdadpkmdhbjdebhfhjifbfka [2017-09-29]
CHR Profile: C:\Users\симо7\AppData\Local\Google\Chrome\User Data\Guest Profile [2017-07-20]
CHR Profile: C:\Users\симо7\AppData\Local\Google\Chrome\User Data\System Profile [2017-09-27]
CHR HKU\S-1-5-21-976013588-1774182616-1790962854-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [chfdnecihphmhljaaejmgoiahnihplgn] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-976013588-1774182616-1790962854-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [mjbepbhonbojpoaenhckjocchgfiaofo] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe [7549928 2017-11-10] (AVAST Software)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [281416 2017-11-10] (AVAST Software)
R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [332368 2017-11-10] (AVAST Software)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6058960 2017-08-07] (Malwarebytes)
R2 NvContainerLocalSystem; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [518264 2017-10-11] (NVIDIA Corporation)
S3 NvContainerNetworkService; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [518264 2017-10-11] (NVIDIA Corporation)
R2 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [462968 2017-10-27] (NVIDIA Corporation)
R2 NvTelemetryContainer; C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe [460920 2017-10-11] (NVIDIA Corporation)
R2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [734400 2015-08-13] (@ByELDI) [File not signed]
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [361824 2017-01-12] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [119872 2017-01-12] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 aswArPot; C:\Windows\System32\drivers\aswArPot.sys [183584 2017-11-10] (AVAST Software)
R1 aswbidsdriver; C:\Windows\System32\drivers\aswbidsdrivera.sys [321032 2017-11-10] (AVAST Software s.r.o.)
R0 aswbidsh; C:\Windows\System32\drivers\aswbidsha.sys [198968 2017-11-10] (AVAST Software s.r.o.)
R0 aswblog; C:\Windows\System32\drivers\aswbloga.sys [343288 2017-11-10] (AVAST Software s.r.o.)
R0 aswbuniv; C:\Windows\System32\drivers\aswbuniva.sys [57728 2017-11-10] (AVAST Software s.r.o.)
S3 aswHwid; C:\Windows\System32\drivers\aswHwid.sys [47008 2017-11-10] (AVAST Software)
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [41832 2017-09-01] (AVAST Software)
R2 aswMonFlt; C:\Windows\System32\drivers\aswMonFlt.sys [148288 2017-11-10] (AVAST Software)
R1 aswNetSec; C:\Windows\System32\drivers\aswNetSec.sys [570152 2017-11-10] (AVAST Software)
R1 aswRdr; C:\Windows\System32\drivers\aswRdr2.sys [110376 2017-11-10] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\drivers\aswRvrt.sys [84416 2017-11-10] (AVAST Software)
R1 aswSnx; C:\Windows\System32\drivers\aswSnx.sys [1026232 2017-11-10] (AVAST Software)
R1 aswSP; C:\Windows\System32\drivers\aswSP.sys [455376 2017-11-15] (AVAST Software)
R2 aswStm; C:\Windows\System32\drivers\aswStm.sys [203976 2017-11-10] (AVAST Software)
S3 aswTap; C:\Windows\system32\DRIVERS\aswTap.sys [53904 2017-06-25] (The OpenVPN Project)
R0 aswVmm; C:\Windows\System32\drivers\aswVmm.sys [364464 2017-11-10] (AVAST Software)
S3 dg_ssudbus; C:\Windows\system32\DRIVERS\ssudbus.sys [131984 2017-05-18] (Samsung Electronics Co., Ltd.)
R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283200 2016-08-11] (DT Soft Ltd)
R3 FUJ02B1; C:\Windows\system32\DRIVERS\FUJ02B1.sys [59152 2016-05-11] (FUJITSU LIMITED)
R0 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [252232 2017-11-17] (Malwarebytes)
R3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3345376 2013-09-04] (Intel Corporation)
S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [30328 2017-10-11] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [50808 2017-10-27] (NVIDIA Corporation)
R3 nvvhci; C:\Windows\System32\drivers\nvvhci.sys [57976 2017-10-27] (NVIDIA Corporation)
S3 ssudmdm; C:\Windows\system32\DRIVERS\ssudmdm.sys [166288 2017-05-18] (Samsung Electronics Co., Ltd.)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [46600 2017-02-10] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [274776 2017-01-12] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [117592 2017-01-12] (Microsoft Corporation)
R2 {A14A8EF6-B11D-4356-9ECC-4B937E6CC626}; C:\Program Files (x86)\CyberLink\PowerDVD17\Common\NavFilter\000.fcl [38168 2017-02-17] (CyberLink Corp.)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-11-18 18:05 - 2017-11-18 18:06 - 000018415 _____ C:\Users\симо7\Desktop\FRST.txt
2017-11-18 18:04 - 2017-11-18 18:05 - 000000000 ____D C:\FRST
2017-11-18 18:03 - 2017-11-18 18:03 - 002392064 _____ (Farbar) C:\Users\симо7\Desktop\FRST64.exe
2017-11-17 17:54 - 2017-11-17 17:54 - 000252232 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys
2017-11-17 17:41 - 2017-11-17 17:41 - 000001957 _____ C:\Users\симо7\Desktop\2017-11-17_17h40_17.png.lnk
2017-11-17 17:38 - 2017-11-17 17:38 - 012701760 _____ (Learnpulse) C:\Users\симо7\Downloads\Screenpresso.exe
2017-11-15 21:23 - 2017-11-15 21:23 - 000455376 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2017-11-15 18:16 - 2017-11-15 18:16 - 000014486 _____ C:\Users\симо7\Downloads\месец октомври аванс Пламена (1).xlsx
2017-11-15 08:35 - 2017-11-15 08:35 - 000001082 _____ C:\Users\Public\Desktop\VLC media player.lnk
2017-11-14 23:52 - 2017-11-14 23:52 - 000071871 _____ C:\Users\симо7\Downloads\blizoo_inv_49655974_01.11.2017.pdf
2017-11-14 23:45 - 2017-11-14 23:45 - 000001165 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2017-11-14 23:45 - 2017-11-14 23:45 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-11-14 23:44 - 2017-11-14 23:45 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-11-14 23:44 - 2017-11-14 23:44 - 000000000 ____D C:\ProgramData\SWCUTemp
2017-11-14 23:35 - 2017-11-14 23:35 - 036686848 _____ (Mozilla) C:\Users\симо7\Downloads\Firefox Setup 57.0.exe
2017-11-14 21:29 - 2017-11-14 21:29 - 000311248 _____ (Mozilla) C:\Users\симо7\Downloads\Firefox Installer.exe
2017-11-14 18:04 - 2017-11-14 18:04 - 000014473 _____ C:\Users\симо7\Downloads\месец октомври аванс Пламена.xlsx
2017-11-14 14:27 - 2017-11-18 11:04 - 000000000 ____D C:\Users\симо7\AppData\LocalLow\uTorrent
2017-11-11 11:27 - 2017-11-11 11:27 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung Printers
2017-11-11 11:27 - 2017-11-11 11:27 - 000000000 ____D C:\ProgramData\Samsung
2017-11-11 11:27 - 2017-11-11 11:27 - 000000000 ____D C:\Program Files (x86)\Samsung
2017-11-11 11:27 - 2015-09-14 07:09 - 002073600 ____N C:\Windows\SysWOW64\DlgSearchEngine.dll
2017-11-11 11:27 - 2015-03-12 04:43 - 000089600 _____ (SS) C:\Windows\system32\ux003ci.dll
2017-11-11 11:27 - 2015-03-12 04:43 - 000022528 _____ () C:\Windows\system32\ux003lm.dll
2017-11-11 11:27 - 2015-02-04 06:41 - 000158016 _____ C:\Windows\system32\ux003ci.exe
2017-11-11 11:26 - 2014-08-18 14:59 - 000011576 ____N (Samsung Electronics) C:\Windows\system32\Drivers\SSPORT.SYS
2017-11-10 09:23 - 2017-11-10 09:23 - 000003914 _____ C:\Windows\System32\Tasks\Avast Emergency Update
2017-11-10 09:23 - 2017-11-10 09:22 - 001026232 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2017-11-10 09:23 - 2017-11-10 09:22 - 000570152 _____ (AVAST Software) C:\Windows\system32\Drivers\aswNetSec.sys
2017-11-10 09:23 - 2017-11-10 09:22 - 000455384 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys.151077381642101
2017-11-10 09:23 - 2017-11-10 09:22 - 000365168 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2017-11-10 09:23 - 2017-11-10 09:22 - 000364464 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
2017-11-10 09:23 - 2017-11-10 09:22 - 000343288 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbloga.sys
2017-11-10 09:23 - 2017-11-10 09:22 - 000321032 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbidsdrivera.sys
2017-11-10 09:23 - 2017-11-10 09:22 - 000203976 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2017-11-10 09:23 - 2017-11-10 09:22 - 000198968 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbidsha.sys
2017-11-10 09:23 - 2017-11-10 09:22 - 000183584 _____ (AVAST Software) C:\Windows\system32\Drivers\aswArPot.sys
2017-11-10 09:23 - 2017-11-10 09:22 - 000148288 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2017-11-10 09:23 - 2017-11-10 09:22 - 000110376 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2017-11-10 09:23 - 2017-11-10 09:22 - 000084416 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2017-11-10 09:23 - 2017-11-10 09:22 - 000057728 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbuniva.sys
2017-11-10 09:23 - 2017-11-10 09:22 - 000047008 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2017-11-09 13:56 - 2017-11-09 13:56 - 000000000 ____D C:\ProgramData\Steam
2017-11-09 12:58 - 2017-11-12 20:58 - 000000000 ____D C:\Program Files\Call of Duty WWII
2017-11-09 12:58 - 2017-11-09 13:56 - 000000842 _____ C:\Users\Public\Desktop\Call of Duty WWII.lnk
2017-11-08 18:20 - 2017-11-08 18:23 - 000008859 _____ C:\Users\симо7\Desktop\ГАЗ-РАЗХОД.xlsx
2017-11-07 09:10 - 2017-11-07 09:10 - 000001650 _____ C:\Users\симо7\Desktop\ASC.exe.lnk
2017-11-07 09:08 - 2017-11-18 17:49 - 000002812 _____ C:\Windows\System32\Tasks\ASC10_SkipUac_симо7
2017-11-03 17:49 - 2017-11-03 17:49 - 000000000 ____D C:\Users\GLCache\1a410118ebdbd30f6e38de2279d395e9
2017-11-03 17:49 - 2017-11-03 17:49 - 000000000 ____D C:\Users\GLCache
2017-11-02 22:22 - 2010-06-02 04:55 - 000527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2017-11-02 22:22 - 2010-06-02 04:55 - 000518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2017-11-02 22:22 - 2010-06-02 04:55 - 000239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll
2017-11-02 22:22 - 2010-06-02 04:55 - 000176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll
2017-11-02 22:22 - 2010-06-02 04:55 - 000077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2017-11-02 22:22 - 2010-06-02 04:55 - 000074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2017-11-02 22:22 - 2010-05-26 11:41 - 002526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2017-11-02 22:22 - 2010-05-26 11:41 - 001907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll
2017-11-02 22:22 - 2010-05-26 11:41 - 001868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll
2017-11-02 22:22 - 2010-02-04 10:01 - 000530776 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_6.dll
2017-11-02 22:22 - 2010-02-04 10:01 - 000528216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_6.dll
2017-11-02 22:22 - 2010-02-04 10:01 - 000238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_6.dll
2017-11-02 22:22 - 2010-02-04 10:01 - 000176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_6.dll
2017-11-02 22:22 - 2010-02-04 10:01 - 000078680 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_4.dll
2017-11-02 22:22 - 2010-02-04 10:01 - 000074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_4.dll
2017-11-02 22:22 - 2010-02-04 10:01 - 000024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_7.dll
2017-11-02 22:22 - 2010-02-04 10:01 - 000022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_7.dll
2017-11-02 22:22 - 2009-09-04 17:44 - 000517960 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_5.dll
2017-11-02 22:22 - 2009-09-04 17:44 - 000515416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_5.dll
2017-11-02 22:22 - 2009-09-04 17:44 - 000238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_5.dll
2017-11-02 22:22 - 2009-09-04 17:44 - 000176968 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_5.dll
2017-11-02 22:22 - 2009-09-04 17:44 - 000073544 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_3.dll
2017-11-02 22:22 - 2009-09-04 17:44 - 000069464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_3.dll
2017-11-02 22:22 - 2009-09-04 17:29 - 005554512 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_42.dll
2017-11-02 22:22 - 2009-09-04 17:29 - 005501792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_42.dll
2017-11-02 22:22 - 2009-09-04 17:29 - 002582888 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_42.dll
2017-11-02 22:22 - 2009-09-04 17:29 - 002475352 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_42.dll
2017-11-02 22:22 - 2009-09-04 17:29 - 001974616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_42.dll
2017-11-02 22:22 - 2009-09-04 17:29 - 001892184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_42.dll
2017-11-02 22:22 - 2009-09-04 17:29 - 000523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll
2017-11-02 22:22 - 2009-09-04 17:29 - 000453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll
2017-11-02 22:22 - 2009-09-04 17:29 - 000285024 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_42.dll
2017-11-02 22:22 - 2009-09-04 17:29 - 000235344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_42.dll
2017-11-02 22:22 - 2009-03-16 14:18 - 000521560 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_4.dll
2017-11-02 22:22 - 2009-03-16 14:18 - 000517448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_4.dll
2017-11-02 22:22 - 2009-03-16 14:18 - 000235352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_4.dll
2017-11-02 22:22 - 2009-03-16 14:18 - 000174936 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_4.dll
2017-11-02 22:22 - 2009-03-16 14:18 - 000024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_6.dll
2017-11-02 22:22 - 2009-03-16 14:18 - 000022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_6.dll
2017-11-02 22:22 - 2009-03-09 15:27 - 005425496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_41.dll
2017-11-02 22:22 - 2009-03-09 15:27 - 004178264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_41.dll
2017-11-02 22:22 - 2009-03-09 15:27 - 002430312 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_41.dll
2017-11-02 22:22 - 2009-03-09 15:27 - 001846632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_41.dll
2017-11-02 22:22 - 2009-03-09 15:27 - 000520544 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_41.dll
2017-11-02 22:22 - 2009-03-09 15:27 - 000453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_41.dll
2017-11-02 22:22 - 2008-10-27 10:04 - 000518480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_3.dll
2017-11-02 22:22 - 2008-10-27 10:04 - 000514384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_3.dll
2017-11-02 22:22 - 2008-10-27 10:04 - 000235856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_3.dll
2017-11-02 22:22 - 2008-10-27 10:04 - 000175440 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_3.dll
2017-11-02 22:22 - 2008-10-27 10:04 - 000074576 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_2.dll
2017-11-02 22:22 - 2008-10-27 10:04 - 000070992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_2.dll
2017-11-02 22:22 - 2008-10-27 10:04 - 000025936 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_5.dll
2017-11-02 22:22 - 2008-10-27 10:04 - 000023376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_5.dll
2017-11-02 22:22 - 2008-10-10 04:52 - 005631312 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_40.dll
2017-11-02 22:22 - 2008-10-10 04:52 - 004379984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_40.dll
2017-11-02 22:22 - 2008-10-10 04:52 - 002605920 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_40.dll
2017-11-02 22:22 - 2008-10-10 04:52 - 002036576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_40.dll
2017-11-02 22:22 - 2008-10-10 04:52 - 000519000 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_40.dll
2017-11-02 22:22 - 2008-10-10 04:52 - 000452440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_40.dll
2017-11-02 22:22 - 2008-07-31 10:41 - 000238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_2.dll
2017-11-02 22:22 - 2008-07-31 10:41 - 000177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_2.dll
2017-11-02 22:22 - 2008-07-31 10:41 - 000072200 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_1.dll
2017-11-02 22:22 - 2008-07-31 10:41 - 000068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll
2017-11-02 22:22 - 2008-07-31 10:40 - 000513544 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_2.dll
2017-11-02 22:22 - 2008-07-31 10:40 - 000509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll
2017-11-02 22:22 - 2008-07-10 11:01 - 000467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll
2017-11-02 22:22 - 2008-07-10 11:00 - 004992520 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_39.dll
2017-11-02 22:22 - 2008-07-10 11:00 - 003851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2017-11-02 22:22 - 2008-07-10 11:00 - 001942552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_39.dll
2017-11-02 22:22 - 2008-07-10 11:00 - 001493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll
2017-11-02 22:22 - 2008-07-10 11:00 - 000540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_39.dll
2017-11-02 22:22 - 2008-05-30 14:19 - 000511496 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_1.dll
2017-11-02 22:22 - 2008-05-30 14:19 - 000507400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_1.dll
2017-11-02 22:22 - 2008-05-30 14:18 - 000238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_1.dll
2017-11-02 22:22 - 2008-05-30 14:18 - 000177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_1.dll
2017-11-02 22:22 - 2008-05-30 14:17 - 000068104 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_0.dll
2017-11-02 22:22 - 2008-05-30 14:17 - 000065032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_0.dll
2017-11-02 22:22 - 2008-05-30 14:17 - 000025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_4.dll
2017-11-02 22:22 - 2008-05-30 14:16 - 000028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_4.dll
2017-11-02 22:22 - 2008-05-30 14:11 - 004991496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_38.dll
2017-11-02 22:22 - 2008-05-30 14:11 - 003850760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_38.dll
2017-11-02 22:22 - 2008-05-30 14:11 - 001941528 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_38.dll
2017-11-02 22:22 - 2008-05-30 14:11 - 001491992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_38.dll
2017-11-02 22:22 - 2008-05-30 14:11 - 000540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_38.dll
2017-11-02 22:22 - 2008-05-30 14:11 - 000467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_38.dll
2017-11-02 22:22 - 2008-03-05 16:04 - 000489480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_0.dll
2017-11-02 22:22 - 2008-03-05 16:03 - 000479752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_0.dll
2017-11-02 22:22 - 2008-03-05 16:03 - 000238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_0.dll
2017-11-02 22:22 - 2008-03-05 16:03 - 000177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_0.dll
2017-11-02 22:22 - 2008-03-05 16:00 - 000028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_3.dll
2017-11-02 22:22 - 2008-03-05 16:00 - 000025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_3.dll
2017-11-02 22:22 - 2008-03-05 15:56 - 004910088 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_37.dll
2017-11-02 22:22 - 2008-03-05 15:56 - 003786760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_37.dll
2017-11-02 22:22 - 2008-03-05 15:56 - 001860120 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_37.dll
2017-11-02 22:22 - 2008-03-05 15:56 - 001420824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_37.dll
2017-11-02 22:22 - 2008-02-05 23:07 - 000529424 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_37.dll
2017-11-02 22:22 - 2008-02-05 23:07 - 000462864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_37.dll
2017-11-02 22:22 - 2007-10-22 03:40 - 000411656 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_10.dll
2017-11-02 22:22 - 2007-10-22 03:39 - 000267272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_10.dll
2017-11-02 22:22 - 2007-10-22 03:37 - 000021000 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_2.dll
2017-11-02 22:22 - 2007-10-22 03:37 - 000017928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_2.dll
2017-11-02 22:22 - 2007-10-12 15:14 - 005081608 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_36.dll
2017-11-02 22:22 - 2007-10-12 15:14 - 003734536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_36.dll
2017-11-02 22:22 - 2007-10-12 15:14 - 002006552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_36.dll
2017-11-02 22:22 - 2007-10-12 15:14 - 001374232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_36.dll
2017-11-02 22:22 - 2007-10-02 09:56 - 000508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_36.dll
2017-11-02 22:22 - 2007-10-02 09:56 - 000444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_36.dll
2017-11-02 22:22 - 2007-07-20 00:57 - 000411496 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_9.dll
2017-11-02 22:22 - 2007-07-20 00:57 - 000267112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_9.dll
2017-11-02 22:22 - 2007-07-19 18:14 - 005073256 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_35.dll
2017-11-02 22:22 - 2007-07-19 18:14 - 003727720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_35.dll
2017-11-02 22:22 - 2007-07-19 18:14 - 001985904 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_35.dll
2017-11-02 22:22 - 2007-07-19 18:14 - 001358192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_35.dll
2017-11-02 22:22 - 2007-07-19 18:14 - 000508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_35.dll
2017-11-02 22:22 - 2007-07-19 18:14 - 000444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_35.dll
2017-11-02 22:22 - 2007-06-20 20:49 - 000409960 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_8.dll
2017-11-02 22:22 - 2007-06-20 20:46 - 000266088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_8.dll
2017-11-02 22:22 - 2007-05-16 16:45 - 004496232 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_34.dll
2017-11-02 22:22 - 2007-05-16 16:45 - 003497832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_34.dll
2017-11-02 22:22 - 2007-05-16 16:45 - 001401200 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_34.dll
2017-11-02 22:22 - 2007-05-16 16:45 - 001124720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_34.dll
2017-11-02 22:22 - 2007-05-16 16:45 - 000506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_34.dll
2017-11-02 22:22 - 2007-05-16 16:45 - 000443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_34.dll
2017-11-02 22:22 - 2007-04-04 18:55 - 000403304 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_7.dll
2017-11-02 22:22 - 2007-04-04 18:55 - 000261480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_7.dll
2017-11-02 22:22 - 2007-04-04 18:53 - 000081768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_3.dll
2017-11-02 22:22 - 2007-03-15 16:57 - 000506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_33.dll
2017-11-02 22:22 - 2007-03-15 16:57 - 000443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_33.dll
2017-11-02 22:22 - 2007-03-12 16:42 - 004494184 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_33.dll
2017-11-02 22:22 - 2007-03-12 16:42 - 003495784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_33.dll
2017-11-02 22:22 - 2007-03-12 16:42 - 001400176 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_33.dll
2017-11-02 22:22 - 2007-03-12 16:42 - 001123696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_33.dll
2017-11-02 22:22 - 2007-03-05 12:42 - 000017688 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_1.dll
2017-11-02 22:22 - 2007-03-05 12:42 - 000015128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_1.dll
2017-11-02 22:22 - 2007-01-24 15:27 - 000393576 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_6.dll
2017-11-02 22:22 - 2007-01-24 15:27 - 000255848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_6.dll
2017-11-02 22:22 - 2006-12-08 12:02 - 000251672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_5.dll
2017-11-02 22:22 - 2006-12-08 12:00 - 000390424 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_5.dll
2017-11-02 22:22 - 2006-11-29 13:06 - 004398360 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll
2017-11-02 22:22 - 2006-11-29 13:06 - 003426072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_32.dll
2017-11-02 22:22 - 2006-11-29 13:06 - 000469264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10.dll
2017-11-02 22:22 - 2006-11-29 13:06 - 000440080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10.dll
2017-11-02 22:22 - 2006-09-28 16:05 - 003977496 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_31.dll
2017-11-02 22:22 - 2006-09-28 16:05 - 002414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll
2017-11-02 22:22 - 2006-09-28 16:05 - 000237848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_4.dll
2017-11-02 22:22 - 2006-09-28 16:04 - 000364824 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_4.dll
2017-11-02 22:22 - 2006-07-28 09:31 - 000083736 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_2.dll
2017-11-02 22:22 - 2006-07-28 09:30 - 000363288 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_3.dll
2017-11-02 22:22 - 2006-07-28 09:30 - 000236824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_3.dll
2017-11-02 22:22 - 2006-07-28 09:30 - 000062744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_2.dll
2017-11-02 22:22 - 2006-05-31 07:24 - 000230168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_2.dll
2017-11-02 22:22 - 2006-05-31 07:22 - 000354072 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_2.dll
2017-11-02 22:22 - 2006-03-31 12:41 - 003927248 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_30.dll
2017-11-02 22:22 - 2006-03-31 12:40 - 002388176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_30.dll
2017-11-02 22:22 - 2006-03-31 12:40 - 000352464 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_1.dll
2017-11-02 22:22 - 2006-03-31 12:39 - 000229584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_1.dll
2017-11-02 22:22 - 2006-03-31 12:39 - 000083664 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_1.dll
2017-11-02 22:22 - 2006-03-31 12:39 - 000062672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_1.dll
2017-11-02 22:22 - 2006-02-03 08:43 - 003830992 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_29.dll
2017-11-02 22:22 - 2006-02-03 08:43 - 002332368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_29.dll
2017-11-02 22:22 - 2006-02-03 08:42 - 000355536 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_0.dll
2017-11-02 22:22 - 2006-02-03 08:42 - 000230096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_0.dll
2017-11-02 22:22 - 2006-02-03 08:41 - 000016592 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_0.dll
2017-11-02 22:22 - 2006-02-03 08:41 - 000014032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_0.dll
2017-11-02 22:22 - 2005-12-05 18:09 - 003815120 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_28.dll
2017-11-02 22:22 - 2005-12-05 18:09 - 002323664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_28.dll
2017-11-02 22:22 - 2005-07-22 19:59 - 003807440 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_27.dll
2017-11-02 22:22 - 2005-07-22 19:59 - 002319568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_27.dll
2017-11-02 22:22 - 2005-05-26 15:34 - 003767504 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_26.dll
2017-11-02 22:22 - 2005-05-26 15:34 - 002297552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_26.dll
2017-11-02 22:22 - 2005-03-18 17:19 - 003823312 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_25.dll
2017-11-02 22:22 - 2005-03-18 17:19 - 002337488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_25.dll
2017-11-02 22:22 - 2005-02-05 19:45 - 003544272 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_24.dll
2017-11-02 22:22 - 2005-02-05 19:45 - 002222800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_24.dll
2017-11-02 22:19 - 2017-11-02 22:22 - 000000000 ____D C:\Windows\SysWOW64\directx
2017-11-01 17:44 - 2017-11-01 17:44 - 000000000 ____D C:\ProgramData\PDVD
2017-11-01 17:43 - 2017-11-01 17:43 - 000002431 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD 17.lnk
2017-11-01 17:43 - 2017-11-01 17:43 - 000002419 _____ C:\Users\Public\Desktop\CyberLink PowerDVD 17.lnk
2017-11-01 17:43 - 2017-11-01 17:43 - 000000000 ____D C:\Program Files (x86)\NSIS Uninstall Information
2017-11-01 17:41 - 2017-11-01 17:41 - 000000000 ____D C:\ProgramData\install_backup
2017-11-01 17:41 - 2017-11-01 17:41 - 000000000 ____D C:\Program Files (x86)\CyberLink
2017-11-01 11:31 - 2017-09-14 01:20 - 000798008 _____ C:\Windows\SysWOW64\vulkan-1.dll
2017-11-01 11:31 - 2017-09-14 01:20 - 000490296 _____ C:\Windows\SysWOW64\vulkaninfo.exe
2017-11-01 11:31 - 2017-09-14 01:19 - 000927544 _____ C:\Windows\system32\vulkan-1.dll
2017-11-01 11:31 - 2017-09-14 01:19 - 000591160 _____ C:\Windows\system32\vulkaninfo.exe
2017-10-31 21:52 - 2017-11-01 11:31 - 000000000 ____D C:\Program Files (x86)\VulkanRT
2017-10-31 21:52 - 2017-10-31 21:52 - 000000000 ____D C:\Windows\SysWOW64\NV
2017-10-31 21:52 - 2017-10-31 21:52 - 000000000 ____D C:\Windows\system32\NV
2017-10-31 21:52 - 2017-10-27 18:12 - 000123000 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2017-10-31 21:52 - 2017-10-27 18:06 - 000136312 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2017-10-31 21:45 - 2017-10-27 18:12 - 000607168 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshext.dll
2017-10-31 21:45 - 2017-10-27 18:12 - 000081856 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshextr.dll
2017-10-31 21:40 - 2017-10-31 21:41 - 000000000 ____D C:\Windows\LastGood
2017-10-31 21:26 - 2017-11-18 17:49 - 000004146 _____ C:\Windows\System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-10-31 21:26 - 2017-11-18 17:49 - 000003814 _____ C:\Windows\System32\Tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-10-31 21:26 - 2017-11-18 17:49 - 000003798 _____ C:\Windows\System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-10-31 21:26 - 2017-11-18 17:49 - 000003738 _____ C:\Windows\System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-10-31 21:26 - 2017-11-18 17:49 - 000003738 _____ C:\Windows\System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-10-31 21:26 - 2017-11-18 17:49 - 000003730 _____ C:\Windows\System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-10-31 21:26 - 2017-11-18 17:49 - 000003554 _____ C:\Windows\System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-10-31 21:26 - 2017-11-18 17:49 - 000003494 _____ C:\Windows\System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-10-31 21:23 - 2017-10-26 04:31 - 001989240 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6438810.dll
2017-10-31 21:23 - 2017-10-26 04:31 - 001673848 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6438810.dll
2017-10-31 17:46 - 2017-10-31 17:47 - 000000000 ____D C:\Windows\LastGood.Tmp
2017-10-31 17:44 - 2017-10-27 19:46 - 040237688 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 036194424 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 035156928 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 029236344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 023262464 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 021744632 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 019037416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 019012232 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 018207248 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 016763000 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2017-10-31 17:44 - 2017-10-27 19:46 - 015027984 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 013864232 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 013254520 _____ (NVIDIA Corporation) C:\Windows\system32\nvptxJitCompiler.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 011779328 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 010882720 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvptxJitCompiler.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 004284496 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 003807680 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 003799032 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 003346552 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 001989056 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6438813.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 001673848 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6438813.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 001135464 _____ (NVIDIA Corporation) C:\Windows\system32\nvfatbinaryLoader.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 001099200 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 001030592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 000981112 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 000932472 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 000885680 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvfatbinaryLoader.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 000615360 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 000527288 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 000505976 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 000492048 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 000446216 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 000407064 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 000171896 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 000154392 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 000149552 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 000132256 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2017-10-31 17:44 - 2017-10-27 19:46 - 000057976 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvhci.sys
2017-10-31 17:44 - 2017-10-27 19:46 - 000050808 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2017-10-31 17:44 - 2017-10-27 19:46 - 000046182 _____ C:\Windows\system32\nvinfo.pb
2017-10-31 17:44 - 2017-10-27 19:46 - 000038336 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvpciflt.sys
2017-10-31 17:44 - 2017-10-27 19:46 - 000000669 _____ C:\Windows\SysWOW64\nv-vk32.json
2017-10-31 17:44 - 2017-10-27 19:46 - 000000669 _____ C:\Windows\system32\nv-vk64.json
2017-10-31 17:42 - 2017-10-31 17:42 - 000000000 ____D C:\NVIDIA
2017-10-28 19:23 - 2017-10-28 19:23 - 000000000 ____D C:\Users\Public\Documents\Steam
2017-10-28 19:22 - 2016-08-10 09:38 - 000107368 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_3.dll
2017-10-28 17:50 - 2017-10-13 00:25 - 000835576 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-10-28 17:50 - 2017-10-13 00:25 - 000177656 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-10-28 17:50 - 2017-10-05 09:17 - 000380248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2017-10-28 17:50 - 2017-09-15 01:52 - 000986968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2017-10-28 17:50 - 2017-09-08 19:14 - 003084288 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll
2017-10-28 17:50 - 2017-09-08 18:50 - 002471424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll
2017-10-28 17:50 - 2017-09-08 05:31 - 000685440 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2017-10-28 17:50 - 2017-09-08 05:28 - 000507176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2017-10-28 17:50 - 2017-09-07 23:31 - 000022528 _____ (Microsoft Corporation) C:\Windows\system32\mgmtapi.dll
2017-10-28 17:50 - 2017-09-07 21:20 - 000018944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mgmtapi.dll
2017-10-28 17:50 - 2017-09-07 19:20 - 000513456 _____ C:\Windows\SysWOW64\locale.nls
2017-10-28 17:50 - 2017-09-07 19:20 - 000513456 _____ C:\Windows\system32\locale.nls
2017-10-28 17:50 - 2017-09-07 15:40 - 000995272 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2017-10-28 17:50 - 2017-09-07 15:40 - 000922432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ucrtbase.dll
2017-10-28 17:50 - 2017-09-07 01:07 - 000158552 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2017-10-28 17:50 - 2017-09-06 23:17 - 000461144 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2017-10-28 17:50 - 2017-09-06 23:17 - 000443224 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2017-10-28 17:50 - 2017-09-06 16:14 - 000166400 _____ (Microsoft Corporation) C:\Windows\system32\regsvc.dll
2017-10-28 17:50 - 2017-08-11 03:39 - 002779136 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2017-10-28 17:50 - 2017-08-11 03:30 - 002464256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-11-18 18:06 - 2017-01-20 10:24 - 000000000 ____D C:\Users\симо7\AppData\Roaming\uTorrent
2017-11-18 17:49 - 2017-10-04 16:24 - 000000000 ____D C:\Windows\System32\Tasks\AVAST Software
2017-11-18 17:49 - 2016-08-08 15:35 - 000003430 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2017-11-18 17:49 - 2016-08-08 15:35 - 000003302 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2017-11-18 17:48 - 2016-08-09 20:20 - 000000000 ____D C:\Users\симо7\AppData\Roaming\.ACEStream
2017-11-18 17:44 - 2017-08-16 21:00 - 000000000 ____D C:\_acestream_cache_
2017-11-18 15:37 - 2016-08-08 15:46 - 000000000 ___RD C:\ТОРЕНТ
2017-11-18 12:25 - 2016-08-08 15:44 - 000000000 ____D C:\ProgramData\NVIDIA
2017-11-18 12:21 - 2016-08-08 15:31 - 000003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-976013588-1774182616-1790962854-1001
2017-11-18 11:50 - 2016-11-17 21:04 - 000000000 ____D C:\Users\симо7\AppData\LocalLow\Mozilla
2017-11-18 11:48 - 2013-08-22 17:36 - 000000000 ___HD C:\Program Files\WindowsApps
2017-11-18 11:48 - 2013-08-22 17:36 - 000000000 ____D C:\Windows\AppReadiness
2017-11-17 17:11 - 2017-03-14 18:53 - 000647040 _____ C:\Windows\system32\perfh002.dat
2017-11-17 17:11 - 2017-03-14 18:53 - 000122548 _____ C:\Windows\system32\perfc002.dat
2017-11-17 17:11 - 2014-11-21 00:31 - 001521674 _____ C:\Windows\system32\PerfStringBackup.INI
2017-11-17 17:11 - 2013-08-22 15:36 - 000000000 ____D C:\Windows\Inf
2017-11-15 18:17 - 2016-08-08 15:26 - 000000000 ____D C:\Users\симо7\AppData\Local\Packages
2017-11-15 16:40 - 2013-08-22 17:36 - 000000000 ____D C:\Windows\LiveKernelReports
2017-11-15 08:39 - 2017-04-09 16:58 - 000000000 ____D C:\Users\симо7\AppData\Roaming\vlc
2017-11-14 23:45 - 2016-08-08 16:40 - 000000000 ____D C:\Users\симо7\AppData\Roaming\Mozilla
2017-11-14 23:45 - 2016-08-08 16:40 - 000000000 ____D C:\Users\симо7\AppData\Local\Mozilla
2017-11-14 23:40 - 2013-08-22 16:45 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2017-11-14 18:20 - 2017-09-30 08:48 - 000000089 _____ C:\Users\симо7\Desktop\Нов текстов документ.txt
2017-11-14 12:40 - 2016-08-10 17:57 - 000000000 ____D C:\ProgramData\Skype
2017-11-14 08:43 - 2016-08-08 15:35 - 000002213 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-11-11 11:20 - 2013-08-22 15:25 - 000262144 ___SH C:\Windows\system32\config\BBI
2017-11-09 12:57 - 2016-08-11 08:32 - 000000000 ____D C:\Users\симо7\AppData\Roaming\DAEMON Tools Lite
2017-11-01 17:48 - 2016-08-11 08:22 - 000000000 ____D C:\Users\симо7\Documents\CyberLink
2017-11-01 17:48 - 2016-08-11 08:22 - 000000000 ____D C:\Users\симо7\AppData\Roaming\CyberLink
2017-11-01 17:44 - 2017-04-12 10:24 - 000000000 ____D C:\ProgramData\CyberLink
2017-11-01 17:43 - 2016-08-11 08:18 - 000000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2017-11-01 17:42 - 2016-08-11 08:20 - 000000000 ____D C:\Users\симо7\AppData\Local\CyberLink
2017-11-01 17:41 - 2017-02-21 08:47 - 000000000 ____D C:\ProgramData\SUPPORTDIR
2017-11-01 17:41 - 2016-08-11 08:18 - 000000000 ____D C:\ProgramData\install_clap
2017-11-01 17:36 - 2016-09-07 13:46 - 000000000 ____D C:\Users\симо7\AppData\Local\CrashDumps
2017-10-31 21:52 - 2016-08-08 15:44 - 000000000 ____D C:\ProgramData\NVIDIA Corporation
2017-10-31 21:26 - 2016-08-08 15:44 - 000000000 ____D C:\Program Files\NVIDIA Corporation
2017-10-31 21:26 - 2016-08-08 15:44 - 000000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2017-10-30 20:08 - 2013-08-22 17:36 - 000000000 ____D C:\Windows\rescache
2017-10-29 11:25 - 2017-09-27 08:01 - 000000000 ____D C:\ProgramData\ProductData
2017-10-28 17:52 - 2013-08-22 17:20 - 000000000 ____D C:\Windows\CbsTemp
2017-10-27 18:36 - 2016-10-07 15:17 - 000001951 _____ C:\Windows\NvContainerRecovery.bat
2017-10-27 18:12 - 2016-08-08 15:44 - 005960824 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2017-10-27 18:12 - 2016-08-08 15:44 - 002587768 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2017-10-27 18:12 - 2016-08-08 15:44 - 001766520 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2017-10-27 18:12 - 2016-08-08 15:44 - 000449656 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2017-10-26 17:36 - 2016-08-11 08:18 - 000000000 ____D C:\ProgramData\Temp
2017-10-25 12:33 - 2016-08-08 15:44 - 007802921 _____ C:\Windows\system32\nvcoproc.bin
2017-10-22 10:21 - 2016-08-08 16:30 - 000000000 ____D C:\Users\симо7\AppData\Local\ElevatedDiagnostics
2017-10-22 10:21 - 2013-08-22 17:36 - 000000000 ____D C:\Windows\system32\NDF

Some files in TEMP:
====================
2017-11-09 17:58 - 2017-11-09 17:58 - 012701760 _____ (Learnpulse) C:\Users\симо7\AppData\Local\Temp\ScreenpressoUpd.exe
2017-11-15 08:34 - 2017-11-15 08:34 - 030950664 _____ () C:\Users\симо7\AppData\Local\Temp\vlc-2.2.6-win32.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-11-14 10:10

==================== End of FRST.txt ============================

Addition.txt

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

19 ноември 20178 г.

Здравейте..!

Фикс с Farbar Recovery Scan Tool

Изтеглете прикачения файл fixlist.txt и го запазете там, където сте свалили FRST.exe
Стартирайте отново FRST.exe и натиснете бутона Fix веднъж и изчакайте.

Ще се създаде нов лог файла FixLog.txt. Прикачете съдържанието му в следващия си коментар.

ЗАБЕЛЕЖКА: Този скрипт е написан специално за този потребител,и за тази конкретна машина. Изпълнението на фикса, на друг компютър може да доведе до увреждане на операционната ви система

Сканиране с SecurityCheck by glax24

Изтеглете SecurityCheck by glax24 от тук и запомнете инструмента на десктопа .
Стартирате програмата (ако използвате Windows XP) или стартирате с десен бутон на мишката от името на администратор (ако използватеWindows Vista/7/8/10)
Изчакайте да приключи сканирането.Ще се отвори в текстов файл с имеSecurityCheck.txt. Копирайте съдържанието на този файл следващия си пост
Можете да намерите този файл в основната директория на системния диск в папка с име SecurityCheck, напр. C:\SecurityCheck\SecurityCheck.txt

Дневници

В следващия си отговор, моля да включите следните дневници:

FixLog.txt
SecurityCheck.txt (копирате цялото съдържание)

19 ноември 20178 г.

Автор

Ето и двата лога.

SecurityCheck by glax24 & Severnyj v.1.4.0.53 [27.10.17]
WebSite: www.safezone.cc
DateLog: 19.11.2017 12:18:45
Path starting: C:\Users\симо7\AppData\Local\Temp\SecurityCheck\SecurityCheck.exe
Log directory: C:\SecurityCheck\
IsAdmin: True
User: симо7
VersionXML: 4.76is-18.11.2017
___________________________________________________________________________

Windows 8.1(6.3.9600) (x64) Professional Lang: 0402
Installation date OS: 08.08.2016 13:26:39
LicenseStatus: Office 15, OfficeProPlusVL_KMS_Client edition Volume activation will expire : 259197 minutes
LicenseStatus: Windows(R), Professional edition Volume activation will expire : 259197 minutes
Boot Mode: Normal
Default Browser: Internet Explorer (C:\Program Files\Internet Explorer\iexplore.exe)
SystemDrive: C: FS: [NTFS] Capacity: [296.6 Gb] Used: [166.4 Gb] Free: [130.2 Gb]
------------------------------- [ Windows ] -------------------------------
Internet Explorer 11.0.9600.18817 Warning! Download Update
Online installation. Last version available when Windows update is enabled throught the Internet.
User Account Control enabled
The elevation prompt for administrators disabled
^It is recommended to enable (default): Win+R typing UserAccountControlSettings and Enter^
Notify before download
Date install updates: 2017-10-28 15:52:49
Windows Update (wuauserv) - The service is running
Security Center (wscsvc) - The service is running
Remote Registry (RemoteRegistry) - The service has stopped
SSDP Discovery (SSDPSRV) - The service is running
Remote Desktop Services (TermService) - The service has stopped
Windows Remote Management (WS-Management) (WinRM) - The service has stopped
------------------------------ [ MS Office ] ------------------------------
Microsoft Office 2013 x64 v.15.0.4569.1506
---------------------------- [ Antivirus_WMI ] ----------------------------
Avast Antivirus (enabled and up to date)
Windows Defender (disabled and up to date)
---------------------------- [ Firewall_WMI ] -----------------------------
Avast Antivirus (enabled)
--------------------------- [ AntiSpyware_WMI ] ---------------------------
Windows Defender (disabled and up to date)
Avast Antivirus (enabled and up to date)
---------------------- [ AntiVirusFirewallInstall ] -----------------------
Avast Internet Security v.17.8.2318
-------------------------- [ SecurityUtilities ] --------------------------
Malwarebytes, версия 3.2.2.2029 v.3.2.2.2029
--------------------------- [ OtherUtilities ] ----------------------------
WinRAR 5.31 (64-битова версия) v.5.31.0 Warning! Download Update
Microsoft Silverlight v.5.1.50907.0
VLC media player v.2.2.6
--------------------------------- [ IM ] ----------------------------------
Skype™ 7.40 v.7.40.151
--------------------------- [ AppleProduction ] ---------------------------
Bonjour v.3.0.0.10 Warning! Download Update
^Please use Apple Software Update tool.^
Bonjour Service (Bonjour Service) - The service is running
--------------------------- [ AdobeProduction ] ---------------------------
Adobe Flash Player 27 NPAPI v.27.0.0.130 Warning! Download Update
------------------------------- [ Browser ] -------------------------------
Google Chrome v.62.0.3202.94
Mozilla Firefox 57.0 (x86 bg) v.57.0
--------------------------- [ RunningProcess ] ----------------------------
C:\Program Files (x86)\Mozilla Firefox\firefox.exe v.57.0.0.6525
------------------ [ AntivirusFirewallProcessServices ] -------------------
Avast Antivirus (avast! Antivirus) - The service is running
C:\Program Files\AVAST Software\Avast\AvastSvc.exe v.17.8.3705.0
aswbIDSAgent (aswbIDSAgent) - The service is running
C:\Program Files\AVAST Software\Avast\AvastUI.exe v.17.8.3705.249
C:\Program Files\AVAST Software\Avast\afwServ.exe v.17.8.3705.0
Avast Firewall Service (avast! Firewall) - The service is running
Malwarebytes Service (MBAMService) - The service has stopped
Услуга на Windows Defender (WinDefend) - The service has stopped
Услуга за мрежова проверка на Windows Defender (WdNisSvc) - The service has stopped
---------------------------- [ UnwantedApps ] -----------------------------
Ace Stream Media 3.1.2 v.3.1.2 Unwanted software.
Advanced SystemCare 10 v.10.5.0 Warning! Application is distributed through the partnership programs and bundle assemblies. Uninstallation recommended. Possible you became a victim of fraud or social engineering.
----------------------------- [ End of Log ] ------------------------------

Fixlog.txt

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

19 ноември 20178 г.

Цитат

Ace Stream Media 3.1.2 v.3.1.2 Unwanted software.
Advanced SystemCare 10 v.10.5.0 Warning! Application is distributed through the partnership programs and bundle assemblies. Uninstallation recommended. Possible you became a victim of fraud or social engineering.

Препоръчвам ви да си решите дали този софтуер ви е необходим и трябва да остане на вашия компютър..Но това си е ваше решение...!

19 ноември 20178 г.

Автор

Благодаря за отделеното внимание.Имаше ли нещо нередно в компютъра.Сега отворих" Зелката" и авастта не изкара това съобщение.Адванса го деинсталирах,но асестрийма го ползвам.На настолният дали ще е същото или няма връзка.

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

19 ноември 20178 г.

Последна проверка и приключваме ...!

Моля, изтеглете Zemana AntiMalware и го запишете на вашия работен плот.

Инсталирайте програмата и след като инсталацията приключи, тя ще се стартира автоматично.
Без да промените каквито и опции, натиснете Scan, за да започне проверката
След кратко сканирането приключи, ако са открити заплахи натиснете Nextза да ги премахнете.

Забележка: Ако се изиска рестартиране, за да завършите процеса на почистване, трябва да щракнете върху Reboot . Ако не се изисква рестартиране, моля рестартирайте компютъра ръчно.

Отворете Zemana AntiMalware отново.
Кликнете върху икона и кликнете два пъти върху последния доклад.
Сега кликнете File > Save As и изберете своя Desktop преди да натиснете Save.
Моля копирайте съдържанието на лог файла в следващия си пост.

преди 20 минути, SIMO70 написа:

На настолният дали ще е същото или няма връзка.

Ако искате и него ще проверим...Процедурата е абсолютно същата...!

Дневници

В следващия си отговор, моля да включите (като копирате целите съдържания ) следните дневници:

Дневник от Zemana AntiMalware

19 ноември 20178 г.

Автор

Още сканира но тези какво да ги прави програмата,ще се прецакали активацията на уиндоса

Service_KMS.exe
Status             : Проверено
Object             : %programw6432%\kmspico\service_kms.exe
MD5                : 99F920E95C2F5AE3796D4928C5C3CB00
Publisher          : @ByELDI
Size               : 734400
Version            : 16.0.0.2
Detection          : PUA:Win32/HackTool.IdleKMS
Cleaning Action    : Карантина
Related Objects    :
                Файл - %programw6432%\kmspico\service_kms.exe
                Процес - 1516 - C:\Program Files\KMSpico\Service_KMS.exe

AutoPico.exe
Status             : Проверено
Object             : %programw6432%\kmspico\autopico.exe
MD5                : C7A2F2E275C8C384F035BDD9E60DE2EC
Publisher          : @ByELDI
Size               : 734400
Version            : 15.0.0.2
Detection          : PUA:Win32/HackTool.IdleKMS
Cleaning Action    : Карантина
Related Objects    :
                Файл - %programw6432%\kmspico\autopico.exe
                Планирана задача - C:\Windows\System32\Tasks\AutoPico Daily Restart

Редактирано 19 ноември 20178 г. от SIMO70 (преглед на промените)

19 ноември 20178 г.

Автор

Двете заплахи от активатора ги сложих на безопасни.

Zemana AntiMalware 2.74.2.150 (инсталираната версия)

-------------------------------------------------------
Scan Result            : Завършено
Scan Date              : 2017.11.19
Operating System       : Windows 8.1 64-bit
Processor              : 4X Intel(R) Core(TM) i5-2430M CPU @ 2.40GHz
BIOS Mode              : Legacy
CUID                   : 12EE8620FF365822ED7922
Scan Type              : Проверка на системата
Duration               : 7m 44s
Scanned Objects        : 57245
Detected Objects       : 3
Excluded Objects       : 0
Read Level             : SCSI
Auto Upload            : Включен
Detect All Extensions : Изключен
Scan Documents         : Изключен
Domain Info            : WORKGROUP,0,2

Detected Objects
-------------------------------------------------------

Firefox Search
Status             : Проверено
Object             : Р РµС‡РЅРёРє РЅР° Portal.BG - http://portal.bg
MD5                : -
Publisher          : -
Size               : -
Version            : -
Detection          : Подозрителна настройка на браузъра
Cleaning Action    : Поправи
Related Objects    :
                Настройка на браузъра - Firefox Search

Service_KMS.exe
Status             : Проверено
Object             : %programw6432%\kmspico\service_kms.exe
MD5                : 99F920E95C2F5AE3796D4928C5C3CB00
Publisher          : @ByELDI
Size               : 734400
Version            : 16.0.0.2
Detection          : PUA:Win32/HackTool.IdleKMS
Cleaning Action    : Карантина
Related Objects    :
                Файл - %programw6432%\kmspico\service_kms.exe
                Процес - 1516 - C:\Program Files\KMSpico\Service_KMS.exe

AutoPico.exe
Status             : Проверено
Object             : %programw6432%\kmspico\autopico.exe
MD5                : C7A2F2E275C8C384F035BDD9E60DE2EC
Publisher          : @ByELDI
Size               : 734400
Version            : 15.0.0.2
Detection          : PUA:Win32/HackTool.IdleKMS
Cleaning Action    : Карантина
Related Objects    :
                Файл - %programw6432%\kmspico\autopico.exe
                Планирана задача - C:\Windows\System32\Tasks\AutoPico Daily Restart

Cleaning Result
-------------------------------------------------------
Cleaned               : 1
Reported as safe      : 2
Failed                : 0

Редактирано 19 ноември 20178 г. от SIMO70 (преглед на промените)

19 ноември 20178 г.

Автор

А това са логовете от настолният комп.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 19-11-2017
Ran by mrawk (administrator) on МОНИ (19-11-2017 14:41:03)
Running from C:\Users\mrawk\Desktop
Loaded Profiles: mrawk (Available Profiles: mrawk)
Platform: Windows 10 Pro Version 1709 16299.19 (X64) Language: Български (България)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(@ByELDI) C:\Program Files\KMSpico\Service_KMS.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(BitTorrent Inc.) C:\Users\mrawk\AppData\Roaming\uTorrent\uTorrent.exe
(BitTorrent Inc.) C:\Users\mrawk\AppData\Roaming\uTorrent\updates\3.5.0_44090\utorrentie.exe
(BitTorrent Inc.) C:\Users\mrawk\AppData\Roaming\uTorrent\updates\3.5.0_44090\utorrentie.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsStore_11710.1001.27.0_x64__8wekyb3d8bbwe\WinStore.App.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
() C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.17085.22311.0_x64__8wekyb3d8bbwe\Music.UI.exe
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2017.39091.16340.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [630168 2017-09-29] (Microsoft Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2397120 2016-11-14] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => "C:\Windows\system32\rundll32.exe" C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKU\S-1-5-21-3545060876-3950350259-1486773641-1001\...\Run: [uTorrent] => C:\Users\mrawk\AppData\Roaming\uTorrent\uTorrent.exe [1982144 2017-09-29] (BitTorrent Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 172.16.1.1
Tcpip\..\Interfaces\{73e19f78-7f1a-4b75-8813-577497609d76}: [DhcpNameServer] 172.16.1.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer.dll [2017-05-22] (IObit)
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office16\OCHelper.dll [2015-07-31] (Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office16\GROOVEEX.DLL [2017-07-11] (Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office16\OCHelper.dll [2015-07-31] (Microsoft Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office16\GROOVEEX.DLL [2017-07-11] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2017-08-15] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2017-08-15] (Microsoft Corporation)

Edge:
======
Edge HomeButtonPage: HKU\S-1-5-21-3545060876-3950350259-1486773641-1001 -> hxxps://www.google.bg/?gws_rd=ssl
Edge Extension: (AdBlock) -> EdgeExtension_BetaFishAdBlock_c1wakc4j0nefm => C:\Program Files\WindowsApps\BetaFish.AdBlock_2.3.0.0_neutral__c1wakc4j0nefm [2017-10-09]

FireFox:
========
FF DefaultProfile: 89t19w25.default
FF ProfilePath: C:\Users\mrawk\AppData\Roaming\Mozilla\Firefox\Profiles\89t19w25.default [2017-11-19]
FF Homepage: Mozilla\Firefox\Profiles\89t19w25.default -> hxxps://www.google.bg/?gws_rd=ssl
FF Extension: (FEBE) - C:\Users\mrawk\AppData\Roaming\Mozilla\Firefox\Profiles\89t19w25.default\Extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3} [2017-11-16] [Lagacy]
FF Extension: (Adblock Plus) - C:\Users\mrawk\AppData\Roaming\Mozilla\Firefox\Profiles\89t19w25.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2017-11-16]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_27_0_0_187.dll [2017-11-19] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_27_0_0_187.dll [2017-11-19] ()
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2016-11-14] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2016-11-14] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-16] (Google Inc.)
FF Plugin HKU\S-1-5-21-3545060876-3950350259-1486773641-1001: @acestream.net/acestreamplugin,version=3.1.2 -> C:\Users\mrawk\AppData\Roaming\ACEStream\player\npace_plugin.dll [2015-08-06] (Innovative Digital Technologies)

Chrome:
=======
CHR HomePage: Default -> hxxps://www.google.bg/?gws_rd=ssl
CHR StartupUrls: Default -> "hxxp://www.google.bg/"
CHR Profile: C:\Users\mrawk\AppData\Local\Google\Chrome\User Data\Default [2017-11-19]
CHR Extension: (Презентации) - C:\Users\mrawk\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-13]
CHR Extension: (Документи) - C:\Users\mrawk\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-13]
CHR Extension: (Google Диск) - C:\Users\mrawk\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-09-07]
CHR Extension: (YouTube) - C:\Users\mrawk\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-09-07]
CHR Extension: (Adblock Plus) - C:\Users\mrawk\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2017-09-27]
CHR Extension: (Таблици) - C:\Users\mrawk\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-13]
CHR Extension: (Google Документи офлайн) - C:\Users\mrawk\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-09-07]
CHR Extension: (Ace Script) - C:\Users\mrawk\AppData\Local\Google\Chrome\User Data\Default\Extensions\mjbepbhonbojpoaenhckjocchgfiaofo [2017-09-22]
CHR Extension: (Плащания в уеб магазина на Chrome) - C:\Users\mrawk\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-09-07]
CHR Extension: (Gmail) - C:\Users\mrawk\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-09-07]
CHR Extension: (Chrome Media Router) - C:\Users\mrawk\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-11-16]
CHR Extension: (Dealicious (Verified)) - C:\Users\mrawk\AppData\Local\Google\Chrome\User Data\Default\Extensions\pplphlbogdadpkmdhbjdebhfhjifbfka [2017-09-30]
CHR HKU\S-1-5-21-3545060876-3950350259-1486773641-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [mjbepbhonbojpoaenhckjocchgfiaofo] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1163712 2016-11-14] (NVIDIA Corporation)
S4 IObitUnSvr; C:\Program Files (x86)\IObit\IObit Uninstaller\IUService.exe [206112 2017-06-14] (IObit)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1879488 2016-11-14] (NVIDIA Corporation)
S2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [2521024 2016-11-14] (NVIDIA Corporation)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [4297920 2017-09-30] (Microsoft Corporation)
R2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [734400 2015-08-13] (@ByELDI) [File not signed]
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [355304 2017-09-29] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [105944 2017-09-29] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 IUFileFilter; C:\Program Files (x86)\IObit\IObit Uninstaller\drivers\win10_amd64\IUFileFilter.sys [39904 2017-06-06] (IObit.com)
S3 IURegProcessFilter; C:\Program Files (x86)\IObit\IObit Uninstaller\drivers\win10_amd64\IURegProcessFilter.sys [39792 2017-09-28] (IObit.com)
R1 MpKsl03908370; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{4F937AB8-5B1F-4BC7-B4F2-39B109868F01}\MpKsl03908370.sys [58120 2017-11-03] (Microsoft Corporation)
R1 MpKsl7ca2a283; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{72624F85-B056-47D3-8805-00627371FEF1}\MpKsl7ca2a283.sys [58120 2017-11-18] (Microsoft Corporation)
R3 nvvad_WaveExtensible; C:\WINDOWS\system32\drivers\nvvad64v.sys [56384 2016-11-14] (NVIDIA Corporation)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [604160 2017-09-29] (Realtek )
R3 RTL8023x64; C:\WINDOWS\System32\drivers\Rtnic64.sys [51712 2017-09-29] (Realtek Semiconductor Corporation )
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44608 2017-09-29] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [309144 2017-09-29] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [119192 2017-09-29] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-11-19 14:41 - 2017-11-19 14:42 - 000012692 _____ C:\Users\mrawk\Desktop\FRST.txt
2017-11-19 14:40 - 2017-11-19 14:41 - 000000000 ____D C:\FRST
2017-11-19 14:40 - 2017-11-19 14:40 - 002391552 _____ (Farbar) C:\Users\mrawk\Desktop\FRST64.exe
2017-11-19 14:11 - 2017-11-19 14:11 - 000000000 ____D C:\Users\mrawk\AppData\Local\Macromedia
2017-11-19 14:10 - 2017-11-19 14:10 - 000004412 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2017-11-19 14:09 - 2017-11-19 14:10 - 000000000 ____D C:\Users\mrawk\AppData\Local\Adobe
2017-11-19 13:01 - 2017-11-19 13:01 - 000022561 _____ C:\Users\mrawk\Downloads\26599-UFC.Fight.Night.121.WEB-DL.H264.Fight-BB.mp4[mma][https___mma-torrents.com].torrent
2017-11-18 21:16 - 2017-11-18 21:16 - 000000000 ____D C:\Users\Default\AppData\Local\Microsoft Help
2017-11-18 21:16 - 2017-11-18 21:16 - 000000000 ____D C:\Users\Default User\AppData\Local\Microsoft Help
2017-11-18 20:59 - 2017-11-18 20:59 - 000000000 ____D C:\Program Files (x86)\Microsoft ASP.NET
2017-11-18 18:15 - 2017-11-18 18:15 - 000028173 _____ C:\Users\mrawk\Downloads\26599-Titan.FC.46.WEB-DL.H264.Fight-BB.mp4[mma][https___mma-torrents.com].torrent
2017-11-16 18:07 - 2017-11-16 18:07 - 000395948 _____ C:\Users\mrawk\Downloads\НАП Михаела.pdf
2017-11-16 18:06 - 2017-11-16 18:06 - 000246060 _____ C:\Users\mrawk\Downloads\ДС Михаела.pdf
2017-11-16 09:10 - 2017-11-17 23:28 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-11-16 09:10 - 2017-11-16 09:10 - 000001220 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2017-11-16 09:10 - 2017-11-16 09:10 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-11-16 06:07 - 2017-11-19 06:55 - 000000000 ____D C:\Users\mrawk\AppData\LocalLow\uTorrent
2017-11-12 09:09 - 2017-11-12 09:09 - 000000000 ____D C:\Users\mrawk\AppData\LocalLow\Temp
2017-11-12 09:03 - 2017-11-12 09:03 - 000000000 ____D C:\Users\mrawk\Documents\Шаблони на Office по избор
2017-11-05 09:11 - 2017-11-05 09:11 - 000000080 _____ C:\Users\mrawk\Downloads\AVG Internet Security 2018 License number.txt
2017-11-04 17:17 - 2017-11-04 17:17 - 000001122 _____ C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk
2017-11-04 17:17 - 2017-11-04 17:17 - 000000000 ____D C:\Users\mrawk\AppData\Local\VS Revo Group
2017-11-04 17:16 - 2017-11-04 17:17 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro
2017-11-04 17:16 - 2017-11-04 17:16 - 000000000 ____D C:\ProgramData\VS Revo Group
2017-11-04 17:16 - 2017-11-04 17:16 - 000000000 ____D C:\Program Files\VS Revo Group
2017-11-04 17:16 - 2016-12-21 14:52 - 000040240 _____ (VS Revo Group) C:\WINDOWS\system32\Drivers\revoflt.sys
2017-11-04 08:13 - 2017-11-04 08:13 - 000039991 _____ C:\Users\mrawk\Downloads\Tachi.Palace.Fights.33.WEB.DL.x264-ThS.mp4[https---mma-torrents.com].torrent
2017-11-04 08:12 - 2017-11-04 08:12 - 000015895 _____ C:\Users\mrawk\Downloads\ONE.Championship.64.Heros.Dream.HDTV.x264-Ebi.mp4[mma][https---mma-torrents.com].torrent
2017-11-04 08:12 - 2017-11-04 08:12 - 000014070 _____ C:\Users\mrawk\Downloads\ONE.Championship.64.Prelims.HDTV.x264-Ebi.mp4[mma][https---mma-torrents.com].torrent
2017-11-03 09:19 - 2017-11-03 09:19 - 000261812 _____ C:\Users\mrawk\Downloads\0005111985.pdf
2017-10-30 11:44 - 2017-10-30 11:44 - 000000000 ____D C:\ProgramData\Temp
2017-10-30 11:42 - 2017-10-30 11:54 - 000000000 ____D C:\ProgramData\SUPPORTDIR
2017-10-30 11:42 - 2017-10-30 11:54 - 000000000 ____D C:\ProgramData\install_clap
2017-10-30 11:42 - 2017-10-30 11:42 - 000000000 ____D C:\ProgramData\CyberLink
2017-10-30 09:37 - 2017-10-30 09:37 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Daum
2017-10-29 10:31 - 2017-10-29 10:31 - 000019222 _____ C:\Users\mrawk\Downloads\UFC.Fight.Night.119.Brunson.vs.Machida.HDTV.x264-Ebi.mp4[mma][https---mma-torrents.com].torrent
2017-10-25 08:08 - 2017-10-25 08:08 - 000001348 _____ C:\Users\mrawk\Desktop\Download - Пряк път.lnk
2017-10-23 05:17 - 2017-10-23 05:17 - 000000000 ____D C:\ProgramData\Microsoft OneDrive
2017-10-23 05:15 - 2017-10-23 05:15 - 000000000 ___HD C:\Users\mrawk\MicrosoftEdgeBackups
2017-10-23 05:14 - 2017-10-23 05:14 - 000000020 ___SH C:\Users\mrawk\ntuser.ini
2017-10-23 05:14 - 2017-10-23 05:14 - 000000000 ___RD C:\Users\mrawk\3D Objects
2017-10-23 00:18 - 2017-11-04 07:49 - 000000000 ____D C:\Windows.old
2017-10-23 00:14 - 2017-10-23 00:18 - 000000000 ____D C:\WINDOWS\system32\config\bbimigrate
2017-10-23 00:12 - 2017-10-23 00:14 - 000000000 ____D C:\WINDOWS\ServiceProfiles
2017-10-23 00:12 - 2017-10-23 00:12 - 000008192 _____ C:\WINDOWS\system32\config\userdiff
2017-10-23 00:10 - 2017-10-23 00:10 - 000000000 ____D C:\WINDOWS\containers
2017-10-23 00:09 - 2017-10-23 00:09 - 025246208 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 023664128 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 021752832 _____ (Microsoft Corporation) C:\WINDOWS\system32\Hydrogen.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 019343360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 018913792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 017080832 _____ (Microsoft Corporation) C:\WINDOWS\system32\HologramCompositor.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 008592280 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2017-10-23 00:09 - 2017-10-23 00:09 - 008097792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 006032896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 005906264 _____ (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 004744192 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 003681280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 003672064 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2017-10-23 00:09 - 2017-10-23 00:09 - 003334144 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 003312432 _____ C:\WINDOWS\system32\Windows.Mirage.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 002905600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2017-10-23 00:09 - 2017-10-23 00:09 - 002869248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 002573208 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2017-10-23 00:09 - 2017-10-23 00:09 - 002474080 _____ C:\WINDOWS\SysWOW64\Windows.Mirage.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 002400664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2017-10-23 00:09 - 2017-10-23 00:09 - 002106880 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2017-10-23 00:09 - 2017-10-23 00:09 - 001856000 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 001822208 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 001664000 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 001641536 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 001633744 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 001587200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 001559552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 001554216 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 001547264 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 001528912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 001470976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 001463856 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 001436432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 001323840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 001261864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.appcore.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 001200024 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2017-10-23 00:09 - 2017-10-23 00:09 - 001165824 _____ (Microsoft Corporation) C:\WINDOWS\system32\ISM.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 001053592 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2017-10-23 00:09 - 2017-10-23 00:09 - 000925184 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000812032 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000778936 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2017-10-23 00:09 - 2017-10-23 00:09 - 000769024 _____ (Microsoft Corporation) C:\WINDOWS\system32\PCPKsp.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000739696 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsapi.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000726016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv2.sys
2017-10-23 00:09 - 2017-10-23 00:09 - 000708096 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000677280 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2017-10-23 00:09 - 2017-10-23 00:09 - 000665088 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmCoreProvisioning.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000664576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000664576 _____ (Microsoft Corporation) C:\WINDOWS\system32\DHolographicDisplay.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000649304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2017-10-23 00:09 - 2017-10-23 00:09 - 000640512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mswstr10.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000597160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dnsapi.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000591872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PCPKsp.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000566272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TpmCoreProvisioning.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000559000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2017-10-23 00:09 - 2017-10-23 00:09 - 000542208 _____ (Microsoft Corporation) C:\WINDOWS\system32\FirewallAPI.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000538624 _____ (Microsoft Corporation) C:\WINDOWS\system32\HolographicExtensions.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000529408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\nwifi.sys
2017-10-23 00:09 - 2017-10-23 00:09 - 000478208 _____ (Microsoft Corporation) C:\WINDOWS\system32\NgcCtnr.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000464416 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcryptprimitives.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000461312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansec.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000442880 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptngc.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000422912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv.sys
2017-10-23 00:09 - 2017-10-23 00:09 - 000418712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000374784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FirewallAPI.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000373656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys
2017-10-23 00:09 - 2017-10-23 00:09 - 000353688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000345088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msexcl40.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000336896 _____ (Microsoft Corporation) C:\WINDOWS\system32\HolographicRuntimes.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000326144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptngc.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000285696 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb10.sys
2017-10-23 00:09 - 2017-10-23 00:09 - 000246168 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000232344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2017-10-23 00:09 - 2017-10-23 00:09 - 000184984 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspicli.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000177664 _____ (Microsoft Corporation) C:\WINDOWS\system32\t2embed.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000139672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecdd.sys
2017-10-23 00:09 - 2017-10-23 00:09 - 000136192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\t2embed.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000123520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sspicli.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000106496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\XblAuthTokenBrokerExt.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000070656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XblAuthTokenBrokerExt.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000060824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\urscx01000.sys
2017-10-23 00:09 - 2017-10-23 00:09 - 000058880 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmTasks.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000057344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\UcmUcsi.sys
2017-10-23 00:09 - 2017-10-23 00:09 - 000045976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storufs.sys
2017-10-23 00:09 - 2017-10-23 00:09 - 000034816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\BasicRender.sys
2017-10-23 00:09 - 2017-10-23 00:09 - 000028672 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspisrv.dll
2017-10-23 00:09 - 2017-10-23 00:09 - 000008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msjint40.dll
2017-10-22 23:45 - 2017-10-22 23:46 - 000007623 _____ C:\WINDOWS\diagwrn.xml
2017-10-22 23:45 - 2017-10-22 23:46 - 000007623 _____ C:\WINDOWS\diagerr.xml
2017-10-22 23:44 - 2017-11-17 23:25 - 000003634 _____ C:\WINDOWS\System32\Tasks\CreateExplorerShellUnelevatedTask
2017-10-22 23:44 - 2017-11-16 06:08 - 000003516 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2017-10-22 23:44 - 2017-11-16 06:08 - 000003392 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2017-10-22 23:44 - 2017-11-08 05:55 - 000003356 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-3545060876-3950350259-1486773641-1001
2017-10-22 23:44 - 2017-11-04 19:08 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-10-22 23:44 - 2017-10-22 23:44 - 000022744 _____ C:\WINDOWS\system32\emptyregdb.dat
2017-10-22 23:44 - 2017-10-22 23:44 - 000002548 _____ C:\WINDOWS\System32\Tasks\AutoPico Daily Restart
2017-10-22 23:44 - 2017-10-22 23:44 - 000000000 ____D C:\WINDOWS\System32\Tasks\S-1-5-21-3545060876-3950350259-1486773641-1001
2017-10-22 23:43 - 2017-11-04 19:15 - 000849518 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-10-22 23:41 - 2017-10-22 23:41 - 000000000 ____H C:\$WINRE_BACKUP_PARTITION.MARKER
2017-10-22 23:34 - 2017-10-22 23:34 - 000000000 ____D C:\ProgramData\USOShared
2017-10-22 23:31 - 2017-10-22 23:31 - 000001576 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2017-10-22 23:29 - 2017-10-23 05:32 - 000000000 ____D C:\Users\mrawk\AppData\Local\Packages
2017-10-22 23:28 - 2017-10-23 05:15 - 000000000 ____D C:\Users\mrawk
2017-10-22 23:27 - 2016-11-14 11:45 - 000615992 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvStreaming.exe
2017-10-22 23:26 - 2017-09-29 15:41 - 002241024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2017-10-22 23:22 - 2017-11-19 14:06 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2017-10-22 19:31 - 2017-11-04 17:04 - 000000000 ___DC C:\WINDOWS\Panther
2017-10-22 11:27 - 2017-10-22 11:27 - 000000000 _____ C:\WINDOWS\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2017-10-22 07:43 - 2017-10-22 07:44 - 000000048 _____ C:\Users\mrawk\Desktop\Iobit Uninstaller Pro 7 Free license.txt
2017-10-22 07:39 - 2017-10-29 09:02 - 000000000 ____D C:\ProgramData\ProductData
2017-10-22 07:39 - 2017-10-23 00:18 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IObit Uninstaller
2017-10-22 07:39 - 2017-10-22 07:39 - 000001443 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IObit Uninstaller.lnk
2017-10-22 07:39 - 2017-10-22 07:39 - 000001431 _____ C:\Users\Public\Desktop\IObit Uninstaller.lnk
2017-10-22 07:39 - 2017-10-22 07:39 - 000000000 ____D C:\Users\mrawk\AppData\LocalLow\IObit
2017-10-22 07:38 - 2017-10-22 07:38 - 000000000 ____D C:\Program Files (x86)\IObit
2017-10-22 07:37 - 2017-10-22 07:43 - 000000000 ____D C:\Users\mrawk\AppData\Roaming\IObit
2017-10-22 07:37 - 2017-10-22 07:40 - 000000000 ____D C:\ProgramData\IObit
2017-10-22 07:37 - 2017-10-22 07:37 - 015873400 _____ (IObit ) C:\Users\mrawk\Downloads\iobituninstaller.exe
2017-10-20 05:55 - 2017-10-20 05:55 - 000069632 _____ C:\Users\mrawk\Downloads\programa.xls
2017-10-20 05:53 - 2017-10-20 05:53 - 000026509 _____ C:\Users\mrawk\Downloads\Kontrolni_klasni.xlsx

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-11-19 14:41 - 2017-09-07 10:53 - 000000000 ____D C:\Users\mrawk\AppData\Roaming\uTorrent
2017-11-19 14:10 - 2017-09-29 15:46 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
2017-11-19 14:10 - 2017-09-29 15:46 - 000000000 ____D C:\WINDOWS\system32\Macromed
2017-11-19 14:10 - 2017-09-07 10:06 - 000000000 ____D C:\Users\mrawk\AppData\LocalLow\Mozilla
2017-11-19 13:01 - 2017-09-07 10:56 - 000000000 ____D C:\ФИЛМИ
2017-11-19 07:00 - 2017-09-29 15:46 - 000000000 ____D C:\WINDOWS\DeliveryOptimization
2017-11-19 06:59 - 2017-09-29 15:46 - 000000000 ___HD C:\Program Files\WindowsApps
2017-11-19 06:59 - 2017-09-29 15:46 - 000000000 ____D C:\WINDOWS\AppReadiness
2017-11-19 00:25 - 2017-09-22 20:36 - 000000000 ___HD C:\_acestream_cache_
2017-11-18 22:07 - 2017-09-22 20:35 - 000000000 ____D C:\Users\mrawk\AppData\Roaming\.ACEStream
2017-11-18 21:47 - 2017-09-07 10:12 - 000000000 ____D C:\WINDOWS\system32\MRT
2017-11-18 21:41 - 2017-10-11 05:59 - 127017032 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT-KB890830.exe
2017-11-18 21:41 - 2017-09-07 10:12 - 127017032 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2017-11-18 21:32 - 2017-03-18 23:03 - 000000167 _____ C:\WINDOWS\win.ini
2017-11-16 09:10 - 2017-09-07 10:06 - 000000000 ____D C:\Users\mrawk\AppData\Roaming\Mozilla
2017-11-16 09:10 - 2017-09-07 10:06 - 000000000 ____D C:\Users\mrawk\AppData\Local\Mozilla
2017-11-16 06:16 - 2017-09-07 10:11 - 000002270 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-11-16 06:16 - 2017-09-07 10:11 - 000002258 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-11-15 06:32 - 2017-09-29 15:37 - 000000000 ____D C:\WINDOWS\CbsTemp
2017-11-12 09:25 - 2017-09-29 15:44 - 000000000 ____D C:\WINDOWS\INF
2017-11-08 05:55 - 2017-09-07 09:32 - 000002429 _____ C:\Users\mrawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2017-11-08 05:55 - 2017-09-07 09:32 - 000000000 ___RD C:\Users\mrawk\OneDrive
2017-11-04 19:08 - 2017-09-29 10:45 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2017-11-04 19:08 - 2017-09-07 09:27 - 000000000 ____D C:\ProgramData\NVIDIA
2017-11-04 17:39 - 2017-09-29 15:46 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2017-11-04 17:39 - 2017-09-15 06:15 - 000000000 ____D C:\Users\mrawk\AppData\Local\CrashDumps
2017-11-04 03:25 - 2017-09-29 15:49 - 000835568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2017-11-04 03:25 - 2017-09-29 15:49 - 000177648 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2017-10-30 09:37 - 2017-09-07 21:05 - 000001235 _____ C:\Users\mrawk\Desktop\PotPlayer.lnk
2017-10-26 09:16 - 2017-09-29 15:46 - 000000000 ____D C:\WINDOWS\rescache
2017-10-23 05:31 - 2017-09-29 15:46 - 000000000 ___RD C:\WINDOWS\PrintDialog
2017-10-23 05:14 - 2017-09-07 09:28 - 000000000 __RHD C:\Users\Public\AccountPictures
2017-10-23 05:14 - 2017-09-07 09:28 - 000000000 ____D C:\Users\mrawk\AppData\Local\TileDataLayer
2017-10-23 02:24 - 2017-09-29 15:46 - 000000000 ____D C:\WINDOWS\appcompat
2017-10-23 00:21 - 2017-09-29 15:46 - 000028672 _____ C:\WINDOWS\system32\config\BCD-Template
2017-10-23 00:18 - 2017-09-29 15:46 - 000000000 ____D C:\WINDOWS\system32\WinBioDatabase
2017-10-23 00:18 - 2017-09-29 15:46 - 000000000 ____D C:\WINDOWS\system32\spool
2017-10-23 00:18 - 2017-09-29 15:46 - 000000000 ____D C:\WINDOWS\system32\NDF
2017-10-23 00:18 - 2017-09-29 15:46 - 000000000 ____D C:\WINDOWS\Help
2017-10-23 00:18 - 2017-09-29 15:46 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2017-10-23 00:18 - 2017-09-29 15:46 - 000000000 ____D C:\Program Files\Common Files\microsoft shared
2017-10-23 00:18 - 2017-09-09 08:03 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Инструменти на Microsoft Office 2016
2017-10-23 00:18 - 2017-09-09 07:58 - 000000000 ____D C:\WINDOWS\SHELLNEW
2017-10-23 00:18 - 2017-09-07 10:24 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico
2017-10-23 00:18 - 2017-03-18 23:03 - 000000000 ____D C:\WINDOWS\system32\Tasks_Migrated
2017-10-23 00:17 - 2017-09-29 15:49 - 000000000 ____D C:\WINDOWS\Setup
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\zu-ZA
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\yo-NG
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\xh-ZA
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\wo-SN
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\vi-VN
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\uz-Latn-UZ
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\ur-PK
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\ug-CN
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\tt-RU
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\tn-ZA
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\tk-TM
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\ti-ET
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\tg-Cyrl-TJ
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\te-IN
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\ta-IN
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\sw-KE
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\sr-Cyrl-RS
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\sr-Cyrl-BA
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\sq-AL
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\si-LK
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\sd-Arab-PK
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\rw-RW
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\quz-PE
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\quc-Latn-GT
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\prs-AF
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\pa-IN
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\pa-Arab-PK
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\or-IN
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\nso-ZA
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\nn-NO
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\ne-NP
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\mt-MT
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\mr-IN
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\mn-MN
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\ml-IN
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\mk-MK
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\mi-NZ
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\lo-LA
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\lb-LU
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\ky-KG
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\ku-Arab-IQ
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\kok-IN
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\kn-IN
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\km-KH
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\kk-KZ
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\ka-GE
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\is-IS
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\ig-NG
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\id-ID
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\hy-AM
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\ha-Latn-NG
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\gu-IN
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\gd-GB
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\ga-IE
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\fil-PH
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\fa-IR
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\cy-GB
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\chr-CHER-US
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\ca-ES-valencia
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\bs-Latn-BA
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\bn-IN
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\bn-BD
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\be-BY
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\az-Latn-AZ
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\as-IN
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\am-ET
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\SysWOW64\af-ZA
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\zu-ZA
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\yo-NG
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\xh-ZA
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\wo-SN
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\vi-VN
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\uz-Latn-UZ
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\ur-PK
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\ug-CN
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\tt-RU
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\tn-ZA
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\tk-TM
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\ti-ET
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\tg-Cyrl-TJ
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\te-IN
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\ta-IN
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\sw-KE
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\sr-Cyrl-RS
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\sr-Cyrl-BA
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\sq-AL
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\si-LK
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\sd-Arab-PK
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\rw-RW
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\quz-PE
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\quc-Latn-GT
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\prs-AF
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\pa-IN
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\pa-Arab-PK
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\or-IN
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\nso-ZA
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\nn-NO
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\ne-NP
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\mt-MT
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\mr-IN
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\mn-MN
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\ml-IN
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\mk-MK
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\mi-NZ
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\lo-LA
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\lb-LU
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\ky-KG
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\ku-Arab-IQ
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\kok-IN
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\kn-IN
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\km-KH
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\kk-KZ
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\ka-GE
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\is-IS
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\ig-NG
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\id-ID
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\hy-AM
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\ha-Latn-NG
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\gu-IN
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\gd-GB
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\ga-IE
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\fil-PH
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\fa-IR
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\cy-GB
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\chr-CHER-US
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\ca-ES-valencia
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\bs-Latn-BA
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\bn-IN
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\bn-BD
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\be-BY
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\az-Latn-AZ
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\as-IN
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\am-ET
2017-10-23 00:10 - 2017-09-30 16:36 - 000000000 ____D C:\WINDOWS\system32\af-ZA
2017-10-23 00:10 - 2017-09-29 15:46 - 000000000 ____D C:\WINDOWS\system32\appraiser
2017-10-22 23:46 - 2017-09-29 10:45 - 000032768 _____ C:\WINDOWS\system32\config\ELAM
2017-10-22 23:45 - 2017-09-29 15:46 - 000000000 ____D C:\WINDOWS\Registration
2017-10-22 23:44 - 2017-09-29 15:46 - 000000000 __RHD C:\Users\Public\Libraries
2017-10-22 23:44 - 2017-09-07 09:50 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2017-10-22 23:35 - 2017-09-30 06:42 - 000000000 ____D C:\Users\mrawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yamicsoft
2017-10-22 23:34 - 2017-09-29 15:46 - 000000000 ____D C:\ProgramData\USOPrivate
2017-10-22 23:31 - 2017-09-29 15:46 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2017-10-22 23:27 - 2017-09-29 10:45 - 000000000 ____D C:\WINDOWS\system32\Sysprep
2017-10-22 23:24 - 2017-09-07 09:26 - 000000000 ____D C:\Program Files\NVIDIA Corporation
2017-10-22 22:38 - 2017-09-07 10:09 - 000008192 __RSH C:\BOOTSECT.BAK

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-11-12 09:38

==================== End of FRST.txt ============================

Addition.txt

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

20 ноември 20178 г.

преди 20 часа, SIMO70 написа:

А това са логовете от настолният комп.

Тук мисля всичко е наред....! Не виждам активни зарази..!

20 ноември 20178 г.

Автор

преди 21 минути, icotonev написа:

Тук мисля всичко е наред....! Не виждам активни зарази..!

Благодаря за отделеното време.На лаптопа имаше ли нещо притеснително или не.

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

20 ноември 20178 г.

Само остатъци..Предполагам че при сканиране с Malwarebytes ....са изчистени зарази...!

Остана да премахнем програмите които използвахме:

Изтеглете DelFix и го стартирайте. Сложете отметка пред:

Remove disinfection tools <----- това ще премахне инструментите които сме използвали
Create registry backup <----- тази опция ще създадете резервно копие от регистъра на Windows
Purge system restore <--- това ще премахне всички предишни точки за възстановяване, ще бъде създадена нова точка на състоянието на системата в момента.
Reset system settings <--- това ще нулира всички настройки на системата и по подразбиране, които са били променени или от нас по време на почистването или от зловреден софтуер / инфекция

..и след това натиснете бутона Run

След като операцията е завърши,ще се създаде дневник
Копирате го и го поставите в следващия си отговор

Инструмента ще се самоизтрие след като приключи своята задача!

Ако има нещо което използвахме в лечението до тук и не се е премахнало след последните инструкции го премахнете ръчно ,по стандартните методи..!

Деинсталирайте Zemana AntiMalware по стандартния метод...!

Остана само Malwarebytes...Тук има два варианта ..или да оставите програмата на вашия компютър и периодично да сканирате системата си с нея (поне един -два пъти в седмицата),като не забравяйте да обновите дефинициите и преди всяко сканиране..както и да изключите защитата в реално време на програмата. Другия е да я деинсталирате:

Mоля, използвайте инструмента Malwarebytes Clean Uninstall Tool .Естествено ако искате програмата да остане Този инструмент е създаден, за да премахне напълно всички следи от програмата от вашия компютър.

Изтеглете и стартирайте mb_clean.exe
Когато инструмента приключи работата си, рестартирайте компютъра

Забележка : Този инструмент ще премахне напълно всички настройки, които сте конфигурирали, лицензионната информация и всичко останало свързано с Malwarebytes.

Поздрави и спокойна вечер пожелавам...!

Дневници :

В следващия си отговор, моля да включите следните дневници:

DelFix

20 ноември 20178 г.

Автор

# DelFix v1.013 - Logfile created 20/11/2017 at 19:05:26
# Updated 17/04/2016 by Xplode
# Username : симо7 - СИМО
# Operating System : Windows 8.1 Pro (64 bits)

~ Removing disinfection tools ...

Deleted : C:\FRST
Deleted : C:\SecurityCheck
Deleted : C:\Users\симо7\Desktop\Addition.txt
Deleted : C:\Users\симо7\Desktop\Fixlog.txt
Deleted : C:\Users\симо7\Desktop\FRST.txt
Deleted : C:\Users\симо7\Desktop\FRST64.exe
Deleted : C:\Users\симо7\Desktop\SecurityCheck.exe

~ Creating registry backup ... OK

~ Cleaning system restore ...

New restore point created !

~ Resetting system settings ... OK

########## - EOF - ##########

Добре дошли!

Съмнения за вирус

Featured Replies

Архивирана тема

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)