Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

Съмнения за coin miner trojan

9 декември 20187 г.

Здравейте искам да попитам след като Windows Defender ми откри Coin Miner троянец следователно "УЖ" го премахна имам съмнения че не е премахнат защото при инсталирането на програмата PeerBlock и слагането на Black list от peerblocklist.com

във самата програма стана страшно направо както че и след пускането процесора олекна малко

изтеглих Farbar както е записано в правилата ето ги логовете

Цитат

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 09.12.2018
Ran by Micr0 (administrator) on MICR0-PC (09-12-2018 20:54:32)
Running from C:\Users\Micr0\Desktop\full_blacklist_database
Loaded Profiles: Micr0 (Available Profiles: Micr0)
Platform: Windows 10 Pro Version 1803 17134.407 (X64) Language: Български (България)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
() C:\Program Files\MySQL\MySQL Server 5.7\bin\mysqld.exe
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1810.5-0\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
() C:\Program Files (x86)\ASRock Utility\APP Shop\AsrAPPShop.exe
(Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1810.5-0\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.35.76.0_x64__kzf8qxf38zg5c\SkypeApp.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.35.76.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.10314.31700.1000_x64__8wekyb3d8bbwe\Office16\OfficeHubTaskHost.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18082.13811.0_x64__8wekyb3d8bbwe\Video.UI.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Wondershare) C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(PeerBlock, LLC) C:\Program Files\PeerBlock\peerblock.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler64.exe
(Microsoft Corporation) C:\Program Files\rempl\sedsvc.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.35.76.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsStore_11810.1001.12.0_x64__8wekyb3d8bbwe\WinStore.App.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [638872 2018-04-12] (Microsoft Corporation)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [320568 2016-09-20] (Intel Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [16407296 2015-10-30] (Realtek Semiconductor)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2137744 2016-10-08] (Wondershare)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [653648 2018-06-27] (Oracle Corporation)
HKU\S-1-5-19\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-12] (Microsoft Corporation)
HKU\S-1-5-20\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-12] (Microsoft Corporation)
HKU\S-1-5-21-2968841199-4106751538-2094254156-1000\...\Run: [uTorrent] => C:\Program Files (x86)\uTorrent\uTorrent.exe [328568 2017-11-19] (BitTorrent, Inc.)
HKU\S-1-5-21-2968841199-4106751538-2094254156-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3131680 2018-11-26] (Valve Corporation)
HKU\S-1-5-21-2968841199-4106751538-2094254156-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-2968841199-4106751538-2094254156-1000\...\Run: [GoogleChromeAutoLaunch_277C86A9CBD55D75AE854C3BD257FDE5] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [1589080 2018-11-16] (Google Inc.)
HKU\S-1-5-21-2968841199-4106751538-2094254156-1000\...\Run: [PeerBlock] => C:\Program Files\PeerBlock\peerblock.exe [2513992 2014-01-14] (PeerBlock, LLC)
HKU\S-1-5-21-2968841199-4106751538-2094254156-1000\...\MountPoints2: {474d8982-db6e-11e8-b032-7085c2344e74} - "F:\HiSuiteDownLoader.exe"
GroupPolicy: Restriction ? <==== ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{A06A16BA-A7FC-4A5E-A1A1-2B417E44F21C}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKU\S-1-5-21-2968841199-4106751538-2094254156-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://go.microsoft.com/fwlink/p/?LinkId=619797&pc=UE01&ocid=UE01DHP
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre-10.0.2\bin\ssv.dll => No File
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre-10.0.2\bin\jp2ssv.dll [2018-09-22] (Oracle Corporation)
BHO-x32: Microsoft Web Test Recorder 12.0 Helper -> {432dd630-7e03-4c97-9d62-b99f52df4fc2} -> D:\Programi\Visual Studio\Visual Studio 2013\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll [2013-10-05] (Microsoft Corporation)

FireFox:
========
FF Plugin: @java.com/DTPlugin,version=13.0.2.0 -> C:\Program Files\Java\jre-10.0.2\bin\dtplugin\npDeployJava1.dll [2018-09-22] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=13.0.2.0 -> C:\Program Files\Java\jre-10.0.2\bin\plugin2\npjp2.dll [2018-09-22] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll [2013-05-13] ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-18] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-18] (Google Inc.)

Chrome:
=======
CHR StartupUrls: Default -> "hxxp://istart.webssearches.com/?type=hppp&ts=1422310551&from=kmp&uid=ST3160815AS_5RA0F530XXXX5RA0F530"
CHR Profile: C:\Users\Micr0\AppData\Local\Google\Chrome\User Data\Default [2018-12-09]
CHR Extension: (Презентации) - C:\Users\Micr0\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-11-19]
CHR Extension: (Документи) - C:\Users\Micr0\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-11-19]
CHR Extension: (Google Диск) - C:\Users\Micr0\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2018-11-06]
CHR Extension: (YouTube) - C:\Users\Micr0\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-11-19]
CHR Extension: (Таблици) - C:\Users\Micr0\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-11-19]
CHR Extension: (Отдалечен работен плот на Chrome) - C:\Users\Micr0\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbchcmhmhahfdphkhkmpfmihenigjmpp [2018-10-10]
CHR Extension: (Google Документи офлайн) - C:\Users\Micr0\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-08-17]
CHR Extension: (Save to Facebook) - C:\Users\Micr0\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfikkaogpplgnfjmbjdpalkhclendgd [2017-11-19]
CHR Extension: (Плащания в уеб магазина на Chrome) - C:\Users\Micr0\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-04-04]
CHR Extension: (Gmail) - C:\Users\Micr0\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-11-19]
CHR Extension: (Chrome Media Router) - C:\Users\Micr0\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-11-09]
CHR Extension: (JobBoxPro) - D:\jobboxpro\jobboxpro [2017-01-25]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [6971400 2018-01-15] ()
S3 c2wts; C:\Program Files\Windows Identity Foundation\v3.5\c2wtshost.exe [5632 2018-04-12] (Microsoft Corporation)
S3 EasyAntiCheat; C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe [780928 2018-10-03] (EasyAntiCheat Ltd)
S3 fussvc; C:\Program Files (x86)\Windows Kits\8.1\App Certification Kit\fussvc.exe [142336 2013-08-22] (Microsoft Corporation) [File not signed]
U2 HiPatchService; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9728 2018-06-11] (Hi-Rez Studios) [File not signed]
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [17976 2016-09-20] (Intel Corporation)
S3 JBossWeb; D:\Programi\JBoss Web 2.1\bin\jbossweb.exe [110592 2010-07-29] (Red Hat®, Inc.) [File not signed]
R2 MySQL57; C:\Program Files\MySQL\MySQL Server 5.7\bin\mysqld.exe [39551488 2017-12-28] () [File not signed]
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [4737448 2018-07-15] (Microsoft Corporation)
S4 ssh-agent; C:\WINDOWS\System32\OpenSSH\ssh-agent.exe [495616 2018-03-10] ()
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
S3 Te.Service; C:\Program Files (x86)\Windows Kits\8.1\Testing\Runtimes\TAEF\Wex.Services.exe [119808 2013-08-22] (Microsoft Corporation) [File not signed]
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [11294448 2018-03-09] (TeamViewer GmbH)
S3 VsEtwService120; C:\Program Files\Microsoft Visual Studio 12.0\Common7\Packages\Debugger\Services\VsEtwService.exe [87728 2013-10-04] (Microsoft Corporation)
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1810.5-0\NisSrv.exe [3917016 2018-10-23] (Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1810.5-0\MsMpEng.exe [114208 2018-10-23] (Microsoft Corporation)
R2 NVDisplay.ContainerLocalSystem; "C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe" -s NVDisplay.ContainerLocalSystem -f "C:\ProgramData\NVIDIA\NVDisplay.ContainerLocalSystem.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem" -r -p 30000
R2 NvTelemetryContainer; "C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe" -s NvTelemetryContainer -f "C:\ProgramData\NVIDIA\NvTelemetryContainer.log" -l 3 -d "C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\plugins" -r

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2014-01-28] ()
R3 AsrAutoChkUpdDrv; C:\WINDOWS\SysWOW64\Drivers\AsrAutoChkUpdDrv.sys [22280 2018-12-09] (ASRock Incorporation)
S3 AsrDrv101; C:\WINDOWS\SysWOW64\Drivers\AsrDrv101.sys [22280 2017-11-19] (ASRock Incorporation)
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131984 2017-05-18] (Samsung Electronics Co., Ltd.)
S3 DIRECTIO37; C:\Program Files\BurnInTest\DirectIo64.sys [31376 2015-02-16] ()
R1 MpKsl58e40453; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{5C9D43ED-AA87-4D9E-AD8C-49B1FF9CC834}\MpKsl58e40453.sys [58120 2018-12-08] (Microsoft Corporation)
R3 nvlddmkm; C:\WINDOWS\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_6bc621d9790e90e7\nvlddmkm.sys [20365000 2018-11-05] (NVIDIA Corporation)
R3 pbfilter; C:\Program Files\PeerBlock\pbfilter.sys [22600 2014-01-14] ()
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [984032 2017-06-05] (Realtek )
R3 SensorsSimulatorDriver; C:\WINDOWS\System32\drivers\WUDFRd.sys [264192 2018-04-12] (Microsoft Corporation)
S3 smbdirect; C:\WINDOWS\System32\DRIVERS\smbdirect.sys [152064 2018-04-12] (Microsoft Corporation)
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [166288 2017-05-18] (Samsung Electronics Co., Ltd.)
R0 VMSNPXY; C:\WINDOWS\System32\drivers\VmsProxyHNic.sys [36768 2018-04-12] (Microsoft Corporation)
S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [46184 2018-10-23] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [328696 2018-10-23] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [60408 2018-10-23] (Microsoft Corporation)
S3 xhunter1; C:\WINDOWS\xhunter1.sys [55704 2018-11-18] (Wellbia.com Co., Ltd.)
U3 idsvc; no ImagePath
S4 nvvad_WaveExtensible; \SystemRoot\system32\drivers\nvvad64v.sys [X]
S4 nvvhci; \SystemRoot\System32\drivers\nvvhci.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-12-09 20:54 - 2018-12-09 20:54 - 000000000 ____D C:\FRST
2018-12-09 16:39 - 2018-12-09 16:39 - 000000477 _____ C:\Users\Micr0\Desktop\xpbqleszmajjesnzddhv.gz
2018-12-09 16:39 - 2018-12-08 18:28 - 000001341 _____ C:\Users\Micr0\Desktop\xpbqleszmajjesnzddhv.txt
2018-12-09 16:36 - 2018-12-09 20:54 - 000000000 ____D C:\Users\Micr0\Desktop\full_blacklist_database
2018-12-09 16:34 - 2018-12-09 16:34 - 000607911 _____ C:\Users\Micr0\Desktop\full_blacklist_database.zip
2018-12-08 22:41 - 2018-12-09 17:02 - 000000000 ____D C:\Program Files\PeerBlock
2018-12-08 22:41 - 2018-12-08 22:41 - 000001777 _____ C:\Users\Micr0\Desktop\PeerBlock.lnk
2018-12-08 22:41 - 2018-12-08 22:41 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PeerBlock
2018-12-08 22:29 - 2018-12-08 22:32 - 000000000 ____D C:\Users\Micr0\Desktop\Нова папка (7)
2018-11-30 00:11 - 2018-11-30 00:11 - 000000000 ___HD C:\OneDriveTemp
2018-11-21 22:22 - 2018-11-21 22:22 - 001875478 _____ C:\Users\Micr0\composer.phar
2018-11-21 22:18 - 2018-11-21 22:18 - 000000000 ____D C:\Users\Micr0\AppData\Roaming\Composer
2018-11-21 22:18 - 2018-11-21 22:18 - 000000000 ____D C:\composer
2018-11-21 22:17 - 2018-11-21 22:17 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XAMPP
2018-11-21 22:13 - 2018-11-21 22:17 - 000000000 ____D C:\xampp
2018-11-21 18:07 - 2018-11-21 18:07 - 000000179 _____ C:\Users\Micr0\.gitconfig
2018-11-21 18:07 - 2018-11-21 18:07 - 000000000 ____D C:\Users\Micr0\Documents\GitHub
2018-11-21 18:03 - 2018-11-21 18:04 - 000000000 ____D C:\Users\Micr0\AppData\Local\GitHubDesktop
2018-11-16 22:33 - 2018-12-01 06:01 - 000835688 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2018-11-16 22:33 - 2018-12-01 06:01 - 000179808 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2018-11-16 19:18 - 2018-12-07 07:05 - 000000000 ____D C:\Program Files\rempl
2018-11-14 18:07 - 2018-11-01 13:45 - 004527776 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe
2018-11-14 18:07 - 2018-11-01 11:15 - 023861760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Hydrogen.dll
2018-11-14 18:07 - 2018-11-01 09:25 - 007520088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2018-11-14 18:07 - 2018-11-01 09:09 - 025855488 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2018-11-14 18:07 - 2018-11-01 09:01 - 022716416 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2018-11-14 18:07 - 2018-11-01 06:47 - 006570368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2018-11-14 18:07 - 2018-11-01 06:40 - 022015488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2018-11-14 18:07 - 2018-10-21 15:00 - 021386368 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2018-11-14 18:06 - 2018-11-01 13:49 - 000348160 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotifyIcon.exe
2018-11-14 18:06 - 2018-11-01 13:46 - 002394960 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMVCORE.DLL
2018-11-14 18:06 - 2018-11-01 13:45 - 001617320 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2018-11-14 18:06 - 2018-11-01 13:45 - 001376672 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2018-11-14 18:06 - 2018-11-01 13:32 - 000064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\iemigplugin.dll
2018-11-14 18:06 - 2018-11-01 13:31 - 006602240 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2018-11-14 18:06 - 2018-11-01 13:30 - 000122368 _____ (Microsoft Corporation) C:\WINDOWS\system32\musdialoghandlers.dll
2018-11-14 18:06 - 2018-11-01 13:30 - 000029696 _____ (Microsoft Corporation) C:\WINDOWS\system32\msisip.dll
2018-11-14 18:06 - 2018-11-01 13:29 - 012710400 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2018-11-14 18:06 - 2018-11-01 13:29 - 000073728 _____ (Microsoft Corporation) C:\WINDOWS\system32\SMSRouter.dll
2018-11-14 18:06 - 2018-11-01 13:28 - 004491264 _____ (Microsoft Corporation) C:\WINDOWS\system32\xpsrchvw.exe
2018-11-14 18:06 - 2018-11-01 13:28 - 003649024 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2018-11-14 18:06 - 2018-11-01 13:28 - 000253952 _____ (Microsoft Corporation) C:\WINDOWS\system32\prnntfy.dll
2018-11-14 18:06 - 2018-11-01 13:27 - 001121792 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWorkspace.dll
2018-11-14 18:06 - 2018-11-01 13:27 - 000878592 _____ (Microsoft Corporation) C:\WINDOWS\system32\CPFilters.dll
2018-11-14 18:06 - 2018-11-01 13:26 - 001364992 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvruserservice.dll
2018-11-14 18:06 - 2018-11-01 13:26 - 000503296 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcext.dll
2018-11-14 18:06 - 2018-11-01 13:26 - 000463872 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpshell.exe
2018-11-14 18:06 - 2018-11-01 13:26 - 000392192 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2018-11-14 18:06 - 2018-11-01 13:26 - 000327168 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpinit.exe
2018-11-14 18:06 - 2018-11-01 13:25 - 000577024 _____ (Microsoft Corporation) C:\WINDOWS\system32\SppExtComObj.Exe
2018-11-14 18:06 - 2018-11-01 12:09 - 001027000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2018-11-14 18:06 - 2018-11-01 11:59 - 005669888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2018-11-14 18:06 - 2018-11-01 11:56 - 011902464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2018-11-14 18:06 - 2018-11-01 11:56 - 000226304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\prnntfy.dll
2018-11-14 18:06 - 2018-11-01 11:56 - 000024576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msisip.dll
2018-11-14 18:06 - 2018-11-01 11:54 - 003397632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xpsrchvw.exe
2018-11-14 18:06 - 2018-11-01 11:54 - 000344576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2018-11-14 18:06 - 2018-11-01 11:53 - 000908288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TSWorkspace.dll
2018-11-14 18:06 - 2018-11-01 11:52 - 002892800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2018-11-14 18:06 - 2018-11-01 11:13 - 019525120 _____ (Microsoft Corporation) C:\WINDOWS\system32\HologramCompositor.dll
2018-11-14 18:06 - 2018-11-01 09:39 - 001035256 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplyTrustOffline.exe
2018-11-14 18:06 - 2018-11-01 09:38 - 000269336 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave_secure.dll
2018-11-14 18:06 - 2018-11-01 09:37 - 000272408 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave.dll
2018-11-14 18:06 - 2018-11-01 09:28 - 001221432 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2018-11-14 18:06 - 2018-11-01 09:28 - 001062712 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2018-11-14 18:06 - 2018-11-01 09:28 - 001029944 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2018-11-14 18:06 - 2018-11-01 09:28 - 000566568 _____ (Microsoft Corporation) C:\WINDOWS\system32\tcblaunch.exe
2018-11-14 18:06 - 2018-11-01 09:28 - 000134968 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll
2018-11-14 18:06 - 2018-11-01 09:28 - 000076088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hvservice.sys
2018-11-14 18:06 - 2018-11-01 09:27 - 001017152 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2adec.dll
2018-11-14 18:06 - 2018-11-01 09:27 - 000491200 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf.dll
2018-11-14 18:06 - 2018-11-01 09:26 - 007432120 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2018-11-14 18:06 - 2018-11-01 09:26 - 003291640 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll
2018-11-14 18:06 - 2018-11-01 09:26 - 003180080 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11.dll
2018-11-14 18:06 - 2018-11-01 09:26 - 001363536 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinTypes.dll
2018-11-14 18:06 - 2018-11-01 09:25 - 009089848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2018-11-14 18:06 - 2018-11-01 09:25 - 004404912 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2018-11-14 18:06 - 2018-11-01 09:25 - 002822456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2018-11-14 18:06 - 2018-11-01 09:25 - 002571320 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2018-11-14 18:06 - 2018-11-01 09:25 - 002371296 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll
2018-11-14 18:06 - 2018-11-01 09:25 - 001934808 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2018-11-14 18:06 - 2018-11-01 09:25 - 001784680 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll
2018-11-14 18:06 - 2018-11-01 09:25 - 001456728 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2018-11-14 18:06 - 2018-11-01 09:25 - 001288920 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll
2018-11-14 18:06 - 2018-11-01 09:25 - 001257880 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2018-11-14 18:06 - 2018-11-01 09:25 - 001209888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2018-11-14 18:06 - 2018-11-01 09:25 - 001190248 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2018-11-14 18:06 - 2018-11-01 09:25 - 001140672 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2018-11-14 18:06 - 2018-11-01 09:25 - 000982592 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2018-11-14 18:06 - 2018-11-01 09:25 - 000885968 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2018-11-14 18:06 - 2018-11-01 09:25 - 000793080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2018-11-14 18:06 - 2018-11-01 09:25 - 000713472 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVideoDSP.dll
2018-11-14 18:06 - 2018-11-01 09:25 - 000594224 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2018-11-14 18:06 - 2018-11-01 09:25 - 000463672 _____ (Microsoft Corporation) C:\WINDOWS\system32\coml2.dll
2018-11-14 18:06 - 2018-11-01 09:25 - 000413720 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2018-11-14 18:06 - 2018-11-01 09:25 - 000412984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2018-11-14 18:06 - 2018-11-01 09:25 - 000375824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msrpc.sys
2018-11-14 18:06 - 2018-11-01 09:25 - 000268088 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll
2018-11-14 18:06 - 2018-11-01 09:25 - 000261000 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2018-11-14 18:06 - 2018-11-01 09:03 - 003397120 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2018-11-14 18:06 - 2018-11-01 09:03 - 000034816 _____ (Microsoft Corporation) C:\WINDOWS\system32\dusmtask.exe
2018-11-14 18:06 - 2018-11-01 09:02 - 000047104 _____ (Microsoft Corporation) C:\WINDOWS\system32\dusmapi.dll
2018-11-14 18:06 - 2018-11-01 09:02 - 000023552 _____ (Microsoft Corporation) C:\WINDOWS\system32\CSystemEventsBrokerClient.dll
2018-11-14 18:06 - 2018-11-01 09:01 - 009084928 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll
2018-11-14 18:06 - 2018-11-01 09:01 - 007057408 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll
2018-11-14 18:06 - 2018-11-01 09:00 - 008189440 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2018-11-14 18:06 - 2018-11-01 09:00 - 006031360 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1.dll
2018-11-14 18:06 - 2018-11-01 09:00 - 003392000 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll
2018-11-14 18:06 - 2018-11-01 09:00 - 000433664 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
2018-11-14 18:06 - 2018-11-01 09:00 - 000209408 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXApplicabilityBlob.dll
2018-11-14 18:06 - 2018-11-01 08:59 - 000322048 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe
2018-11-14 18:06 - 2018-11-01 08:59 - 000241152 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringservice.dll
2018-11-14 18:06 - 2018-11-01 08:59 - 000192000 _____ (Microsoft Corporation) C:\WINDOWS\system32\scrrun.dll
2018-11-14 18:06 - 2018-11-01 08:59 - 000176128 _____ (Microsoft Corporation) C:\WINDOWS\system32\WPTaskScheduler.dll
2018-11-14 18:06 - 2018-11-01 08:59 - 000107520 _____ (Microsoft Corporation) C:\WINDOWS\system32\dab.dll
2018-11-14 18:06 - 2018-11-01 08:58 - 007573504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2018-11-14 18:06 - 2018-11-01 08:58 - 004867072 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2018-11-14 18:06 - 2018-11-01 08:58 - 004383744 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeContent.dll
2018-11-14 18:06 - 2018-11-01 08:58 - 000530432 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapConfiguration.dll
2018-11-14 18:06 - 2018-11-01 08:58 - 000273408 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll
2018-11-14 18:06 - 2018-11-01 08:58 - 000154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2018-11-14 18:06 - 2018-11-01 08:58 - 000149504 _____ (Microsoft Corporation) C:\WINDOWS\system32\dssvc.dll
2018-11-14 18:06 - 2018-11-01 08:57 - 003381248 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapRouter.dll
2018-11-14 18:06 - 2018-11-01 08:57 - 002825728 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapGeocoder.dll
2018-11-14 18:06 - 2018-11-01 08:57 - 002364928 _____ (Microsoft Corporation) C:\WINDOWS\system32\OpcServices.dll
2018-11-14 18:06 - 2018-11-01 08:57 - 001804288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2018-11-14 18:06 - 2018-11-01 08:57 - 001708544 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSPhotography.dll
2018-11-14 18:06 - 2018-11-01 08:57 - 000898560 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
2018-11-14 18:06 - 2018-11-01 08:57 - 000894464 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll
2018-11-14 18:06 - 2018-11-01 08:57 - 000835584 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneService.dll
2018-11-14 18:06 - 2018-11-01 08:57 - 000808448 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeManager.dll
2018-11-14 18:06 - 2018-11-01 08:57 - 000726528 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2018-11-14 18:06 - 2018-11-01 08:57 - 000356352 _____ (Microsoft Corporation) C:\WINDOWS\system32\dusmsvc.dll
2018-11-14 18:06 - 2018-11-01 08:57 - 000281600 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemEventsBrokerServer.dll
2018-11-14 18:06 - 2018-11-01 08:57 - 000265728 _____ (Microsoft Corporation) C:\WINDOWS\system32\psmsrv.dll
2018-11-14 18:06 - 2018-11-01 08:56 - 002929664 _____ (Microsoft Corporation) C:\WINDOWS\system32\xpsservices.dll
2018-11-14 18:06 - 2018-11-01 08:56 - 002172928 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2018-11-14 18:06 - 2018-11-01 08:56 - 001768448 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2018-11-14 18:06 - 2018-11-01 08:56 - 001395200 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2018-11-14 18:06 - 2018-11-01 08:56 - 000506880 _____ (Microsoft Corporation) C:\WINDOWS\system32\netprofmsvc.dll
2018-11-14 18:06 - 2018-11-01 08:55 - 002738688 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssrch.dll
2018-11-14 18:06 - 2018-11-01 08:55 - 001058304 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchIndexer.exe
2018-11-14 18:06 - 2018-11-01 08:55 - 000684544 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2018-11-14 18:06 - 2018-11-01 08:54 - 001679360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2018-11-14 18:06 - 2018-11-01 08:54 - 001551360 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2018-11-14 18:06 - 2018-11-01 08:54 - 001264640 _____ (Microsoft Corporation) C:\WINDOWS\system32\JpMapControl.dll
2018-11-14 18:06 - 2018-11-01 08:54 - 001225216 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsStore.dll
2018-11-14 18:06 - 2018-11-01 08:54 - 001023488 _____ (Microsoft Corporation) C:\WINDOWS\system32\ShareHost.dll
2018-11-14 18:06 - 2018-11-01 08:54 - 000943616 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingOnlineServices.dll
2018-11-14 18:06 - 2018-11-01 08:54 - 000916480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll
2018-11-14 18:06 - 2018-11-01 08:54 - 000895488 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.OnlineId.dll
2018-11-14 18:06 - 2018-11-01 08:54 - 000884736 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapControlCore.dll
2018-11-14 18:06 - 2018-11-01 08:54 - 000796672 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssvp.dll
2018-11-14 18:06 - 2018-11-01 08:54 - 000606208 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll
2018-11-14 18:06 - 2018-11-01 08:53 - 002248192 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidsvc.dll
2018-11-14 18:06 - 2018-11-01 08:53 - 001373696 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll
2018-11-14 18:06 - 2018-11-01 08:53 - 001159680 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll
2018-11-14 18:06 - 2018-11-01 08:53 - 000889344 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll
2018-11-14 18:06 - 2018-11-01 08:53 - 000542208 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2018-11-14 18:06 - 2018-11-01 08:53 - 000406528 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchProtocolHost.exe
2018-11-14 18:06 - 2018-11-01 07:39 - 000001310 _____ C:\WINDOWS\system32\tcbres.wim
2018-11-14 18:06 - 2018-11-01 07:08 - 002417952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll
2018-11-14 18:06 - 2018-11-01 06:50 - 000861712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2adec.dll
2018-11-14 18:06 - 2018-11-01 06:50 - 000786288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2018-11-14 18:06 - 2018-11-01 06:48 - 006039064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2018-11-14 18:06 - 2018-11-01 06:48 - 004790184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2018-11-14 18:06 - 2018-11-01 06:48 - 002478872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll
2018-11-14 18:06 - 2018-11-01 06:48 - 002331480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2vdec.dll
2018-11-14 18:06 - 2018-11-01 06:48 - 001805656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2018-11-14 18:06 - 2018-11-01 06:48 - 001011872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2018-11-14 18:06 - 2018-11-01 06:48 - 000880248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinTypes.dll
2018-11-14 18:06 - 2018-11-01 06:48 - 000384520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\coml2.dll
2018-11-14 18:06 - 2018-11-01 06:47 - 001980776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2018-11-14 18:06 - 2018-11-01 06:47 - 001379792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll
2018-11-14 18:06 - 2018-11-01 06:47 - 001020064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll
2018-11-14 18:06 - 2018-11-01 06:47 - 000581600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVideoDSP.dll
2018-11-14 18:06 - 2018-11-01 06:47 - 000567256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2018-11-14 18:06 - 2018-11-01 06:47 - 000129304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfps.dll
2018-11-14 18:06 - 2018-11-01 06:35 - 019403776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2018-11-14 18:06 - 2018-11-01 06:34 - 002700288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll
2018-11-14 18:06 - 2018-11-01 06:33 - 006661632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2018-11-14 18:06 - 2018-11-01 06:33 - 003711488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2018-11-14 18:06 - 2018-11-01 06:32 - 006647296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingMaps.dll
2018-11-14 18:06 - 2018-11-01 06:31 - 005307904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll
2018-11-14 18:06 - 2018-11-01 06:31 - 000288768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Search.ProtocolHandler.MAPI2.dll
2018-11-14 18:06 - 2018-11-01 06:30 - 005883904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll
2018-11-14 18:06 - 2018-11-01 06:30 - 005775872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2018-11-14 18:06 - 2018-11-01 06:30 - 002449408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapRouter.dll
2018-11-14 18:06 - 2018-11-01 06:30 - 001361408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSPhotography.dll
2018-11-14 18:06 - 2018-11-01 06:30 - 000561152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2018-11-14 18:06 - 2018-11-01 06:30 - 000392704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapConfiguration.dll
2018-11-14 18:06 - 2018-11-01 06:30 - 000310272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wincorlib.dll
2018-11-14 18:06 - 2018-11-01 06:29 - 002258944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssrch.dll
2018-11-14 18:06 - 2018-11-01 06:29 - 001986560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapGeocoder.dll
2018-11-14 18:06 - 2018-11-01 06:29 - 001862656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xpsservices.dll
2018-11-14 18:06 - 2018-11-01 06:29 - 000848384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ShareHost.dll
2018-11-14 18:06 - 2018-11-01 06:29 - 000608768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EdgeManager.dll
2018-11-14 18:06 - 2018-11-01 06:29 - 000578560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll
2018-11-14 18:06 - 2018-11-01 06:29 - 000165376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scrrun.dll
2018-11-14 18:06 - 2018-11-01 06:28 - 001348096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OpcServices.dll
2018-11-14 18:06 - 2018-11-01 06:28 - 001000448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2018-11-14 18:06 - 2018-11-01 06:28 - 000978944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\JpMapControl.dll
2018-11-14 18:06 - 2018-11-01 06:27 - 001627648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2018-11-14 18:06 - 2018-11-01 06:27 - 000856576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchIndexer.exe
2018-11-14 18:06 - 2018-11-01 06:27 - 000713216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingOnlineServices.dll
2018-11-14 18:06 - 2018-11-01 06:27 - 000678400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll
2018-11-14 18:06 - 2018-11-01 06:27 - 000534016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2018-11-14 18:06 - 2018-11-01 06:26 - 000795648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.OnlineId.dll
2018-11-14 18:06 - 2018-11-01 06:26 - 000735744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssvp.dll
2018-11-14 18:06 - 2018-11-01 06:26 - 000345088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchProtocolHost.exe
2018-11-14 18:06 - 2018-10-21 15:04 - 002267448 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystems64.dll
2018-11-14 18:06 - 2018-10-21 15:00 - 001639560 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2018-11-14 18:06 - 2018-10-21 15:00 - 001516120 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2018-11-14 18:06 - 2018-10-21 15:00 - 000790416 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2018-11-14 18:06 - 2018-10-21 15:00 - 000396304 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2018-11-14 18:06 - 2018-10-21 14:59 - 000766480 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicensingWinRT.dll
2018-11-14 18:06 - 2018-10-21 14:59 - 000236728 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeManagerObj.dll
2018-11-14 18:06 - 2018-10-21 14:46 - 013572096 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
2018-11-14 18:06 - 2018-10-21 14:46 - 004393472 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2018-11-14 18:06 - 2018-10-21 14:45 - 000123392 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontsub.dll
2018-11-14 18:06 - 2018-10-21 14:44 - 000623104 _____ (Microsoft Corporation) C:\WINDOWS\system32\osk.exe
2018-11-14 18:06 - 2018-10-21 14:44 - 000085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\INETRES.dll
2018-11-14 18:06 - 2018-10-21 14:43 - 000345600 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcGenral.dll
2018-11-14 18:06 - 2018-10-21 14:43 - 000276992 _____ (Microsoft Corporation) C:\WINDOWS\system32\wisp.dll
2018-11-14 18:06 - 2018-10-21 14:43 - 000182784 _____ (Microsoft Corporation) C:\WINDOWS\system32\LanguageComponentsInstaller.dll
2018-11-14 18:06 - 2018-10-21 14:42 - 001127936 _____ (Microsoft Corporation) C:\WINDOWS\system32\nettrace.dll
2018-11-14 18:06 - 2018-10-21 14:42 - 000765440 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdh.dll
2018-11-14 18:06 - 2018-10-21 14:42 - 000592896 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserLanguagesCpl.dll
2018-11-14 18:06 - 2018-10-21 14:42 - 000181248 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeHelper.dll
2018-11-14 18:06 - 2018-10-21 14:41 - 001180672 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
2018-11-14 18:06 - 2018-10-21 13:41 - 001540408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppVEntSubsystems32.dll
2018-11-14 18:06 - 2018-10-21 13:41 - 000023056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hvsicontainerservice.dll
2018-11-14 18:06 - 2018-10-21 13:38 - 001322376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2018-11-14 18:06 - 2018-10-21 13:38 - 000662312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2018-11-14 18:06 - 2018-10-21 13:38 - 000660480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicensingWinRT.dll
2018-11-14 18:06 - 2018-10-21 13:38 - 000221216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EditionUpgradeManagerObj.dll
2018-11-14 18:06 - 2018-10-21 13:37 - 020381808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2018-11-14 18:06 - 2018-10-21 13:37 - 001626656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2018-11-14 18:06 - 2018-10-21 13:28 - 012501504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2018-11-14 18:06 - 2018-10-21 13:28 - 000084992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\INETRES.dll
2018-11-14 18:06 - 2018-10-21 13:23 - 000622080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdh.dll
2018-11-14 18:06 - 2018-10-21 13:23 - 000523264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserLanguagesCpl.dll
2018-11-14 18:06 - 2018-10-21 13:22 - 002405888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcGenral.dll
2018-11-14 18:06 - 2018-10-21 13:22 - 000224256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wisp.dll
2018-11-14 18:06 - 2018-10-21 11:29 - 001008640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.MixedRealityCapture.dll
2018-11-14 18:06 - 2018-10-21 10:44 - 000868864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.MixedRealityCapture.dll
2018-11-14 18:06 - 2018-10-21 09:48 - 005602456 _____ (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll
2018-11-14 18:06 - 2018-10-21 09:47 - 000368440 _____ (Microsoft Corporation) C:\WINDOWS\system32\thumbcache.dll
2018-11-14 18:06 - 2018-10-21 09:46 - 000717112 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_StorageSense.dll
2018-11-14 18:06 - 2018-10-21 09:46 - 000709936 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2018-11-14 18:06 - 2018-10-21 09:46 - 000611640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys
2018-11-14 18:06 - 2018-10-21 09:46 - 000560136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2018-11-14 18:06 - 2018-10-21 09:46 - 000497864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Enumeration.dll
2018-11-14 18:06 - 2018-10-21 09:46 - 000171024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2018-11-14 18:06 - 2018-10-21 09:45 - 003283512 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreUIComponents.dll
2018-11-14 18:06 - 2018-10-21 09:45 - 002719032 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2018-11-14 18:06 - 2018-10-21 09:45 - 001946208 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2018-11-14 18:06 - 2018-10-21 09:45 - 001098064 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvproc.dll
2018-11-14 18:06 - 2018-10-21 09:45 - 000607136 _____ (Microsoft Corporation) C:\WINDOWS\system32\TextInputFramework.dll
2018-11-14 18:06 - 2018-10-21 09:45 - 000185120 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspicli.dll
2018-11-14 18:06 - 2018-10-21 09:45 - 000175624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spacedump.sys
2018-11-14 18:06 - 2018-10-21 09:45 - 000139792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecdd.sys
2018-11-14 18:06 - 2018-10-21 09:45 - 000058088 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsass.exe
2018-11-14 18:06 - 2018-10-21 09:28 - 016592384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2018-11-14 18:06 - 2018-10-21 09:22 - 004710912 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdp.dll
2018-11-14 18:06 - 2018-10-21 09:21 - 001589248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll
2018-11-14 18:06 - 2018-10-21 09:21 - 000123424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sspicli.dll
2018-11-14 18:06 - 2018-10-21 09:20 - 000760320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Wnv.sys
2018-11-14 18:06 - 2018-10-21 09:20 - 000424000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Enumeration.dll
2018-11-14 18:06 - 2018-10-21 09:20 - 000295224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\thumbcache.dll
2018-11-14 18:06 - 2018-10-21 09:20 - 000161792 _____ (Microsoft Corporation) C:\WINDOWS\system32\spacebridge.dll
2018-11-14 18:06 - 2018-10-21 09:20 - 000141312 _____ C:\WINDOWS\system32\DataStoreCacheDumpTool.exe
2018-11-14 18:06 - 2018-10-21 09:20 - 000050688 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcimage.dll
2018-11-14 18:06 - 2018-10-21 09:19 - 002487088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreUIComponents.dll
2018-11-14 18:06 - 2018-10-21 09:19 - 001620776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2018-11-14 18:06 - 2018-10-21 09:19 - 001130768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvproc.dll
2018-11-14 18:06 - 2018-10-21 09:19 - 000514560 _____ (Microsoft Corporation) C:\WINDOWS\system32\nltest.exe
2018-11-14 18:06 - 2018-10-21 09:19 - 000505616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TextInputFramework.dll
2018-11-14 18:06 - 2018-10-21 09:19 - 000463360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansec.dll
2018-11-14 18:06 - 2018-10-21 09:19 - 000409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanmsm.dll
2018-11-14 18:06 - 2018-10-21 09:19 - 000228864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\winnat.sys
2018-11-14 18:06 - 2018-10-21 09:19 - 000228352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Web.Diagnostics.dll
2018-11-14 18:06 - 2018-10-21 09:19 - 000137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputLocaleManager.dll
2018-11-14 18:06 - 2018-10-21 09:19 - 000112128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthhfenum.sys
2018-11-14 18:06 - 2018-10-21 09:19 - 000086528 _____ (Microsoft Corporation) C:\WINDOWS\system32\ofdeploy.exe
2018-11-14 18:06 - 2018-10-21 09:19 - 000060928 _____ (Microsoft Corporation) C:\WINDOWS\system32\BthAvrcpAppSvc.dll
2018-11-14 18:06 - 2018-10-21 09:19 - 000036352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhf.sys
2018-11-14 18:06 - 2018-10-21 09:19 - 000028672 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspisrv.dll
2018-11-14 18:06 - 2018-10-21 09:18 - 000761344 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
2018-11-14 18:06 - 2018-10-21 09:18 - 000461824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Activities.dll
2018-11-14 18:06 - 2018-10-21 09:18 - 000395264 _____ (Microsoft Corporation) C:\WINDOWS\system32\BthAvctpSvc.dll
2018-11-14 18:06 - 2018-10-21 09:18 - 000275456 _____ (Microsoft Corporation) C:\WINDOWS\system32\scecli.dll
2018-11-14 18:06 - 2018-10-21 09:18 - 000274432 _____ (Microsoft Corporation) C:\WINDOWS\system32\DAFWSD.dll
2018-11-14 18:06 - 2018-10-21 09:18 - 000130048 _____ (Microsoft Corporation) C:\WINDOWS\system32\officecsp.dll
2018-11-14 18:06 - 2018-10-21 09:18 - 000030720 _____ (Microsoft Corporation) C:\WINDOWS\system32\seclogon.dll
2018-11-14 18:06 - 2018-10-21 09:17 - 001826816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.CloudStore.dll
2018-11-14 18:06 - 2018-10-21 09:17 - 001668096 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdprt.dll
2018-11-14 18:06 - 2018-10-21 09:17 - 000787456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdiWiFi.sys
2018-11-14 18:06 - 2018-10-21 09:17 - 000625152 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2018-11-14 18:06 - 2018-10-21 09:17 - 000473600 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2018-11-14 18:06 - 2018-10-21 09:17 - 000311296 _____ (Microsoft Corporation) C:\WINDOWS\system32\BthAvrcp.dll
2018-11-14 18:06 - 2018-10-21 09:17 - 000271872 _____ (Microsoft Corporation) C:\WINDOWS\system32\dafBth.dll
2018-11-14 18:06 - 2018-10-21 09:16 - 002584576 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll
2018-11-14 18:06 - 2018-10-21 09:16 - 002368512 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebRuntimeManager.dll
2018-11-14 18:06 - 2018-10-21 09:16 - 001535488 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2018-11-14 18:06 - 2018-10-21 09:16 - 000847360 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll
2018-11-14 18:06 - 2018-10-21 09:16 - 000514048 _____ (Microsoft Corporation) C:\WINDOWS\system32\BTAGService.dll
2018-11-14 18:06 - 2018-10-21 09:16 - 000323584 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxAllUserStore.dll
2018-11-14 18:06 - 2018-10-21 09:15 - 003212800 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2018-11-14 18:06 - 2018-10-21 09:15 - 002904064 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2018-11-14 18:06 - 2018-10-21 09:15 - 000743936 _____ (Microsoft Corporation) C:\WINDOWS\system32\PrintRenderAPIHost.DLL
2018-11-14 18:06 - 2018-10-21 09:15 - 000401920 _____ (Microsoft Corporation) C:\WINDOWS\system32\rascustom.dll
2018-11-14 18:06 - 2018-10-21 09:14 - 002224640 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2018-11-14 18:06 - 2018-10-21 09:14 - 001919488 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2018-11-14 18:06 - 2018-10-21 09:14 - 001854976 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll
2018-11-14 18:06 - 2018-10-21 09:14 - 001034752 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll
2018-11-14 18:06 - 2018-10-21 09:14 - 000932352 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasmans.dll
2018-11-14 18:06 - 2018-10-21 09:14 - 000632320 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdpsvc.dll
2018-11-14 18:06 - 2018-10-21 09:14 - 000453632 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdpusersvc.dll
2018-11-14 18:06 - 2018-10-21 09:14 - 000311296 _____ (Microsoft Corporation) C:\WINDOWS\system32\EnterpriseAppMgmtSvc.dll
2018-11-14 18:06 - 2018-10-21 09:09 - 013873664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2018-11-14 18:06 - 2018-10-21 09:02 - 002966528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdp.dll
2018-11-14 18:06 - 2018-10-21 09:02 - 000157184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\spacebridge.dll
2018-11-14 18:06 - 2018-10-21 09:01 - 001189376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll
2018-11-14 18:06 - 2018-10-21 09:01 - 000168448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Web.Diagnostics.dll
2018-11-14 18:06 - 2018-10-21 09:00 - 000214528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scecli.dll
2018-11-14 18:06 - 2018-10-21 08:59 - 000602112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll
2018-11-14 18:06 - 2018-10-21 08:58 - 001124352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdprt.dll
2018-11-14 18:06 - 2018-10-21 08:58 - 000415744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2018-11-14 18:06 - 2018-10-21 08:58 - 000230912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxAllUserStore.dll
2018-11-14 18:06 - 2018-10-21 08:57 - 002611200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2018-11-14 18:06 - 2018-10-21 07:59 - 000806320 _____ C:\WINDOWS\SysWOW64\locale.nls
2018-11-14 18:06 - 2018-10-21 07:59 - 000806320 _____ C:\WINDOWS\system32\locale.nls
2018-11-14 18:06 - 2018-04-28 06:02 - 000144384 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll
2018-11-14 02:42 - 2018-11-14 02:42 - 000000600 _____ C:\Users\Micr0\AppData\Roaming\winscp.rnd
2018-11-14 02:37 - 2018-11-14 02:37 - 000001146 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinSCP.lnk
2018-11-14 02:37 - 2018-11-14 02:37 - 000001134 _____ C:\Users\Public\Desktop\WinSCP.lnk
2018-11-14 02:37 - 2018-11-14 02:37 - 000000000 ____D C:\Program Files (x86)\WinSCP
2018-11-11 12:35 - 2018-11-11 12:35 - 000000000 ____D C:\Users\Micr0\AppData\Local\OneDrive
2018-11-10 18:13 - 2018-11-03 03:56 - 000001951 _____ C:\WINDOWS\NvTelemetryContainerRecovery.bat
2018-11-10 18:12 - 2018-11-10 18:12 - 000000000 ____D C:\WINDOWS\system32\Drivers\NVIDIA Corporation
2018-11-10 18:10 - 2018-11-05 18:56 - 015908504 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvptxJitCompiler.dll
2018-11-10 18:10 - 2018-11-05 18:56 - 013203400 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvptxJitCompiler.dll
2018-11-10 18:10 - 2018-11-05 18:55 - 019709024 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuda.dll
2018-11-10 18:10 - 2018-11-05 18:55 - 016986632 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuda.dll
2018-11-10 18:10 - 2018-11-05 18:55 - 004992144 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvapi64.dll
2018-11-10 18:10 - 2018-11-05 18:55 - 004253008 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvapi.dll
2018-11-10 18:10 - 2018-11-05 18:55 - 001462424 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvEncMFTH264.dll
2018-11-10 18:10 - 2018-11-05 18:55 - 001167800 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvfatbinaryLoader.dll
2018-11-10 18:10 - 2018-11-05 18:55 - 001145744 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvEncMFTH264.dll
2018-11-10 18:10 - 2018-11-05 18:55 - 000914792 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvfatbinaryLoader.dll
2018-11-10 18:10 - 2018-11-05 18:55 - 000794656 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvEncodeAPI64.dll
2018-11-10 18:10 - 2018-11-05 18:55 - 000637872 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvEncodeAPI.dll
2018-11-10 18:10 - 2018-11-05 14:59 - 000978320 _____ C:\WINDOWS\system32\vulkan-1-999-0-0-0.dll
2018-11-10 18:10 - 2018-11-05 14:59 - 000978320 _____ C:\WINDOWS\system32\vulkan-1.dll
2018-11-10 18:10 - 2018-11-05 14:59 - 000845200 _____ C:\WINDOWS\SysWOW64\vulkan-1-999-0-0-0.dll
2018-11-10 18:10 - 2018-11-05 14:59 - 000845200 _____ C:\WINDOWS\SysWOW64\vulkan-1.dll
2018-11-10 18:10 - 2018-11-05 14:59 - 000552232 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.dll
2018-11-10 18:10 - 2018-11-05 14:59 - 000457184 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.dll
2018-11-10 18:10 - 2018-11-05 14:59 - 000268176 _____ C:\WINDOWS\system32\vulkaninfo-1-999-0-0-0.exe
2018-11-10 18:10 - 2018-11-05 14:59 - 000268176 _____ C:\WINDOWS\system32\vulkaninfo.exe
2018-11-10 18:10 - 2018-11-05 14:59 - 000243600 _____ C:\WINDOWS\SysWOW64\vulkaninfo-1-999-0-0-0.exe
2018-11-10 18:10 - 2018-11-05 14:59 - 000243600 _____ C:\WINDOWS\SysWOW64\vulkaninfo.exe
2018-11-10 18:10 - 2018-11-05 14:58 - 001457088 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFR64.dll
2018-11-10 18:10 - 2018-11-05 14:58 - 001124560 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFR.dll
2018-11-10 18:10 - 2018-11-05 14:58 - 000631232 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFROpenGL.dll
2018-11-10 18:10 - 2018-11-05 14:58 - 000521472 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFROpenGL.dll
2018-11-10 18:10 - 2018-11-05 14:57 - 040254264 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcompiler.dll
2018-11-10 18:10 - 2018-11-05 14:57 - 035151960 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcompiler.dll
2018-11-10 18:10 - 2018-11-05 14:57 - 004941480 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuvid.dll
2018-11-10 18:10 - 2018-11-05 14:57 - 004313048 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuvid.dll
2018-11-10 18:10 - 2018-11-05 14:57 - 002017536 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispco6441681.dll
2018-11-10 18:10 - 2018-11-05 14:57 - 001999968 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvFBC64.dll
2018-11-10 18:10 - 2018-11-05 14:57 - 001509072 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvFBC.dll
2018-11-10 18:10 - 2018-11-05 14:57 - 001468112 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispgenco6441681.dll
2018-11-10 18:10 - 2018-11-05 14:57 - 000750016 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvDecMFTMjpeg.dll
2018-11-10 18:10 - 2018-11-05 14:57 - 000608712 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvDecMFTMjpeg.dll
2018-11-10 18:04 - 2018-11-03 00:28 - 005945328 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcpl.dll
2018-11-10 18:04 - 2018-11-03 00:28 - 002611240 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvsvc64.dll
2018-11-10 18:04 - 2018-11-03 00:28 - 001767280 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvsvcr.dll
2018-11-10 18:04 - 2018-11-03 00:28 - 000635248 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nv3dappshext.dll
2018-11-10 18:04 - 2018-11-03 00:28 - 000451056 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvmctray.dll
2018-11-10 18:04 - 2018-11-03 00:28 - 000124112 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvshext.dll
2018-11-10 18:04 - 2018-11-03 00:28 - 000083336 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nv3dappshextr.dll
2018-11-10 18:04 - 2018-10-26 12:33 - 008391862 _____ C:\WINDOWS\system32\nvcoproc.bin
2018-11-10 18:04 - 2018-10-22 11:08 - 000001951 _____ C:\WINDOWS\NvContainerRecovery.bat
2018-11-10 02:43 - 2018-11-10 02:43 - 000000836 _____ C:\Users\Micr0\Desktop\BurnInTest.lnk
2018-11-10 02:43 - 2018-11-10 02:43 - 000000000 ____D C:\WINDOWS\system32\temp
2018-11-10 02:43 - 2018-11-10 02:43 - 000000000 ____D C:\Users\Micr0\Documents\PassMark
2018-11-10 02:43 - 2018-11-10 02:43 - 000000000 ____D C:\ProgramData\PassMark
2018-11-10 02:43 - 2018-11-10 02:43 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BurnInTest
2018-11-10 02:43 - 2018-11-10 02:43 - 000000000 ____D C:\Program Files\BurnInTest

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-12-09 20:47 - 2018-04-12 01:38 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2018-12-09 19:56 - 2018-05-16 01:44 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2018-12-09 14:42 - 2018-05-16 01:47 - 000933504 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2018-12-09 14:42 - 2018-04-12 01:36 - 000000000 ____D C:\WINDOWS\INF
2018-12-09 14:41 - 2018-05-16 02:07 - 000003024 _____ C:\WINDOWS\System32\Tasks\AsrAPPShop
2018-12-09 14:41 - 2017-11-19 22:59 - 000000000 ____D C:\Program Files (x86)\Steam
2018-12-09 14:41 - 2017-11-19 12:31 - 000022280 _____ (ASRock Incorporation) C:\WINDOWS\SysWOW64\Drivers\AsrAutoChkUpdDrv.sys
2018-12-09 14:40 - 2017-11-19 12:29 - 000000000 ____D C:\Users\Micr0\AppData\Roaming\uTorrent
2018-12-09 14:40 - 2017-11-19 10:44 - 000000000 ___RD C:\Users\Micr0\OneDrive
2018-12-09 14:38 - 2018-08-04 23:53 - 000000000 ____D C:\Program Files (x86)\Hi-Rez Studios
2018-12-09 14:38 - 2018-03-25 19:30 - 000000000 ____D C:\Program Files (x86)\TeamViewer
2018-12-09 14:38 - 2017-11-19 10:49 - 000000000 ____D C:\ProgramData\NVIDIA
2018-12-09 14:37 - 2018-05-16 02:07 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2018-12-09 02:00 - 2018-08-25 22:35 - 000000000 ____D C:\Users\Micr0\AppData\Local\Adobe
2018-12-08 23:05 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\AppReadiness
2018-12-08 22:29 - 2018-04-12 01:38 - 000000000 ___HD C:\Program Files\WindowsApps
2018-12-08 22:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2018-12-08 20:47 - 2018-04-12 01:30 - 000000000 ____D C:\WINDOWS\CbsTemp
2018-12-07 19:09 - 2017-11-19 10:41 - 000000000 ____D C:\Users\Micr0\AppData\Local\Packages
2018-12-07 02:19 - 2017-12-28 01:29 - 000000000 ____D C:\KMPlayer
2018-11-30 00:11 - 2018-05-16 02:07 - 000003364 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-2968841199-4106751538-2094254156-1000
2018-11-30 00:11 - 2018-05-16 01:52 - 000002395 _____ C:\Users\Micr0\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2018-11-28 00:34 - 2017-11-19 12:23 - 000002299 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2018-11-28 00:34 - 2017-11-19 12:23 - 000002258 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2018-11-27 13:14 - 2010-11-21 05:27 - 000592416 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2018-11-21 22:23 - 2018-05-16 01:52 - 000000000 ____D C:\Users\Micr0
2018-11-21 18:08 - 2018-06-03 18:32 - 000000000 ____D C:\Users\Micr0\AppData\Roaming\GitHub Desktop
2018-11-21 18:04 - 2018-06-03 18:32 - 000002419 _____ C:\Users\Micr0\Desktop\GitHub Desktop.lnk
2018-11-21 18:04 - 2018-06-03 18:32 - 000000000 ____D C:\Users\Micr0\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GitHub, Inc
2018-11-21 18:04 - 2018-02-17 21:33 - 000000000 ____D C:\Users\Micr0\AppData\Local\SquirrelTemp
2018-11-21 17:46 - 2017-11-19 12:33 - 000000000 ____D C:\Users\Micr0\AppData\Local\PlaceholderTileLogoFolder
2018-11-18 21:51 - 2018-11-04 21:46 - 000000000 ____D C:\Users\Micr0\AppData\Roaming\Awesomium
2018-11-18 21:33 - 2018-11-04 21:46 - 000055704 _____ (Wellbia.com Co., Ltd.) C:\WINDOWS\xhunter1.sys
2018-11-17 00:07 - 2017-11-19 10:41 - 000000000 __RHD C:\Users\Public\AccountPictures
2018-11-17 00:07 - 2017-11-19 10:41 - 000000000 ___RD C:\Users\Micr0\3D Objects
2018-11-16 22:32 - 2018-05-16 01:44 - 005019936 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2018-11-16 22:30 - 2018-04-11 23:04 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2018-11-16 22:28 - 2018-04-12 01:38 - 000000000 ___SD C:\WINDOWS\SysWOW64\F12
2018-11-16 22:28 - 2018-04-12 01:38 - 000000000 ___SD C:\WINDOWS\system32\F12
2018-11-16 22:28 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\TextInput
2018-11-16 22:28 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\ShellExperiences
2018-11-16 22:27 - 2018-04-12 01:38 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2018-11-16 22:27 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\ShellExperiences
2018-11-16 22:27 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\bcastdvr
2018-11-16 21:51 - 2018-11-07 23:44 - 000000000 ____D C:\Users\Micr0\AppData\Roaming\TS3Client
2018-11-14 18:18 - 2017-12-05 19:52 - 000000000 ____D C:\WINDOWS\system32\MRT
2018-11-14 18:15 - 2017-12-05 19:52 - 137810048 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2018-11-14 03:08 - 2018-06-12 22:24 - 000000000 ____D C:\ProgramData\Packages
2018-11-14 02:45 - 2018-10-28 01:16 - 000000000 ____D C:\Users\Micr0\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Visual Studio Code
2018-11-10 18:13 - 2017-11-19 10:49 - 000000000 ____D C:\Program Files\NVIDIA Corporation
2018-11-10 18:13 - 2017-11-19 10:49 - 000000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2018-11-10 18:10 - 2017-11-19 10:49 - 000000000 ____D C:\ProgramData\NVIDIA Corporation
2018-11-10 18:04 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\Help
2018-11-09 00:19 - 2017-11-29 10:55 - 000000000 ____D C:\Users\Micr0\AppData\Local\CrashDumps

==================== Files in the root of some directories =======

2018-08-26 16:45 - 2018-08-26 16:45 - 000000132 _____ () C:\Users\Micr0\AppData\Roaming\Adobe PNG Format CS6 Prefs
2018-11-14 02:42 - 2018-11-14 02:42 - 000000600 _____ () C:\Users\Micr0\AppData\Roaming\winscp.rnd
2018-08-26 16:36 - 2018-08-26 16:40 - 000001456 _____ () C:\Users\Micr0\AppData\Local\Adobe Save for Web 13.0 Prefs

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2018-05-16 01:43

==================== End of FRST.txt ============================

Цитат

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 09.12.2018
Ran by Micr0 (09-12-2018 20:55:39)
Running from C:\Users\Micr0\Desktop\full_blacklist_database
Windows 10 Pro Version 1803 17134.407 (X64) (2018-05-16 00:08:31)
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-2968841199-4106751538-2094254156-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-2968841199-4106751538-2094254156-503 - Limited - Disabled)
Guest (S-1-5-21-2968841199-4106751538-2094254156-501 - Limited - Disabled)
Micr0 (S-1-5-21-2968841199-4106751538-2094254156-1000 - Administrator - Enabled) => C:\Users\Micr0
WDAGUtilityAccount (S-1-5-21-2968841199-4106751538-2094254156-504 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKLM-x32\...\uTorrent) (Version: 2.0.4 - )
Adobe Photoshop CS6 (HKLM-x32\...\{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}) (Version: 13.0 - Adobe Systems Incorporated)
Android Studio (HKLM\...\Android Studio) (Version: 1.0 - Google Inc.)
APP Shop v1.0.31 (HKLM-x32\...\{90242E9B-BC60-46E3-8EE7-8E953F702280}_is1) (Version: 1.0.31 - ASRock Inc.)
ASRock App Charger v1.0.6 (HKLM\...\ASRock App Charger_is1) (Version: 1.0.6 - ASRock Inc.)
AzureTools.Notifications (HKLM-x32\...\{3FBFCF2C-392A-4632-9442-14C305B44D5E}) (Version: 2.1.10731.1602 - Microsoft Corporation) Hidden
Behaviors SDK (XAML) for Visual Studio (HKLM-x32\...\{0B5E43C7-965D-4AF4-A33E-5FA35B6660C8}) (Version: 12.0.41002.1 - Microsoft Corporation) Hidden
Blend for Visual Studio 2013 (HKLM-x32\...\{EBC890A6-DE7C-44B4-AA03-119B6190D3E1}) (Version: 12.0.41002.1 - Microsoft Corporation) Hidden
Blend for Visual Studio 2013 ENU resources (HKLM-x32\...\{9ED1634C-4E71-4992-A1BA-7C4BE6EE39E1}) (Version: 12.0.41002.1 - Microsoft Corporation) Hidden
Blend for Visual Studio SDK for .NET 4.5 (HKLM-x32\...\{37E53780-3944-4A6A-842F-727128E8616E}) (Version: 3.0.40218.0 - Microsoft Corporation) Hidden
Blend for Visual Studio SDK for Silverlight 5 (HKLM-x32\...\{0C03A66F-1FF0-45F9-8D67-0D806EBFFBA1}) (Version: 3.0.40218.0 - Microsoft Corporation) Hidden
Build Tools - amd64 (HKLM\...\{F74753A3-C93C-34F5-A199-993CAF602B7D}) (Version: 12.0.21005 - Microsoft Corporation) Hidden
Build Tools - x86 (HKLM-x32\...\{FB3A15FD-FC67-3A2F-892B-6890B0C56EA9}) (Version: 12.0.21005 - Microsoft Corporation) Hidden
Build Tools Language Resources - amd64 (HKLM\...\{05198C22-FFCE-374A-B190-9F18CC99DAEA}) (Version: 12.0.21005 - Microsoft Corporation) Hidden
Build Tools Language Resources - x86 (HKLM-x32\...\{9347889B-C22A-3905-901F-C05D8F73C929}) (Version: 12.0.21005 - Microsoft Corporation) Hidden
BurnInTest v9.0 Standard (HKLM\...\BurnInTest_is1) (Version: 9.0.1010.0 - Passmark Software)
DisplayDriverAnalyzer (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_DisplayDriverAnalyzer) (Version: 416.81 - NVIDIA Corporation) Hidden
Dotfuscator and Analytics Community Edition (HKLM-x32\...\{2386192E-D6DB-4AD2-9564-65586A0AE53E}) (Version: 5.5.4954.46574 - PreEmptive Solutions) Hidden
Dying Light v.1.12 (HKLM-x32\...\Dying Light_is1) (Version: - )
Entity Framework Tools for Visual Studio 2013 (HKLM-x32\...\{08AEF86A-1956-4846-B906-B01350E96E30}) (Version: 12.0.20912.0 - Microsoft Corporation)
Epic Games Launcher (HKLM-x32\...\{8F89B0CF-8144-43EE-AB9F-B7F8F23D85FB}) (Version: 1.1.135.0 - Epic Games, Inc.)
F.E.A.R 2 - Дополненное издание (HKLM-x32\...\{17F403A2-9777-4365-9C1A-72B6B2430622}) (Version: 1.00 - Новый Диск)
F.E.A.R. 2 (HKLM-x32\...\F.E.A.R. 2_R.G. Mechanics_is1) (Version: - R.G. Mechanics, Galfimbul)
FileZilla Client 3.38.1 (HKLM-x32\...\FileZilla Client) (Version: 3.38.1 - Tim Kosse)
Frostpunk (HKLM-x32\...\Frostpunk_is1) (Version: 1.1.2.0 - 11 bit studios)
GitHub Desktop (HKU\S-1-5-21-2968841199-4106751538-2094254156-1000\...\GitHubDesktop) (Version: 1.5.0 - GitHub, Inc.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 70.0.3538.110 - Google Inc.)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.17 - Google Inc.) Hidden
Hi-Rez Studios Authenticate and Update Service (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}) (Version: 3.0.0.0 - Hi-Rez Studios)
HP USB Disk Storage Format Tool (HKLM-x32\...\{0E0DF90C-D0BA-4C89-9262-AD78D1A3DE51}) (Version: - )
IIS 8.0 Express (HKLM\...\{7BF61FA9-BDFB-4563-98AD-FCB0DA28CCC7}) (Version: 8.0.1557 - Microsoft Corporation)
IIS Express Application Compatibility Database for x64 (HKLM\...\{9f4f4a9b-eec5-4906-92fe-d1f43ccf5c8d}.sdb) (Version: - )
IIS Express Application Compatibility Database for x86 (HKLM\...\{fdfba1f3-74ae-4255-9c10-a0f552b4610f}.sdb) (Version: - )
Intel(R) Chipset Device Software (HKLM-x32\...\{bb0592a7-5772-4736-9d55-2402740085db}) (Version: 10.1.1.38 - Intel(R) Corporation) Hidden
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.6.0.1030 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 15.2.0.1020 - Intel Corporation)
Intel® Hardware Accelerated Execution Manager (HKLM\...\{6230EE50-BD4E-4B39-904D-3E7600053E08}) (Version: 6.2.1 - Intel Corporation)
iSkysoft Data Recovery(Build 3.0.0.12) (HKLM-x32\...\{656DB838-DB63-4acd-82E3-BB363ED99116}_is1) (Version: 3.0.0.12 - iSkysoft Software Co.,Ltd.)
Java 10.0.2 (64-bit) (HKLM\...\{EECB2736-D013-5AC5-9917-7656712F6931}) (Version: 10.0.2.0 - Oracle Corporation)
Java 8 Update 181 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180181F0}) (Version: 8.0.1810.13 - Oracle Corporation)
Java SE Development Kit 8 Update 171 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180171}) (Version: 8.0.1710.11 - Oracle Corporation)
Java SE Development Kit 8 Update 181 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180181}) (Version: 8.0.1810.13 - Oracle Corporation)
Java(TM) SE Development Kit 10.0.2 (64-bit) (HKLM\...\{71307D56-8005-5F5E-9227-BFA2754D6E54}) (Version: 10.0.2.0 - Oracle Corporation)
JavaScript Tooling (HKLM\...\{2044FC4C-4EA3-4113-BC1E-962DF568D201}) (Version: 12.0.21005 - Microsoft Corporation) Hidden
JBoss Web 2.1 (remove only) (HKLM-x32\...\JBoss Web 2.1) (Version: - )
KMPlayer (remove only) (HKLM-x32\...\The KMPlayer) (Version: 4.1.1.5 - PandoraTV)
Launcher Prerequisites (x64) (HKLM-x32\...\{c6c5a357-c7ca-4a5f-9789-3bb1af579253}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden
Lineage II (HKLM-x32\...\{0a78b236-0352-4631-bfd3-f894209a378b}) (Version: 1.0.2.0 - NC Interactive, LLC)
Lineage II (HKLM-x32\...\{C9D826BB-412C-4BF2-A06E-E0422849DDCC}) (Version: 4.0.0.2 - NC Interactive, LLC) Hidden
LocalESPC (HKLM-x32\...\{62910715-63E3-0AB0-0B29-99140DE1C15E}) (Version: 8.59.29989 - Microsoft Corporation) Hidden
LocalESPC Dev12 (HKLM-x32\...\{492498A3-F88C-FE2F-755C-9B1B91724CA5}) (Version: 8.100.25984 - Microsoft Corporation) Hidden
LocalESPCui for en-us (HKLM-x32\...\{326A5052-061C-F656-31E3-3B73842ABD46}) (Version: 8.59.29989 - Microsoft) Hidden
LocalESPCui for en-us Dev12 (HKLM-x32\...\{B1C38F27-D377-8C98-D98D-29B67C0B978D}) (Version: 8.100.25984 - Microsoft) Hidden
Microsoft .NET Framework 4.5 Multi-Targeting Pack (HKLM-x32\...\{56E962F0-4FB0-3C67-88DB-9EAA6EEFC493}) (Version: 4.5.50710 - Microsoft Corporation)
Microsoft .NET Framework 4.5 SDK (HKLM-x32\...\{4AE57014-05C4-4864-A13D-86517A7E1BA4}) (Version: 4.5.50710 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 Multi-Targeting Pack (ENU) (HKLM-x32\...\{D3517C62-68A5-37CF-92F7-93C029A89681}) (Version: 4.5.50932 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 Multi-Targeting Pack (HKLM-x32\...\{6A0C6700-EA93-372C-8871-DCCF13D160A4}) (Version: 4.5.50932 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 SDK (HKLM-x32\...\{19A5926D-66E1-46FC-854D-163AA10A52D3}) (Version: 4.5.51641 - Microsoft Corporation)
Microsoft Help Viewer 2.1 (HKLM-x32\...\Microsoft Help Viewer 2.1) (Version: 2.1.21005 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-2968841199-4106751538-2094254156-1000\...\OneDriveSetup.exe) (Version: 18.212.1021.0008 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.20513.0 - Microsoft Corporation)
Microsoft Silverlight 5 SDK (HKLM-x32\...\{E1FBB3D4-ADB0-4949-B101-855DA061C735}) (Version: 5.0.61118.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Command Line Utilities (HKLM\...\{58FED865-4F13-408D-A5BF-996019C4B936}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Data-Tier App Framework (HKLM-x32\...\{1B876496-B3A2-4D22-9B12-B608A3FD4B8B}) (Version: 11.1.2902.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Data-Tier App Framework (x64) (HKLM\...\{A6BA243E-85A3-4635-A269-32949C98AC7F}) (Version: 11.1.2902.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Express LocalDB (HKLM\...\{6C026A91-640F-4A23-8B68-05D589CC6F18}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Management Objects (HKLM-x32\...\{2F7DBBE6-8EBC-495C-9041-46A772F4E311}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Management Objects (x64) (HKLM\...\{43A5C316-9521-49C3-B9B6-FCE5E1005DF0}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Native Client (HKLM\...\{D411E9C9-CE62-4DBF-9D92-4CB22B750ED5}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Transact-SQL ScriptDom (HKLM\...\{54C5041B-0E91-4E92-8417-AAA12493C790}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 T-SQL Language Service (HKLM-x32\...\{04DD7AF4-A6D3-4E30-9BB9-3B3670719234}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server Compact 4.0 SP1 x64 ENU (HKLM\...\{78909610-D229-459C-A936-25D92283D3FD}) (Version: 4.0.8876.1 - Microsoft Corporation)
Microsoft SQL Server Data Tools - enu (12.0.30919.1) (HKLM-x32\...\{0D7FCBFB-F478-4D32-901C-83F0BF5A3501}) (Version: 12.0.30919.1 - Microsoft Corporation)
Microsoft SQL Server Data Tools Build Utilities - enu (12.0.30919.1) (HKLM-x32\...\{6781FF9B-E87D-4A03-9373-A55A288B83FA}) (Version: 12.0.30919.1 - Microsoft Corporation)
Microsoft SQL Server System CLR Types (HKLM-x32\...\{A47FD1BF-A815-4A76-BE65-53A15BD5D25D}) (Version: 10.50.1600.1 - Microsoft Corporation)
Microsoft SQL Server System CLR Types (x64) (HKLM\...\{4701DEDE-1888-49E0-BAE5-857875924CA2}) (Version: 10.50.1600.1 - Microsoft Corporation)
Microsoft System CLR Types for SQL Server 2012 (HKLM-x32\...\{070C38AC-05CE-43DF-9A20-141332F6AB2B}) (Version: 11.1.3366.16 - Microsoft Corporation)
Microsoft System CLR Types for SQL Server 2012 (x64) (HKLM\...\{05FF8209-C4F1-4C77-BC28-791653156D20}) (Version: 11.1.3366.16 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2017 Redistributable (x64) - 14.12.25810 (HKLM-x32\...\{e2ee15e2-a480-4bc5-bfb7-e9803d1d9823}) (Version: 14.12.25810.0 - Microsoft Corporation)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.12.25810 (HKLM-x32\...\{56e11d69-7cc9-40a5-a4f9-8f6190c4d84d}) (Version: 14.12.25810.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.40820 - Microsoft Corporation)
Microsoft Visual Studio Code (User) (HKU\S-1-5-21-2968841199-4106751538-2094254156-1000\...\{771FD6B0-FA20-440A-A002-3B3BAC16DC50}_is1) (Version: 1.29.0 - Microsoft Corporation)
Microsoft Visual Studio Ultimate 2013 (HKLM-x32\...\{8c13edfc-064c-4ba0-91cd-5b04248be882}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Web Deploy 3.5 (HKLM\...\{3674F088-9B90-473A-AAC3-20A00D8D810C}) (Version: 3.1237.1762 - Microsoft Corporation)
MOTHERGUNSHIP (HKLM-x32\...\MOTHERGUNSHIP_is1) (Version: 1.0.1.0 - Terrible Posture Games)
MySQL Installer - Community (HKLM-x32\...\{7A2A8443-C1A7-483E-9DCF-1FE4A1766DAD}) (Version: 1.4.23.0 - Oracle Corporation)
MySQL Server 5.7 (HKLM\...\{3FAF469E-B671-4ED9-AB0D-CF8D41E35319}) (Version: 5.7.21 - Oracle Corporation)
NCSOFT Game Launcher (HKLM-x32\...\NCLauncher_NCWest) (Version: - NCSOFT)
Notepad++ (32-bit x86) (HKLM-x32\...\Notepad++) (Version: 7.5.6 - Notepad++ Team)
NVIDIA Graphics Driver 416.81 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 416.81 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.18.0907 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.18.0907 - NVIDIA Corporation)
Open XML SDK 2.5 for Microsoft Office (HKLM-x32\...\{3EA16E23-14D2-466A-8268-D7CD40DC46B6}) (Version: 2.5.5631 - Microsoft Corporation) Hidden
PDF Settings CS6 (HKLM-x32\...\{BFEAAE77-BD7F-4534-B286-9C5CB4697EB1}) (Version: 11.0 - Adobe Systems Incorporated) Hidden
PeerBlock 1.2 (r693) (HKLM\...\{015C5B35-B678-451C-9AEE-821E8D69621C}_is1) (Version: 1.2.0.693 - PeerBlock, LLC)
PreEmptive Analytics Visual Studio Components (HKLM-x32\...\{943F3FB1-3F9C-4FB7-A4E2-6D53617068C3}) (Version: 1.2.3197.1 - PreEmptive Solutions) Hidden
PremiumSoft Navicat Premium 11.0 (HKLM-x32\...\PremiumSoft Navicat Premium_is1) (Version: 11.0.7 - PremiumSoft CyberTech Ltd.)
Prerequisites for SSDT (HKLM-x32\...\{35C1D9D6-87C0-46A3-B1B4-EDBCC063221C}) (Version: 11.1.3000.0 - Microsoft Corporation)
Python Tools Redirection Template (HKLM-x32\...\{EE541DCE-3018-4A12-B0A3-7C55D62B3D01}) (Version: 1.1 - Microsoft Corporation) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.18.526.2017 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7647 - Realtek Semiconductor Corp.)
SceneBuilder (HKU\S-1-5-21-2968841199-4106751538-2094254156-1000\...\{com.oracle.javafx.scenebuilder.app}}_is1) (Version: 10.0.0 - Gluon)
SharePoint Client Components (HKLM\...\{95150001-1163-0409-1000-0000000FF1CE}) (Version: 15.0.4481.1505 - Microsoft Corporation) Hidden
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Team Explorer for Microsoft Visual Studio 2013 (HKLM-x32\...\{C9E7751E-88ED-36CF-B610-71A1D262E906}) (Version: 12.0.21005 - Microsoft Corporation) Hidden
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.2.3 - TeamSpeak Systems GmbH)
TeamViewer 13 (HKLM-x32\...\TeamViewer) (Version: 13.1.1548 - TeamViewer)
The Solus Project (HKLM-x32\...\1455617752_is1) (Version: 2.12.0.15 - GOG.com)
UE4 Prerequisites (x64) (HKLM\...\{36EAD5CF-44EF-4FCF-8BE1-D96C4835D7A4}) (Version: 1.0.11.0 - Epic Games, Inc.) Hidden
UE4 Prerequisites (x64) (HKLM-x32\...\{2890ae6b-90e9-448d-b3e6-97e43c21e2fd}) (Version: 1.0.13.0 - Epic Games, Inc.) Hidden
Update for (KB2504637) (HKLM-x32\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}.KB2504637) (Version: 1 - Microsoft Corporation)
Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\...\{9CBA860F-7437-4A75-941C-8EF559F2D145}) (Version: 2.52.0.0 - Microsoft Corporation)
USB Drive Letter Manager (x64) (HKLM\...\{1C1EB27C-3FFA-4858-8FC8-7BFFCEA1A361}) (Version: 5.3.0.50 - uwe-sieber.de) Hidden
Vs2012 Verification SDK (HKLM-x32\...\{3EB86FF9-D90A-38F0-AB6E-C67EEC5112FE}) (Version: 12.0.21005 - Microsoft Corporation) Hidden
WCF Data Services 5.6.0 Runtime (HKLM-x32\...\{46910786-E4AC-41E4-A4A0-C086EA85242D}) (Version: 5.6.61587.0 - Microsoft Corporation) Hidden
WCF Data Services Tools for Microsoft Visual Studio 2013 (HKLM-x32\...\{BF3E2194-F89B-44FB-A801-464BF787599F}) (Version: 5.6.61587.0 - Microsoft Corporation) Hidden
WCF RIA Services V1.0 SP2 (HKLM-x32\...\{5D8DD6A8-C4D7-4554-93F9-F1CC28C72600}) (Version: 4.1.62812.0 - Microsoft Corporation)
Windows 7 USB/DVD Download Tool (HKLM-x32\...\{CCF298AF-9CE1-4B26-B251-486E98A34789}) (Version: 1.0.30 - Microsoft Corporation)
WinRAR 5.50 (64-битова версия) (HKLM\...\WinRAR archiver) (Version: 5.50.0 - win.rar GmbH)
WinSCP 5.13.4 (HKLM-x32\...\winscp3_is1) (Version: 5.13.4 - Martin Prikryl)
Wondershare Helper Compact 2.5.2 (HKLM-x32\...\{5363CE84-5F09-48A1-8B6C-6BB590FFEDF2}_is1) (Version: 2.5.2 - Wondershare)
Workflow Manager Client 1.0 (HKLM\...\{199C6892-5DED-409B-88B2-3BE6421552B2}) (Version: 2.0.30813.2 - Microsoft Corporation) Hidden
Workflow Manager Tools 1.0 for Visual Studio (HKLM\...\{E1F79421-EC32-437F-8525-ABE902C85AC5}) (Version: 2.0.30725.1 - Microsoft Corporation) Hidden
XAMPP (HKLM-x32\...\xampp) (Version: 7.2.12-0 - Bitnami)
Помощник за актуализация на Windows 10 (HKLM-x32\...\{D5C69738-B486-402E-85AC-2456D98A64E4}) (Version: 1.4.9200.22256 - Microsoft Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} => C:\Program Files (x86)\Notepad++\NppShell_06.dll [2018-03-19] ()
ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2017-08-11] (Alexander Roshal)
ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2017-08-11] (Alexander Roshal)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\WINDOWS\system32\nvshext.dll [2018-11-03] (NVIDIA Corporation)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2017-08-11] (Alexander Roshal)
ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2017-08-11] (Alexander Roshal)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {00C27623-F0B3-4796-A801-4AE4E1396D3A} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {01288DDD-3598-472C-9949-20F5F0AE2C5D} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {012CA266-DD35-4696-9C34-35BD280EA018} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {02AFA076-1DDD-4931-8C61-ED9F3EDE5D30} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {0536BCAF-9AD2-41B0-84BB-01F56EDE9F44} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {05F57127-68D2-414D-B766-3201A081B7F0} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1810.5-0\MpCmdRun.exe [2018-10-23] (Microsoft Corporation)
Task: {0B125084-D1B6-44FF-AEBE-A88504D8EB0D} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {0BFA8B0B-0D52-4955-B205-D097CE2EDA47} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\WINDOWS\ehome\MCUpdate.exe
Task: {1108E94A-375E-46EA-9862-F089AD64856D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-11-19] (Google Inc.)
Task: {14D87B18-FDFD-4F23-828A-F8AA49D0EA65} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\WINDOWS\ehome\ehrec.exe
Task: {1A7B5403-166F-447E-94DB-213482469174} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {239ADB45-B4AA-48CF-84FF-5531E48C1551} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {3344FD1D-C6B0-4CA8-86B2-838E9F965A5F} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {35F6EA47-2EBE-494F-BAF4-D0B2F4AE77F2} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {4FB4237B-B544-4084-95B6-F1AAA48D9C02} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {557FF8BF-8B15-4FC2-A8ED-F2576ACB0E5D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-11-19] (Google Inc.)
Task: {65B85F6F-35B3-4459-A179-28255D5B7B25} - System32\Tasks\Microsoft\Windows\HelloFace\FODCleanupTask => C:\WINDOWS\System32\WinBioPlugIns\FaceFodUninstaller.exe [2018-04-12] ()
Task: {863F9250-E3F5-4CC7-944E-2CCE4E5512F5} - System32\Tasks\[email protected] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-04-04] (Adobe Systems Incorporated)
Task: {96EA1A4A-5DEC-49D8-8F67-9D46A5C6988E} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1810.5-0\MpCmdRun.exe [2018-10-23] (Microsoft Corporation)
Task: {9B83C416-CED1-409D-B1FE-F62EDA31AF1B} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {AA8AFB9D-3468-47CB-AD2F-863A0C03D8C4} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {ADD60DC6-5411-4FC7-941E-9D5EA012C89E} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {B18FCB31-C86B-4BD4-A378-B4B090D40273} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1810.5-0\MpCmdRun.exe [2018-10-23] (Microsoft Corporation)
Task: {B201C777-123E-469F-B4AB-33A919D6ECBA} - System32\Tasks\JavaUpdateSched => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2018-06-27] (Oracle Corporation)
Task: {B8F83D97-917A-43EB-B775-6B29568DDE7D} - System32\Tasks\AsrAPPShop => C:\Program Files (x86)\ASRock Utility\APP Shop\AsrAPPShop.exe [2017-04-25] ()
Task: {BFE05B5A-CA60-45EB-8C38-F35B7262E5E4} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\WINDOWS\ehome\mcupdate.exe
Task: {C51DCB1D-8472-41CB-A731-DEFB06A37942} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {D4F885D7-E982-4221-B6C2-FB843C624864} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {DB0B25C8-D1C9-4589-8565-E9E933B36D72} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {EE553738-ED4C-4F20-8C56-36D66973A931} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {F17B0A8E-BAC9-4FFA-9BD3-F550B89BAC23} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1810.5-0\MpCmdRun.exe [2018-10-23] (Microsoft Corporation)
Task: {F60856C9-7D12-4560-8C19-CD23BC477D8D} - System32\Tasks\MySQL\Installer\ManifestUpdate => C:\Program Files (x86)\MySQL\MySQL Installer for Windows\MySQLInstallerConsole.exe [2017-12-23] (Oracle Corporation)
Task: {FDDDEF44-F988-4F57-98CB-33475CBFB3C0} - System32\Tasks\S-1-5-21-2968841199-4106751538-2094254156-1000\DataSenseLiveTileTask => C:\WINDOWS\System32\DataUsageLiveTileTask.exe [2018-04-12] (Microsoft Corporation)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)

Shortcut: C:\Users\Micr0\Desktop\petq - Пряк път.lnk -> E:\petq (No File) <==== Cyrillic
Shortcut: C:\Users\Micr0\Desktop\XilisoftVideoConverterPortable - Пряк път.lnk -> D:\Xilisoft Video Converter Ultimate v7.8.19 Build 20170122 Portable\XilisoftVideoConverterPortable.exe (No File) <==== Cyrillic
Shortcut: C:\Users\Micr0\Desktop\Помощник за актуализация на Windows 10.lnk -> C:\Windows10Upgrade\Windows10UpgraderApp.exe (No File) <==== Cyrillic
Shortcut: C:\Users\Micr0\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JBoss Web 2.1\JBoss Web Home Page.lnk -> hxxp://labs.jboss.com/jbossweb
Shortcut: C:\Users\Micr0\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JBoss Web 2.1\JBoss Web Manager.lnk -> hxxp://localhost:8080/manager/htm
Shortcut: C:\Users\Micr0\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JBoss Web 2.1\Welcome.lnk -> hxxp://localhost:8080
Shortcut: C:\Users\Micr0\AppData\Roaming\Microsoft\Windows\SendTo\Прехвърляне на файлове с Bluetooth.LNK -> C:\Windows\System32\fsquirt.exe (Microsoft Corporation) <==== Cyrillic
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Помощник за актуализация на Windows 10.lnk -> C:\Windows10Upgrade\Windows10UpgraderApp.exe (No File) <==== Cyrillic

ShortcutWithArgument: C:\Users\Micr0\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Приложения в Chrome\Отдалечен работен плот на Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=gbchcmhmhahfdphkhkmpfmihenigjmpp
ShortcutWithArgument: C:\Users\Micr0\AppData\Roaming\Microsoft\Windows\SendTo\Получател на факса.lnk -> C:\Windows\System32\WFS.exe (Microsoft Corporation) -> /SendTo <==== Cyrillic

==================== Loaded Modules (Whitelisted) ==============

2017-12-28 05:06 - 2017-12-28 05:06 - 039551488 _____ () C:\Program Files\MySQL\MySQL Server 5.7\bin\mysqld.exe
2017-11-19 12:31 - 2017-04-25 18:16 - 006179080 _____ () C:\Program Files (x86)\ASRock Utility\APP Shop\AsrAPPShop.exe
2018-04-12 01:34 - 2018-04-12 01:34 - 000491744 _____ () C:\WINDOWS\SYSTEM32\inputhost.dll
2018-04-12 01:34 - 2018-04-12 01:34 - 000472064 _____ () C:\Windows\ShellExperiences\TileControl.dll
2018-04-12 01:34 - 2018-04-12 01:34 - 002759168 _____ () C:\Windows\ShellComponents\TaskFlowUI.dll
2018-03-19 01:40 - 2018-03-19 01:40 - 000230064 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2018-11-14 18:06 - 2018-11-01 08:55 - 002185216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2018-10-27 19:48 - 2018-10-27 19:48 - 000054440 _____ () C:\Program Files\FileZilla FTP Client\fzshellext_64.dll
2018-10-04 22:32 - 2018-10-04 22:33 - 000009216 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.35.76.0_x64__kzf8qxf38zg5c\ImagePipelineNative.dll
2018-12-05 20:27 - 2018-12-05 20:27 - 000060416 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.35.76.0_x64__kzf8qxf38zg5c\ChakraBridge.dll
2018-12-05 20:27 - 2018-12-05 20:27 - 000019456 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.35.76.0_x64__kzf8qxf38zg5c\SkypeProxiesAndStubs.dll
2018-12-05 20:27 - 2018-12-05 20:27 - 010885632 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.35.76.0_x64__kzf8qxf38zg5c\LibWrapper.dll
2018-12-05 20:27 - 2018-12-05 20:27 - 002850816 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.35.76.0_x64__kzf8qxf38zg5c\skypert.dll
2018-12-05 20:27 - 2018-12-05 20:27 - 000688128 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.35.76.0_x64__kzf8qxf38zg5c\RtmMvrUap.dll
2018-12-05 20:27 - 2018-12-05 20:27 - 000182272 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.35.76.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe
2018-07-11 01:06 - 2018-07-11 01:06 - 001922224 _____ () C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.10314.31700.1000_x64__8wekyb3d8bbwe\Microsoft.Applications.Telemetry.Windows.dll
2018-10-27 15:57 - 2018-10-27 15:57 - 035118592 _____ () C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18082.13811.0_x64__8wekyb3d8bbwe\Video.UI.exe
2018-10-27 15:57 - 2018-10-27 15:57 - 000290816 _____ () C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18082.13811.0_x64__8wekyb3d8bbwe\SharedUI.dll
2018-10-27 15:57 - 2018-10-27 15:57 - 005987328 _____ () C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18082.13811.0_x64__8wekyb3d8bbwe\EntCommon.dll
2017-11-19 11:15 - 2017-11-19 11:15 - 003553704 _____ () C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18082.13811.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll
2018-10-27 15:57 - 2018-10-27 15:57 - 009064448 _____ () C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18082.13811.0_x64__8wekyb3d8bbwe\EntPlat.dll
2018-11-28 00:34 - 2018-11-16 07:43 - 005020504 _____ () C:\Program Files (x86)\Google\Chrome\Application\70.0.3538.110\libglesv2.dll
2018-11-28 00:34 - 2018-11-16 07:43 - 000116056 _____ () C:\Program Files (x86)\Google\Chrome\Application\70.0.3538.110\libegl.dll
2018-08-29 23:53 - 2018-10-30 20:06 - 001057056 _____ () C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\SDL2.dll
2018-08-29 23:53 - 2018-09-23 02:00 - 102804768 _____ () C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\libcef.dll
2018-08-29 23:53 - 2018-09-23 02:00 - 004866336 _____ () C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\libglesv2.dll
2018-08-29 23:53 - 2018-09-23 02:00 - 000116000 _____ () C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\libegl.dll
2018-11-14 02:29 - 2018-11-14 02:30 - 000478720 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
2018-11-14 02:29 - 2018-11-14 02:30 - 066031104 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\Microsoft.Photos.dll
2017-11-19 11:17 - 2017-11-19 11:18 - 002523136 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\UnityEngineDelegates.dll
2018-11-09 06:14 - 2018-11-09 06:15 - 003715072 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\MediaEngineCSWrapper.dll
2018-11-09 06:14 - 2018-11-09 06:15 - 000010752 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\RenderingPlugin.dll
2018-08-24 20:15 - 2018-08-24 20:16 - 002280960 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\opencv_core320.dll
2018-11-09 06:14 - 2018-11-09 06:15 - 000036352 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\WinMLWrapper.UWP.dll
2018-08-24 20:15 - 2018-08-24 20:16 - 002480640 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\opencv_imgproc320.dll
2018-04-05 13:02 - 2018-04-05 13:02 - 002283008 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\TrackingDLLUWP.dll
2018-11-14 02:29 - 2018-11-14 02:30 - 014097920 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\PhotosApp.Windows.dll
2018-11-09 06:14 - 2018-11-09 06:15 - 003569152 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\MediaEngine.dll
2018-11-14 02:29 - 2018-11-14 02:29 - 002863616 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\AppCore.Windows.dll
2018-08-29 23:59 - 2018-08-30 00:00 - 000973312 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\RuntimeConfiguration.dll
2018-07-27 02:33 - 2018-07-27 02:34 - 004584960 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll
2018-11-06 16:37 - 2018-11-06 16:37 - 000194048 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_11810.1001.12.0_x64__8wekyb3d8bbwe\WinStore.Preview.dll
2018-11-06 16:37 - 2018-11-06 16:37 - 002538056 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_11810.1001.12.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll
2018-11-06 16:37 - 2018-11-06 16:37 - 001754112 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_11810.1001.12.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl.dll
2017-11-19 23:01 - 2018-10-30 20:06 - 000879904 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2017-11-19 23:01 - 2018-11-26 22:29 - 002649376 _____ () C:\Program Files (x86)\Steam\video.dll
2017-11-19 23:00 - 2016-09-01 03:02 - 004969248 _____ () C:\Program Files (x86)\Steam\v8.dll
2017-12-18 22:44 - 2017-12-20 03:43 - 000351520 _____ () C:\Program Files (x86)\Steam\libavresample-3.dll
2017-12-18 22:44 - 2017-12-20 03:43 - 000695584 _____ () C:\Program Files (x86)\Steam\libavformat-57.dll
2017-12-18 22:44 - 2017-12-20 03:43 - 000847136 _____ () C:\Program Files (x86)\Steam\libavutil-55.dll
2017-12-18 22:44 - 2017-12-20 03:43 - 000783648 _____ () C:\Program Files (x86)\Steam\libswscale-4.dll
2017-12-18 22:44 - 2017-12-20 03:43 - 005137696 _____ () C:\Program Files (x86)\Steam\libavcodec-57.dll
2017-11-19 23:01 - 2016-09-01 03:02 - 001195296 _____ () C:\Program Files (x86)\Steam\icuuc.dll
2017-11-19 23:00 - 2016-09-01 03:02 - 001563936 _____ () C:\Program Files (x86)\Steam\icui18n.dll
2017-11-19 23:01 - 2018-11-26 22:29 - 001028384 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2017-11-19 23:00 - 2016-07-05 00:17 - 000266560 _____ () C:\Program Files (x86)\Steam\openvr_api.dll
2018-08-16 19:27 - 2016-07-21 09:54 - 000137728 _____ () C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\CBSCreateVC.dll
2018-08-16 19:27 - 2016-10-08 15:48 - 001506304 _____ () C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\DAQExp.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\Public\AppData:CSM [484]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 000000824 _____ C:\WINDOWS\system32\Drivers\etc\hosts

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2968841199-4106751538-2094254156-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Micr0\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\21291324_1026242614145557_1614710554_n.jpg
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: )
HKLM\software\microsoft\Windows\CurrentVersion\Telephony\Providers => ProviderFileName2 -> ndptsp.tsp (No File)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

If an entry is included in the fixlist, it will be removed.

HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "AdobeCS6ServiceManager"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [UDP Query User{99745C12-30CC-4318-958B-F1A2A2F80039}C:\program files\android\android studio\jre\bin\java.exe] => (Allow) C:\program files\android\android studio\jre\bin\java.exe
FirewallRules: [TCP Query User{115C55D3-13F1-4695-9481-3AEECD7AA7F4}C:\program files\android\android studio\jre\bin\java.exe] => (Allow) C:\program files\android\android studio\jre\bin\java.exe
FirewallRules: [{EF6C1E04-4850-48FC-AE26-AA57FC671A8E}] => (Allow) D:\Game\SteamLibrary\steamapps\common\Warframe\Tools\RemoteCrashSender.exe
FirewallRules: [{37587A82-D659-4F59-ABEB-57CB750F04B4}] => (Allow) D:\Game\SteamLibrary\steamapps\common\Warframe\Tools\Launcher.exe
FirewallRules: [{71FFF919-E756-4EE8-A9A9-1C7FD4FE05AF}] => (Allow) D:\Game\SteamLibrary\steamapps\common\Warframe\Warframe.x64.exe
FirewallRules: [{EC9FC8C5-4463-475E-8C42-8FEAD85D6A1E}] => (Allow) D:\Game\SteamLibrary\steamapps\common\Warframe\Warframe.exe
FirewallRules: [{C8FB4038-FED8-4C98-AEBD-996C80016797}] => (Allow) D:\Game\SteamLibrary\steamapps\common\Warframe\Warframe.x64.exe
FirewallRules: [{2A41E313-9536-47D7-8997-F964D3AAF98A}] => (Allow) D:\Game\SteamLibrary\steamapps\common\Warframe\Warframe.exe
FirewallRules: [{7A542F0E-907F-4BF0-888C-45AF0BDCA6AF}] => (Allow) D:\Game\SteamLibrary\steamapps\common\Warframe\Tools\RemoteCrashSender.exe
FirewallRules: [{02E050D5-1F31-4A99-A94F-46D245EEE8D3}] => (Allow) D:\Game\SteamLibrary\steamapps\common\Warframe\Tools\Launcher.exe
FirewallRules: [{5F240534-2C7A-4343-B551-B19D7993BC60}] => (Allow) D:\Game\SteamLibrary\steamapps\common\Warframe\Warframe.x64.exe
FirewallRules: [{2557B77D-C14D-489A-8776-08DC9A0CAD37}] => (Allow) D:\Game\SteamLibrary\steamapps\common\Warframe\Warframe.exe
FirewallRules: [{9C7020E0-4B52-48F3-9A0C-5640F4DCAC75}] => (Allow) D:\Game\SteamLibrary\steamapps\common\Warframe\Warframe.x64.exe
FirewallRules: [{D34A8B15-6775-44A9-AA36-9522FB4F31F9}] => (Allow) D:\Game\SteamLibrary\steamapps\common\Warframe\Warframe.exe
FirewallRules: [{1D7D3AC8-F669-4859-93B6-9D37ECB5EDAD}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{11634872-CDCF-4FE1-8CAB-C4B5007F801A}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{1CA348B4-919D-4EBD-9147-4BEDE06614C5}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{9B80A200-4DB7-4755-84A5-EE40CC940EC7}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [UDP Query User{1061EA63-7E5C-4510-9102-9C149E54F91C}C:\users\micr0\desktop\нова папка (4)\нова папка\resources\app\sia\siad.exe] => (Allow) C:\users\micr0\desktop\нова папка (4)\нова папка\resources\app\sia\siad.exe
FirewallRules: [TCP Query User{0E0517E6-FC37-4810-AB6E-4883A3420378}C:\users\micr0\desktop\нова папка (4)\нова папка\resources\app\sia\siad.exe] => (Allow) C:\users\micr0\desktop\нова папка (4)\нова папка\resources\app\sia\siad.exe
FirewallRules: [UDP Query User{2F100A00-464B-41A8-A3F7-5124B63D4B47}C:\users\micr0\appdata\local\temp\rar$exa920.6020\hshare-qt.exe] => (Allow) C:\users\micr0\appdata\local\temp\rar$exa920.6020\hshare-qt.exe
FirewallRules: [TCP Query User{9EEAB0B0-0BAD-4BA2-AFAA-F239500D8165}C:\users\micr0\appdata\local\temp\rar$exa920.6020\hshare-qt.exe] => (Allow) C:\users\micr0\appdata\local\temp\rar$exa920.6020\hshare-qt.exe
FirewallRules: [UDP Query User{8A2C1216-40C8-4343-A0BB-3FA0FB347D1A}C:\users\micr0\desktop\нова папка (2)\ethdcrminer64.exe] => (Allow) C:\users\micr0\desktop\нова папка (2)\ethdcrminer64.exe
FirewallRules: [TCP Query User{3DDF76BD-CF2B-46B0-AD6A-77B1C1DC9433}C:\users\micr0\desktop\нова папка (2)\ethdcrminer64.exe] => (Allow) C:\users\micr0\desktop\нова папка (2)\ethdcrminer64.exe
FirewallRules: [UDP Query User{ABEEFCC7-D5B9-46BA-B24B-A8C8677F649E}C:\users\micr0\appdata\roaming\ethereum wallet\binaries\geth\unpacked\geth.exe] => (Allow) C:\users\micr0\appdata\roaming\ethereum wallet\binaries\geth\unpacked\geth.exe
FirewallRules: [TCP Query User{6BFC5BBB-9935-4D49-BD1C-1EDD0D7E6E29}C:\users\micr0\appdata\roaming\ethereum wallet\binaries\geth\unpacked\geth.exe] => (Allow) C:\users\micr0\appdata\roaming\ethereum wallet\binaries\geth\unpacked\geth.exe
FirewallRules: [{3E87358E-687A-4908-820B-F332A454C2CD}] => (Allow) LPort=3306
FirewallRules: [{6776E10E-429F-4BE2-A457-782D7A65371E}] => (Allow) LPort=3306
FirewallRules: [UDP Query User{55629BD6-BB5D-4A77-B845-D7DED1943FA7}D:\programi\xampp\apache\bin\httpd.exe] => (Allow) D:\programi\xampp\apache\bin\httpd.exe
FirewallRules: [TCP Query User{BEE5B33E-B646-421D-A320-1E4DBB2B2860}D:\programi\xampp\apache\bin\httpd.exe] => (Allow) D:\programi\xampp\apache\bin\httpd.exe
FirewallRules: [UDP Query User{9D94A5D8-D927-4586-BEA9-8393063014EE}D:\programi\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe] => (Allow) D:\programi\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe
FirewallRules: [TCP Query User{DBC40ABC-2874-4FD1-BBE9-6B5E8A56881B}D:\programi\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe] => (Allow) D:\programi\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe
FirewallRules: [UDP Query User{834B2DD9-312C-4454-8375-8CDACC4CD55C}D:\programi\epic games\unrealtournament\engine\binaries\win64\ue4-win64-shipping.exe] => (Allow) D:\programi\epic games\unrealtournament\engine\binaries\win64\ue4-win64-shipping.exe
FirewallRules: [TCP Query User{4A874387-F119-4CB0-9F48-2825083C0D9E}D:\programi\epic games\unrealtournament\engine\binaries\win64\ue4-win64-shipping.exe] => (Allow) D:\programi\epic games\unrealtournament\engine\binaries\win64\ue4-win64-shipping.exe
FirewallRules: [UDP Query User{91464928-C7C6-47A9-8CEA-777B6DD26C89}D:\programi\epic games\ue_4.18\engine\binaries\win64\ue4editor.exe] => (Allow) D:\programi\epic games\ue_4.18\engine\binaries\win64\ue4editor.exe
FirewallRules: [TCP Query User{19BD51D9-B552-484F-89DD-B6E3C7A3EC72}D:\programi\epic games\ue_4.18\engine\binaries\win64\ue4editor.exe] => (Allow) D:\programi\epic games\ue_4.18\engine\binaries\win64\ue4editor.exe
FirewallRules: [UDP Query User{570A86D4-208C-4151-B3FA-150196ED2E6E}D:\programi\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe] => (Allow) D:\programi\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe
FirewallRules: [TCP Query User{B1B8A7B4-8D64-4C66-9896-C429B212D2DA}D:\programi\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe] => (Allow) D:\programi\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe
FirewallRules: [UDP Query User{4B69B235-D29C-4222-B2C4-2E3C52703EA2}D:\programi\epic games\launcher\portal\binaries\win32\epicgameslauncher.exe] => (Allow) D:\programi\epic games\launcher\portal\binaries\win32\epicgameslauncher.exe
FirewallRules: [TCP Query User{12A1933A-B88C-43B1-A0D3-EA5F8ED0934D}D:\programi\epic games\launcher\portal\binaries\win32\epicgameslauncher.exe] => (Allow) D:\programi\epic games\launcher\portal\binaries\win32\epicgameslauncher.exe
FirewallRules: [{B0A53C63-C0BD-4195-9F0A-541D651A28DB}] => (Allow) D:\Game\SteamLibrary\steamapps\common\MOBIUS FINAL FANTASY\mobiusff.exe
FirewallRules: [{BBD8AAEE-3584-4124-AD29-0FE8053E96C8}] => (Allow) D:\Game\SteamLibrary\steamapps\common\MOBIUS FINAL FANTASY\mobiusff.exe
FirewallRules: [UDP Query User{D4425FD5-BF6F-43FD-A9B4-64E39BAB8891}D:\game\counter-strike global offensive\csgo.exe] => (Allow) D:\game\counter-strike global offensive\csgo.exe
FirewallRules: [TCP Query User{B5CA9E43-E5F5-4245-A4ED-5E72C1DE97EC}D:\game\counter-strike global offensive\csgo.exe] => (Allow) D:\game\counter-strike global offensive\csgo.exe
FirewallRules: [{D46969A8-57FC-4D19-9B39-8B96210A9587}] => (Allow) LPort=12292
FirewallRules: [{5F39D677-D653-412F-AE5B-8207908BD43F}] => (Allow) D:\Programi\Visual Studio\Visual Studio 2013\Common7\IDE\devenv.exe
FirewallRules: [{0B8D8CA8-8826-4D37-9FDB-5F155514A9B6}] => (Allow) D:\Programi\Visual Studio\Visual Studio 2013\Common7\IDE\devenv.exe
FirewallRules: [{A45E4495-5C8F-439F-B469-B0CD7CAF90FB}] => (Allow) D:\Programi\Visual Studio\Visual Studio 2013\Common7\IDE\devenv.exe
FirewallRules: [{45FF3CAA-545C-4BE6-9B98-65270086E6A4}] => (Allow) D:\Programi\Visual Studio\Visual Studio 2013\Common7\IDE\devenv.exe
FirewallRules: [{EF286FB3-1972-4DF7-B382-F6FA681186CD}] => (Allow) D:\Programi\Visual Studio\Visual Studio 2013\Common7\IDE\devenv.exe
FirewallRules: [{D36E0291-22F1-4010-8970-AD89154EE474}] => (Allow) D:\Programi\Visual Studio\Visual Studio 2013\Common7\IDE\devenv.exe
FirewallRules: [{15036FDD-F730-43EA-B5A4-30C5A1274F14}] => (Allow) D:\Programi\Visual Studio\Visual Studio 2013\Common7\IDE\devenv.exe
FirewallRules: [{41355D21-50A0-4729-9CE4-309B675BE495}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{F37D6B92-30A9-4F07-80AE-1F139642EA9B}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{76D4AA9D-6609-4395-913F-795ED0ED38CB}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{F1D140DD-DD8F-465F-B9D8-EDE2F2D80AB0}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{5A8243F3-AA81-499B-BD1D-AFE669DAD477}] => (Allow) C:\Program Files (x86)\uTorrent\uTorrent.exe
FirewallRules: [{604D2034-A486-484B-8F50-830390FC7853}] => (Allow) C:\Program Files (x86)\uTorrent\uTorrent.exe
FirewallRules: [{5B72AC93-8965-4752-ACB2-11DFB2D15B54}] => (Allow) C:\Users\Micr0\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{58D4A378-2E50-499C-8A7E-CB4345870A12}] => (Allow) C:\Users\Micr0\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [TCP Query User{5D86485D-C0E2-4184-A207-F5452FBF7999}D:\programi\eclipse\eclipse\eclipse.exe] => (Allow) D:\programi\eclipse\eclipse\eclipse.exe
FirewallRules: [UDP Query User{6C6A4253-B7F5-42AC-864E-9580FC061DB7}D:\programi\eclipse\eclipse\eclipse.exe] => (Allow) D:\programi\eclipse\eclipse\eclipse.exe
FirewallRules: [TCP Query User{BCF2E503-7CC9-4B85-B06E-FC727FE8ADA3}C:\program files\java\jre1.8.0_171\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_171\bin\javaw.exe
FirewallRules: [UDP Query User{0637BFF7-0CAA-4C3F-92FD-E2171D532286}C:\program files\java\jre1.8.0_171\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_171\bin\javaw.exe
FirewallRules: [TCP Query User{245609DC-A810-4B87-B609-AFB0DDC21347}D:\game\mothergunship\towerofguns2\binaries\win64\towerofguns2-win64-shipping.exe] => (Allow) D:\game\mothergunship\towerofguns2\binaries\win64\towerofguns2-win64-shipping.exe
FirewallRules: [UDP Query User{9BDD349F-A7AA-4C44-AB9D-BF7CB5269DC2}D:\game\mothergunship\towerofguns2\binaries\win64\towerofguns2-win64-shipping.exe] => (Allow) D:\game\mothergunship\towerofguns2\binaries\win64\towerofguns2-win64-shipping.exe
FirewallRules: [TCP Query User{712D8907-2B10-4548-9DE4-DD040112336D}D:\game\steamlibrary\steamapps\common\paladins\binaries\win64\paladins.exe] => (Allow) D:\game\steamlibrary\steamapps\common\paladins\binaries\win64\paladins.exe
FirewallRules: [UDP Query User{C63A49AB-E6FC-4971-B769-4DF9EA7E450D}D:\game\steamlibrary\steamapps\common\paladins\binaries\win64\paladins.exe] => (Allow) D:\game\steamlibrary\steamapps\common\paladins\binaries\win64\paladins.exe
FirewallRules: [{2DFB3A93-BF8B-4AE2-8991-932E2CB6DC4F}] => (Allow) D:\Game\SteamLibrary\steamapps\common\CopperCube 6\CopperCube.exe
FirewallRules: [{7F26A968-A554-4EBF-BAC1-E391BE74FD77}] => (Allow) D:\Game\SteamLibrary\steamapps\common\CopperCube 6\CopperCube.exe
FirewallRules: [{2A06F963-5BFC-4724-A2CF-643B53DEDB05}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
FirewallRules: [{777DE544-A293-4953-BA81-C66B18FCD2AE}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
FirewallRules: [TCP Query User{78F6723C-9E06-4D60-953D-9BE5255D4D81}D:\games\counter-strike\hl.exe] => (Allow) D:\games\counter-strike\hl.exe
FirewallRules: [UDP Query User{C74AC25B-7562-4517-B3B4-B2EB0FDF0BF8}D:\games\counter-strike\hl.exe] => (Allow) D:\games\counter-strike\hl.exe
FirewallRules: [TCP Query User{DAADDE09-75B7-42CB-B7F2-FC0A6C81E930}D:\games\dying light\dyinglightgame.exe] => (Allow) D:\games\dying light\dyinglightgame.exe
FirewallRules: [UDP Query User{ACDF88F6-82E3-4A54-86F7-FC052EBAB43A}D:\games\dying light\dyinglightgame.exe] => (Allow) D:\games\dying light\dyinglightgame.exe
FirewallRules: [{B175417B-5237-40D5-B402-30C846C91B3C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\CSNZ\Bin\cstrike-online.exe
FirewallRules: [{13605212-EC9F-490A-AAC0-F2B77AE772A1}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\CSNZ\Bin\cstrike-online.exe
FirewallRules: [TCP Query User{59E18DA3-9383-41E6-9086-8470EB6D6E26}D:\game\steamlibrary\steamapps\common\citybattle virtual earth\warguardgame\binaries\win64\warguardgameclient-win64-shipping.exe] => (Allow) D:\game\steamlibrary\steamapps\common\citybattle virtual earth\warguardgame\binaries\win64\warguardgameclient-win64-shipping.exe
FirewallRules: [UDP Query User{87A2A891-8165-40D4-8A75-69DABA7BF929}D:\game\steamlibrary\steamapps\common\citybattle virtual earth\warguardgame\binaries\win64\warguardgameclient-win64-shipping.exe] => (Allow) D:\game\steamlibrary\steamapps\common\citybattle virtual earth\warguardgame\binaries\win64\warguardgameclient-win64-shipping.exe
FirewallRules: [TCP Query User{F27FE178-AE11-4F9A-A085-046CD54ABB52}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
FirewallRules: [UDP Query User{B21380D5-074B-4E5D-A691-7C88DDEBC198}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
FirewallRules: [{531AD6D7-2D41-43C5-B56B-27539455EF57}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Restore Points =========================

23-11-2018 16:44:39 Програма за инсталиране на модули за Windows
24-11-2018 18:44:42 Програма за инсталиране на модули за Windows
25-11-2018 20:44:45 Програма за инсталиране на модули за Windows
26-11-2018 22:44:34 Програма за инсталиране на модули за Windows
28-11-2018 00:44:35 Програма за инсталиране на модули за Windows
29-11-2018 02:44:34 Програма за инсталиране на модули за Windows
30-11-2018 04:44:37 Програма за инсталиране на модули за Windows
01-12-2018 06:44:44 Програма за инсталиране на модули за Windows
02-12-2018 08:44:44 Програма за инсталиране на модули за Windows
03-12-2018 10:44:39 Програма за инсталиране на модули за Windows
04-12-2018 12:44:39 Програма за инсталиране на модули за Windows
05-12-2018 14:44:39 Програма за инсталиране на модули за Windows
06-12-2018 16:44:38 Програма за инсталиране на модули за Windows
07-12-2018 18:45:25 Програма за инсталиране на модули за Windows
08-12-2018 20:46:06 Програма за инсталиране на модули за Windows

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (12/09/2018 02:42:49 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: Unable to read the performance counter strings defined for the 002 language ID. The first DWORD in the Data section contains the Win32 error code.

Error: (12/09/2018 02:42:49 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: Unable to read the performance counter strings defined for the 002 language ID. The first DWORD in the Data section contains the Win32 error code.

Error: (12/08/2018 11:10:44 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: Unable to read the performance counter strings defined for the 002 language ID. The first DWORD in the Data section contains the Win32 error code.

Error: (12/08/2018 11:10:44 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: Unable to read the performance counter strings defined for the 002 language ID. The first DWORD in the Data section contains the Win32 error code.

Error: (12/08/2018 10:20:39 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: Unable to read the performance counter strings defined for the 002 language ID. The first DWORD in the Data section contains the Win32 error code.

Error: (12/08/2018 10:20:39 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: Unable to read the performance counter strings defined for the 002 language ID. The first DWORD in the Data section contains the Win32 error code.

Error: (12/08/2018 10:09:27 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Име на приложение с грешки: dwm.exe, версия: 10.0.17134.1, времево клеймо: 0xf5178e97
Име на модул с грешки: unknown, версия: 0.0.0.0, времево клеймо: 0x00000000
Код на изключение: 0xe0464645
Отместване на грешка: 0x0000000000000000
ИД на процес на грешка: 0x1764
Начален час на приложението с грешки: 0x01d48f31ebcae540
Път на приложението с грешки: C:\WINDOWS\system32\dwm.exe
Път на модула с грешки: unknown
ИД на доклад: b3c3d67e-f674-4f38-b72f-f7a59435f493
Пълно име на пакета с грешка:
ИД на свързаното с пакета с грешка приложение:

Error: (12/08/2018 10:09:26 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Име на приложение с грешки: dwm.exe, версия: 10.0.17134.1, времево клеймо: 0xf5178e97
Име на модул с грешки: unknown, версия: 0.0.0.0, времево клеймо: 0x00000000
Код на изключение: 0xe0464645
Отместване на грешка: 0x0000000000000000
ИД на процес на грешка: 0xe30
Начален час на приложението с грешки: 0x01d48f31eb355052
Път на приложението с грешки: C:\WINDOWS\system32\dwm.exe
Път на модула с грешки: unknown
ИД на доклад: e33b5072-e9d0-4453-b948-c22ef9a9a651
Пълно име на пакета с грешка:
ИД на свързаното с пакета с грешка приложение:

System errors:
=============
Error: (12/09/2018 06:32:10 PM) (Source: DCOM) (EventID: 10016) (User: MICR0-PC)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
and APPID
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
to the user Micr0-PC\Micr0 SID (S-1-5-21-2968841199-4106751538-2094254156-1000) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.ContentDeliveryManager_10.0.17134.1_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723). This security permission can be modified using the Component Services administrative tool.

Error: (12/09/2018 06:25:37 PM) (Source: DCOM) (EventID: 10016) (User: MICR0-PC)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
and APPID
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
to the user Micr0-PC\Micr0 SID (S-1-5-21-2968841199-4106751538-2094254156-1000) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.ContentDeliveryManager_10.0.17134.1_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723). This security permission can be modified using the Component Services administrative tool.

Error: (12/09/2018 02:41:43 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
Windows.SecurityCenter.WscDataProtection
and APPID
Unavailable
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (12/09/2018 02:41:43 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
Windows.SecurityCenter.WscBrokerManager
and APPID
Unavailable
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (12/09/2018 02:41:06 PM) (Source: DCOM) (EventID: 10016) (User: MICR0-PC)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user Micr0-PC\Micr0 SID (S-1-5-21-2968841199-4106751538-2094254156-1000) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (12/09/2018 02:40:41 PM) (Source: DCOM) (EventID: 10016) (User: MICR0-PC)
Description: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
Windows.SecurityCenter.WscCloudBackupProvider
and APPID
Unavailable
to the user Micr0-PC\Micr0 SID (S-1-5-21-2968841199-4106751538-2094254156-1000) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (12/09/2018 02:40:05 PM) (Source: DCOM) (EventID: 10016) (User: MICR0-PC)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user Micr0-PC\Micr0 SID (S-1-5-21-2968841199-4106751538-2094254156-1000) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (12/09/2018 02:37:59 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 14:24:10 on ‎9.‎12.‎2018 ‎г. was unexpected.

Windows Defender:
===================================
Date: 2018-12-08 22:31:21.183
Description:
Windows Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Win32/CoinMiner&threatid=2147672528&enterprise=0
Name: Trojan:Win32/CoinMiner
ID: 2147672528
Severity: Много високо
Category: Троянски кон
Path: file:_C:\Users\Micr0\Desktop\Нова папка (7)\Нова папка (2)\Нова папка\nheqminer.exe
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: Real-Time Protection
Process Name: C:\Windows\System32\SearchProtocolHost.exe
Signature Version: AV: 1.283.148.0, AS: 1.283.148.0, NIS: 1.283.148.0
Engine Version: AM: 1.1.15500.2, NIS: 1.1.15500.2

==================== Memory info ===========================

Processor: Intel(R) Core(TM) i3-7100 CPU @ 3.90GHz
Percentage of memory in use: 49%
Total physical RAM: 8147.36 MB
Available physical RAM: 4113.05 MB
Total Virtual: 16339.36 MB
Available Virtual: 10872.55 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:247.37 GB) (Free:75.71 GB) NTFS
Drive d: () (Fixed) (Total:683.59 GB) (Free:394.43 GB) NTFS

\\?\Volume{5df23bc4-ccc1-11e7-8d87-806e6f6e6963}\ (Резервирана за системата) (Fixed) (Total:0.1 GB) (Free:0.06 GB) NTFS
\\?\Volume{b0768c71-0000-0000-0000-10de3d000000}\ () (Fixed) (Total:0.45 GB) (Free:0.07 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7/8/10) (Size: 931.5 GB) (Disk ID: B0768C71)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=247.4 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=459 MB) - (Type=27)
Partition 4: (Not Active) - (Size=683.6 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

Благодаря за отделеното време

10 декември 20187 г.

Здравейте,

Видях от лог файла, че Windows Defender е премахнал файл в папка създадена от вас. Т.е. не мисля, че системата е била заразена или е бил активен/стартиран, а просто свален файл в тази папка от която е бил изтрит.

Цитат

Windows Defender:
===================================
Date: 2018-12-08 22:31:21.183
Description:
Windows Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Win32/CoinMiner&threatid=2147672528&enterprise=0
Name: Trojan:Win32/CoinMiner
ID: 2147672528
Severity: Много високо
Category: Троянски кон
Path: file:_C:\Users\Micr0\Desktop\Нова папка (7)\Нова папка (2)\Нова папка\nheqminer.exe
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: Real-Time Protection
Process Name: C:\Windows\System32\SearchProtocolHost.exe
Signature Version: AV: 1.283.148.0, AS: 1.283.148.0, NIS: 1.283.148.0
Engine Version: AM: 1.1.15500.2, NIS: 1.1.15500.2

От лог файловете не видях активни зарази, но видях в правилата на стената, че сте ползвали програма за друга крипто валута?

Това ми прилича на доброволно инсталирано. Да не би да са остатъци от него, които да причиняват текущия ви проблем?

Цитат

FirewallRules: [UDP Query User{1061EA63-7E5C-4510-9102-9C149E54F91C}C:\users\micr0\desktop\нова папка (4)\нова папка\resources\app\sia\siad.exe] => (Allow) C:\users\micr0\desktop\нова папка (4)\нова папка\resources\app\sia\siad.exe
FirewallRules: [TCP Query User{0E0517E6-FC37-4810-AB6E-4883A3420378}C:\users\micr0\desktop\нова папка (4)\нова папка\resources\app\sia\siad.exe] => (Allow) C:\users\micr0\desktop\нова папка (4)\нова папка\resources\app\sia\siad.exe
FirewallRules: [UDP Query User{2F100A00-464B-41A8-A3F7-5124B63D4B47}C:\users\micr0\appdata\local\temp\rar$exa920.6020\hshare-qt.exe] => (Allow) C:\users\micr0\appdata\local\temp\rar$exa920.6020\hshare-qt.exe
FirewallRules: [TCP Query User{9EEAB0B0-0BAD-4BA2-AFAA-F239500D8165}C:\users\micr0\appdata\local\temp\rar$exa920.6020\hshare-qt.exe] => (Allow) C:\users\micr0\appdata\local\temp\rar$exa920.6020\hshare-qt.exe
FirewallRules: [UDP Query User{8A2C1216-40C8-4343-A0BB-3FA0FB347D1A}C:\users\micr0\desktop\нова папка (2)\ethdcrminer64.exe] => (Allow) C:\users\micr0\desktop\нова папка (2)\ethdcrminer64.exe
FirewallRules: [TCP Query User{3DDF76BD-CF2B-46B0-AD6A-77B1C1DC9433}C:\users\micr0\desktop\нова папка (2)\ethdcrminer64.exe] => (Allow) C:\users\micr0\desktop\нова папка (2)\ethdcrminer64.exe
FirewallRules: [UDP Query User{ABEEFCC7-D5B9-46BA-B24B-A8C8677F649E}C:\users\micr0\appdata\roaming\ethereum wallet\binaries\geth\unpacked\geth.exe] => (Allow) C:\users\micr0\appdata\roaming\ethereum wallet\binaries\geth\unpacked\geth.exe
FirewallRules: [TCP Query User{6BFC5BBB-9935-4D49-BD1C-1EDD0D7E6E29}C:\users\micr0\appdata\roaming\ethereum wallet\binaries\geth\unpacked\geth.exe] => (Allow) C:\users\micr0\appdata\roaming\ethereum wallet\binaries\geth\unpacked\geth.exe

Поздрави!

11 декември 20187 г.

Автор

До сега съм ползвал предимно Browser копачи и страданото е че до сега не съм позволявал в firewall единствено бях теглил един Monero miner който го пробвах под linux на друга машина

а относно peerblock можете ли да ми дадете малко повече информация

при активирането на peerblock беше при изключен торрент и скайп

Благодаря

Поздрави

13 декември 20187 г.

Ами не съм ползвал PeerBlock, но не виждам какво е специалното. Това, което го прави тя, би трябвало да може да го прави всяка защитна стена, която има опция да блокира даден IP RANGE. Вие сте използвали някакви заготовки на адреси и тя си върши работата. Но не мисля, че това е особено добър вариант, защото няма как да блокирате всички IP адреси. По-скоро е за конкретни такива. По-добре да се ползва софтуерна стена или хардуерна (на рутера например) за да филтрира целия трафик, вместо инструмент, който да блокира специфични IP адреси.

Все пак проверете папките, които са bold-нати в цитатите от предишния ми коментар и ако не ползвате вече тези инструменти направо ги изтрийте. Можем да направим и някои проверки, но за мен системата е чиста (поне на ниво логове).

Моля изтеглете Malwarebytes Anti-Malware 3.6.1.2711 Final и я запазете на вашия десктоп.

Стартирайте файла mb3-setup-consumer-3.6.1.2711.exe и следвайте указанията за да инсталирате програмата.
След като инсталацията приключи програмата ще стартира автоматично.
Отидете до табът Settings => Protection > и под категорията Scan Options включете опцията "Scan for rootkits" като преместите плъзгача надясно.

Отидете до табът Scan, и изберете Threat Scan и след това натиснете бутона Start Scan.

Ще започне проверка за зловреден софтуер.

При някои инфекции можете да видите съобщението:
"Could not load DDA driver"
Натиснете "Yes" на това съобщение за да позволите драйвера да се зареди след рестарт.
Разрешете на компютъра да се рестартира и след това продължете с останалите инструкции.
След като проверката приключи ще се появи списъка с резултатите (ако има намерени обекти). Ако програмата е минимизирана докато сканира ще се появи следното съобщение ако има открити заплахи. Натиснете бутона View Scan Results.

. Натиснете бутона Quarantine Selected.

Изчакайте да се появи прозореца подканващ ви да рестартирате и след това натиснете бутона Yes.

След рестарта, стартирайте отново Malwarebytes Anti-Malware.
Отидете то табът Reports и отворете лог файла с името Scan Report.

Натиснете бутона Export и след това => "Copy to Clipboard"

Сега вече поставете съдържанието на лог файла с клавишната комбинация Ctrl + V и го публикувайте в следващия си коментар.

Поздрави!

13 декември 20187 г.

Автор

Стараното от цялата работа че съм теглил само pooler cpu minner i zec miner ehterium копачи за тях не съм теглил което е стараното от цялата работа при положение че ги има в download и даже разархивирани ....

ето лога

Цитат

Malwarebytes
www.malwarebytes.com

-Детайли за регистъра-
Дата на сканиране: 13.12.18 г.
Час на сканиране: 22:54
Файл на регистъра: 5a3cbca4-ff19-11e8-9d9b-7085c2344e74.json

-Информация за софтуера-
Версия: 3.6.1.2711
Версия на компонентите: 1.0.508
Актуализирай версията на пакета: 1.0.8305
Лиценз: Пробен период

-Системна информация-
OS: Windows 10 (Build 17134.471)
CPU: x64
Файлова система: NTFS
Потребител: MICR0-PC\Micr0

-Резюме на сканирането-
Тип сканиране: Threat Scan
Сканирането е стартирано от: Ръчно
Резултат: Завършено
Сканирани обекти: 344146
Открити заплахи: 17
Заплахи под карантина: 0
Изтекло време: 17 мин, 28 сек

-Опции за сканиране-
Памет: Разрешено
Стартиране: Разрешено
Файлова система: Разрешено
Архиви: Разрешено
руткитове: Разрешено
Евристика: Разрешено
PUP: Открий
PUM: Открий

-Детайли за сканирането-
Процес: 0
(Не бяха открити зловредни елементи)

Модул: 0
(Не бяха открити зловредни елементи)

Ключ на регистъра: 0
(Не бяха открити зловредни елементи)

Стойност на регистъра: 0
(Не бяха открити зловредни елементи)

Данни на регистъра: 0
(Не бяха открити зловредни елементи)

Поток данни: 0
(Не бяха открити зловредни елементи)

Папка: 0
(Не бяха открити зловредни елементи)

Файл: 17
PUP.Optional.Reimage, C:\WINDOWS\REIMAGE.INI, Няма действие от потребителя, [326], [412667],1.0.8305
RiskWare.BitCoinMiner, C:\USERS\MICR0\DOWNLOADS\POOLER-CPUMINER-2.5.0-WIN64.ZIP, Няма действие от потребителя, [695], [524997],1.0.8305
RiskWare.BitCoinMiner, C:\USERS\MICR0\DOWNLOADS\ETHEREUM-MINING-WINDOWS.ZIP, Няма действие от потребителя, [695], [311221],1.0.8305
Generic.Malware/Suspicious, C:\USERS\MICR0\DOWNLOADS\ETHEREUM-MINING-WINDOWS.ZIP, Няма действие от потребителя, [0], [392686],1.0.8305
RiskWare.BitCoinMiner, C:\USERS\MICR0\DOWNLOADS\ZEC MINER 0.3.4B.ZIP, Няма действие от потребителя, [695], [467508],1.0.8305
RiskWare.BitCoinMiner, C:\USERS\MICR0\DOWNLOADS\WINDOWS_X64_NHEQMINER-5C.ZIP, Няма действие от потребителя, [695], [409945],1.0.8305
RiskWare.BitCoinMiner, C:\USERS\MICR0\DOWNLOADS\MARLIN-1.0.0-WIN64.ZIP, Няма действие от потребителя, [695], [443304],1.0.8305
RiskWare.BitCoinMiner, C:\USERS\MICR0\DOWNLOADS\WINETH-SETUP.EXE, Няма действие от потребителя, [695], [484438],1.0.8305
RiskWare.BitCoinMiner, C:\USERS\MICR0\DOWNLOADS\CLAYMORE.S.DUAL.ETHEREUM.DECRED_SIACOIN_LBRY_PASCAL.AMD.NVIDIA.GPU.MINER.V10.0.ZIP, Няма действие от потребителя, [695], [440778],1.0.8305
Generic.Malware/Suspicious, C:\USERS\MICR0\DOWNLOADS\CLAYMORE.S.DUAL.ETHEREUM.DECRED_SIACOIN_LBRY_PASCAL.AMD.NVIDIA.GPU.MINER.V10.0.ZIP, Няма действие от потребителя, [0], [392686],1.0.8305
Trojan.BitCoinMiner, C:\USERS\MICR0\DOWNLOADS\CLAYMORE'S DUAL ETHEREUM+DECRED_SIACOIN_LBRY_PASCAL AMD+NVIDIA GPU MINER V10.6 - CATALYST 15.12-17.X - CUDA 8.0_9.1_7.5_6.5.ZIP, Няма действие от потребителя, [573], [489587],1.0.8305
Trojan.BitCoinMiner, C:\USERS\MICR0\DOWNLOADS\ETHMINER-DBG-0.13.0-WINDOWS.ZIP, Няма действие от потребителя, [573], [483817],1.0.8305
RiskWare.BitCoinMiner, C:\USERS\MICR0\DOWNLOADS\ETHMINER-0.13.0-WINDOWS.ZIP, Няма действие от потребителя, [695], [515099],1.0.8305
RiskWare.BitCoinMiner, C:\USERS\MICR0\DOWNLOADS\ETHMINER-0.13.0-WINDOWS (1).ZIP, Няма действие от потребителя, [695], [515099],1.0.8305
RiskWare.BitCoinMiner, C:\USERS\MICR0\APPDATA\LOCAL\WINETH\UPDATE.EXE, Няма действие от потребителя, [695], [484438],1.0.8305
Adware.Elex.ShrtCln, C:\USERS\MICR0\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\SyncData.sqlite3, Няма действие от потребителя, [261], [454742],1.0.8305
Adware.Elex.ShrtCln, C:\USERS\MICR0\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Няма действие от потребителя, [261], [454742],1.0.8305

Физически сектор: 0
(Не бяха открити зловредни елементи)

WMI: 0
(Не бяха открити зловредни елементи)

(end)

поздрави

Благодаря за отделеното време

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.