Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

Допуснах вирус или троянски кон

niknik96
в Премахване на зловреден софтуер

Featured Replies

Здравейте!Допуснах вирус или троянски кон, в резултат на което не мога да отворя нито един файл с разширение doc.,txt,png,jpg,jpeg,mp3,mp4 и т.н.Всичките ми файлове са преименувани като след разширението стоят буквите XQKLBVNMDH.Уиндоуса изписва, че не може да отвори файл с такова разширение.Опитвам се да махна тези букви и да преименувам файла, но след преименуването файла става неизползваем.Инсталирах НОД 32 и ми откри 5065 троянеца, от които успя да почисти 5055, но положението не се промени.Някой може ли да помогне с нещо?

преди 7 минути, niknik96 написа:

Здравейте!Допуснах вирус или троянски кон, в резултат на което не мога да отворя нито един файл с разширение doc.,txt,png,jpg,jpeg,mp3,mp4 и т.н.Всичките ми файлове са преименувани като след разширението стоят буквите XQKLBVNMDH.Уиндоуса изписва, че не може да отвори файл с такова разширение.Опитвам се да махна тези букви и да преименувам файла, но след преименуването файла става неизползваем.Инсталирах НОД 32 и ми откри 5065 троянеца, от които успя да почисти 5055, но положението не се промени.Някой може ли да помогне с нещо?

Прочети тази тема и изпълни стъпките в нея. След това ще изчакаш колега от HJT Team  да ти помогне. Дано не съм прав, но вероятно си лепнал крипто вирус и няма да можеш да възстановиш информацията.

Най-вероятно през системата ти е минал криптиращ вирус.

Шанса да намериш работещ декриприращ софтуер клони към 0, но все пак първо трябва да знаеш от какво си ударен точно.

Бекъп имаш ли?

  • Автор
преди 12 минути, plamen_petrov_80 написа:

Най-вероятно през системата ти е минал криптиращ вирус.

Шанса да намериш работещ декриприращ софтуер клони към 0, но все пак първо трябва да знаеш от какво си ударен точно.

Бекъп имаш ли?

Да

Значи след глобалното и пълно почистване на системата ползваш резервните копия на файловете.

Хубаво е да установиш как го вкара този крипто вирус и как да се пазиш от такива в бъдеще.

  • Автор
преди 15 минути, Емил Костов написа:

Прочети тази тема и изпълни стъпките в нея. След това ще изчакаш колега от HJT Team  да ти помогне. Дано не съм прав, но вероятно си лепнал крипто вирус и няма да можеш да възстановиш информацията.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 09.12.2018
Ran by Admin (administrator) on ADMIN-PC (14-12-2018 16:35:31)
Running from C:\Users\Admin\Desktop
Loaded Profiles: Admin (Available Profiles: Admin)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Opera)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(ESET) C:\Program Files\ESET\ESET Security\ekrn.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
() C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Node.js) C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe
(Copyright 2017.) C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe
(Lenovo) C:\Program Files (x86)\MagicPlus\MagicPlus_helper.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(ESET) C:\Program Files\ESET\ESET Security\egui.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
(EnigmaSoft Limited) C:\Program Files\EnigmaSoft\SpyHunter\ShKernel.exe
(EnigmaSoft Limited) C:\Program Files\EnigmaSoft\SpyHunter\ShMonitor.exe
() E:\Apps1\Apps\Zoek\zoek 2014.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
(Opera Software) C:\Program Files\Opera\56.0.3051.116\opera.exe
(Opera Software) C:\Program Files\Opera\56.0.3051.116\opera_crashreporter.exe
(Opera Software) C:\Program Files\Opera\56.0.3051.116\opera.exe
(Opera Software) C:\Program Files\Opera\56.0.3051.116\opera.exe
(Opera Software) C:\Program Files\Opera\56.0.3051.116\opera.exe
(Opera Software) C:\Program Files\Opera\56.0.3051.116\opera.exe
(Opera Software) C:\Program Files\Opera\56.0.3051.116\opera.exe
(Opera Software) C:\Program Files\Opera\56.0.3051.116\opera.exe
(Opera Software) C:\Program Files\Opera\56.0.3051.116\opera.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [hshhsaaaws] => [X]
HKLM\...\Run: [SERVICE] => [X]
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Security\ecmds.exe [177928 2018-11-29] (ESET)
BootExecute: autocheck autochk * sh4native Sh4Removal

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 62.221.132.211 85.130.60.11
Tcpip\..\Interfaces\{01D03BC8-766F-43DE-8E7D-1F16382484D9}: [DhcpNameServer] 62.221.132.211 85.130.60.11
Tcpip\..\Interfaces\{9C586E7E-713D-48FE-A1D0-30A5A8DC9360}: [DhcpNameServer] 62.221.132.211 85.130.60.11

Internet Explorer:
==================
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = 
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3401822030-582483864-3347882107-1000 -> DefaultScope {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-3401822030-582483864-3347882107-1000 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office16\URLREDIR.DLL [2015-07-31] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office16\URLREDIR.DLL [2015-07-31] (Microsoft Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office16\GROOVEEX.DLL [2017-02-22] (Microsoft Corporation)
IE Session Restore: HKU\S-1-5-21-3401822030-582483864-3347882107-1000 -> is enabled.
Handler: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files\Microsoft Office\Office16\MSOSB.DLL [2017-04-11] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2017-04-11] (Microsoft Corporation)
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\Office16\MSOSB.DLL [2017-04-11] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2017-04-11] (Microsoft Corporation)

FireFox:
========
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-30] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-30] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2018-12-04] (Adobe Systems Inc.)

Chrome: 
=======
CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default [2018-12-13]
CHR Extension: (Презентации) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-12-26]
CHR Extension: (Документи) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-12-26]
CHR Extension: (Google Диск) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-12-26]
CHR Extension: (YouTube) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-12-26]
CHR Extension: (Таблици) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-12-26]
CHR Extension: (Google Документи офлайн) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-12-11]
CHR Extension: (Плащания в уеб магазина на Chrome) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-10-06]
CHR Extension: (Gmail) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-12-26]
CHR Extension: (Chrome Media Router) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-12-11]
CHR HKLM\...\Chrome\Extension: [fagakgcelolinfnkfgekcnedpaklfcok] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx

Opera: 
=======
OPR Session Restore: -> is enabled.

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S4 AEADIFilters; C:\Windows\system32\AEADISRV.EXE [111616 2009-06-05] (Andrea Electronics Corporation)
R2 afcdpsrv; C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [6080088 2017-09-11] ()
S4 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2015-12-18] (Creative Labs) [File not signed]
S4 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [307200 2008-11-18] (Creative Technology Ltd) [File not signed]
S3 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe [1369464 2016-01-15] (Disc Soft Ltd)
R2 ekrn; C:\Program Files\ESET\ESET Security\ekrn.exe [2302160 2018-11-29] (ESET)
R3 ekrnEpfw; C:\Program Files\ESET\ESET Security\ekrn.exe [2302160 2018-11-29] (ESET)
R2 EsgShKernel; C:\Program Files\EnigmaSoft\SpyHunter\ShKernel.exe [9872688 2018-12-14] (EnigmaSoft Limited)
S4 HauppaugeTVServer; C:\Program Files (x86)\WinTV\TVServer\HauppaugeTVServer.exe [583288 2015-02-13] (Hauppauge Computer Works) [File not signed]
S3 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6347056 2018-09-19] (Malwarebytes)
S2 MicroService; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) <==== ATTENTION <==== ATTENTION (no ServiceDLL)
S2 MicroService; C:\Windows\SysWOW64\svchost.exe [20992 2009-07-14] (Microsoft Corporation) <==== ATTENTION <==== ATTENTION (no ServiceDLL)
R2 NvContainerLocalSystem; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [773160 2018-10-10] (NVIDIA Corporation)
S3 NvContainerNetworkService; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [773160 2018-10-10] (NVIDIA Corporation)
S3 PrintNotify; C:\Windows\system32\spool\DRIVERS\x64\3\PrintConfig.dll [3337728 2015-10-30] (Microsoft Corporation) [File not signed]
S3 scan; C:\Program Files\BDServices\scan.dll [652568 2017-08-09] (Bitdefender)
R2 ShMonitor; C:\Program Files\EnigmaSoft\SpyHunter\ShMonitor.exe [538416 2018-12-14] (EnigmaSoft Limited)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2015-12-11] (Microsoft Corporation)
R2 ZAMSvc; C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe [15775888 2017-08-09] (Copyright 2017.)
S2 HitmanPro38CrusaderBoot; "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\x64.exe" /crusader:boot [X] <==== ATTENTION <==== ATTENTION
S4 HuaweiHiSuiteService64.exe; "C:\ProgramData\HandSetService\HuaweiHiSuiteService64.exe" -/service [X]
R2 NVDisplay.ContainerLocalSystem; "C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe" -s NVDisplay.ContainerLocalSystem -f "C:\ProgramData\NVIDIA\NVDisplay.ContainerLocalSystem.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem" -r -p 30000 
S4 NvStreamNetworkSvc; "C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe" [X]
S4 NvStreamSvc; "C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe" [X]
R2 NvTelemetryContainer; "C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe" -s NvTelemetryContainer -f "C:\ProgramData\NVIDIA\NvTelemetryContainer.log" -l 3 -d "C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\plugins" -r
S2 panda_url_filtering; no ImagePath

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 A38CCID; C:\Windows\System32\DRIVERS\a38ccid.sys [75152 2015-12-02] (Advanced Card Systems Ltd.)
S3 AEAudio; C:\Windows\System32\drivers\AEAudio.sys [125824 2009-08-26] (Andrea Electronics Corporation)
S3 dg_ssudbus; C:\Windows\System32\DRIVERS\ssudbus.sys [129152 2016-04-24] (Samsung Electronics Co., Ltd.)
R3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [30264 2016-01-31] (Disc Soft Ltd)
R3 dtliteusbbus; C:\Windows\System32\DRIVERS\dtliteusbbus.sys [47672 2016-01-31] (Disc Soft Ltd)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [143448 2018-11-29] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [188832 2018-10-17] (ESET)
R3 EnigmaFileMonDriver; C:\Windows\system32\Drivers\EnigmaFileMonDriver.sys [61624 2018-12-14] (EnigmaSoft Limited)
R1 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [109864 2018-10-17] (ESET)
S3 ESETCleanersDriver; C:\Windows\system32\Drivers\ESETCleanersDriver.sys [170280 2018-12-04] (ESET)
R3 ETDSMBus; C:\Windows\System32\DRIVERS\ETDSMBus.sys [32840 2017-09-03] (ELAN Microelectronic Corp.)
S3 ew_usbccgpfilter; C:\Windows\System32\DRIVERS\ew_usbccgpfilter.sys [18816 2016-02-16] (Huawei Technologies Co., Ltd.)
R2 file_protector; C:\Windows\System32\DRIVERS\file_protector.sys [559888 2017-09-11] (Acronis International GmbH)
R0 file_tracker; C:\Windows\System32\DRIVERS\file_tracker.sys [378712 2017-09-11] (Acronis International GmbH)
S3 HCW3x64; C:\Windows\System32\DRIVERS\HCW71364.sys [1501656 2014-02-20] (Hauppauge Computer Works, Inc.)
S3 HTCAND64; C:\Windows\System32\Drivers\ANDROIDUSB.sys [33736 2009-11-02] (HTC, Corporation) [File not signed]
R1 HWiNFO32; C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [27552 2016-05-08] (REALiX(tm))
S3 hwusb_cdcacm; C:\Windows\System32\DRIVERS\hw_cdcacm.sys [126592 2016-02-16] (Huawei Technologies Co., Ltd.)
U5 hw_usbdev; C:\Windows\System32\Drivers\hw_usbdev.sys [116864 2016-02-16] (Huawei Technologies Co., Ltd.)
S3 JmUsbCcgp; C:\Windows\System32\DRIVERS\jmccgp.sys [17136 2009-07-29] (JMicron Technology Corp.)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2016-01-28] ()
S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [30792 2018-08-21] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [69544 2018-06-08] (NVIDIA Corporation)
R3 nvvhci; C:\Windows\System32\DRIVERS\nvvhci.sys [74576 2018-10-01] (NVIDIA Corporation)
S3 panda_url_filteringd; no ImagePath
S3 Ph3xIB64; C:\Windows\System32\DRIVERS\Ph3xIB64.sys [1627520 2009-06-10] (NXP Semiconductors)
S2 Sentinel64; C:\Windows\System32\Drivers\Sentinel64.sys [145448 2009-09-17] (SafeNet, Inc.)
S3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [33960 2016-08-22] (Synaptics Incorporated)
S3 ssudmdm; C:\Windows\System32\DRIVERS\ssudmdm.sys [221824 2016-04-24] (Samsung Electronics Co., Ltd.)
R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1310552 2017-09-11] (Acronis International GmbH)
R2 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [213336 2017-09-11] (Acronis International GmbH)
S3 tnd; C:\Windows\System32\DRIVERS\tnd.sys [690520 2017-09-11] (Acronis International GmbH)
S3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [442848 2017-08-09] (BitDefender S.R.L.)
R2 virtual_file; C:\Windows\System32\DRIVERS\virtual_file.sys [326416 2017-09-11] (Acronis International GmbH)
R0 volume_tracker; C:\Windows\System32\DRIVERS\volume_tracker.sys [243472 2017-09-11] (Acronis International GmbH)
S3 wdm_usb; C:\Windows\System32\DRIVERS\usb2ser.sys [150136 2015-11-06] (MBB)
R1 ZAM; C:\Windows\System32\drivers\zam64.sys [203680 2017-09-15] (Zemana Ltd.)
R1 ZAM_Guard; C:\Windows\System32\drivers\zamguard64.sys [203680 2017-09-15] (Zemana Ltd.)
U0 Partizan; system32\drivers\Partizan.sys [X]
S3 SenFiltService; system32\drivers\Senfilt.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-12-14 16:35 - 2018-12-14 16:36 - 000016831 _____ C:\Users\Admin\Desktop\FRST.txt
2018-12-14 16:35 - 2018-12-14 16:35 - 000000000 ____D C:\FRST
2018-12-14 16:34 - 2018-12-14 16:34 - 002417152 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe
2018-12-14 16:24 - 2018-12-14 16:24 - 000000002 _____ C:\runcheck.txt
2018-12-14 16:00 - 2018-12-14 16:00 - 000004056 _____ C:\Windows\System32\Tasks\TR_FastScan_Daily_Admin
2018-12-14 16:00 - 2018-12-14 16:00 - 000003874 _____ C:\Windows\System32\Tasks\TR_Updater
2018-12-14 15:59 - 2018-12-14 15:59 - 011445768 _____ (Simply Super Software ) C:\Users\Admin\Desktop\trjsetup695.exe
2018-12-14 15:59 - 2018-12-14 15:59 - 000003934 _____ C:\Windows\System32\Tasks\TR_FastScan_AtLogon
2018-12-14 15:59 - 2018-12-14 15:59 - 000003728 _____ C:\Windows\System32\Tasks\TR_AntiHijack
2018-12-14 15:59 - 2018-12-14 15:59 - 000001116 _____ C:\Users\Public\Desktop\Trojan Remover.lnk
2018-12-14 15:46 - 2018-12-14 15:46 - 000000000 ____D C:\Users\Admin\AppData\Local\F-Secure
2018-12-14 15:46 - 2018-12-14 15:46 - 000000000 ____D C:\Users\Admin\AppData\Local\FSDART
2018-12-14 15:42 - 2018-12-14 15:42 - 000061624 _____ (EnigmaSoft Limited) C:\Windows\system32\Drivers\EnigmaFileMonDriver.sys
2018-12-14 15:42 - 2018-12-14 15:42 - 000001017 _____ C:\Users\Public\Desktop\SpyHunter5.lnk
2018-12-14 15:42 - 2018-12-14 15:42 - 000000000 ____D C:\sh5ldr
2018-12-14 15:42 - 2018-12-14 15:42 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EnigmaSoft
2018-12-14 15:42 - 2018-12-14 15:42 - 000000000 ____D C:\ProgramData\EnigmaSoft Limited
2018-12-14 15:42 - 2018-12-14 15:42 - 000000000 ____D C:\Program Files\EnigmaSoft
2018-12-14 15:26 - 2018-12-14 15:26 - 000000000 ____D C:\Users\Admin\AppData\Local\mbamtray
2018-12-14 15:26 - 2018-12-14 15:26 - 000000000 ____D C:\Users\Admin\AppData\Local\mbam
2018-12-14 15:20 - 2018-12-14 15:29 - 000152688 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbae64.sys
2018-12-14 15:20 - 2018-12-14 15:20 - 000001874 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2018-12-14 15:20 - 2018-12-14 15:20 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2018-12-14 15:17 - 2018-12-14 15:17 - 000000000 ____D C:\ProgramData\MB3Install
2018-12-14 15:00 - 2018-12-14 15:00 - 000000000 ____D C:\Users\Admin\Music\Documents\Simply Super Software
2018-12-14 06:25 - 2018-12-14 06:25 - 000001509 _____ C:\Users\Admin\Desktop\egui.lnk
2018-12-13 23:10 - 2018-12-13 23:10 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET
2018-12-13 23:10 - 2018-12-13 23:10 - 000000000 ____D C:\ProgramData\ESET
2018-12-13 23:10 - 2018-12-13 23:10 - 000000000 ____D C:\Program Files\ESET
2018-12-13 21:54 - 2018-12-13 22:23 - 000000000 ____D C:\Users\Admin\AppData\Roaming\d2vqvd030gw
2018-12-13 21:54 - 2018-12-13 22:23 - 000000000 ____D C:\Program Files\ZF8QSRKIJ8
2018-12-13 21:53 - 2018-12-13 21:53 - 000000020 ___SH C:\Users\Admin\ntuser.ini
2018-12-13 21:47 - 2018-12-13 22:23 - 000000000 ____D C:\Users\Admin\AppData\Roaming\lyrz2bizxti
2018-12-13 21:47 - 2018-12-13 22:23 - 000000000 ____D C:\Program Files\MX3T0WAXAB
2018-12-13 21:02 - 2018-12-13 21:53 - 000000000 ____D C:\Users\Admin\AppData\Roaming\3yms3othv1t
2018-12-13 21:02 - 2018-12-13 21:51 - 000000000 ____D C:\Program Files\PYU34MBVMV
2018-12-13 21:01 - 2018-12-13 22:23 - 000000000 ____D C:\Program Files (x86)\Money
2018-12-12 23:15 - 2018-12-14 04:51 - 000000000 ____D C:\Users\Admin\Doctor Web
2018-12-12 23:15 - 2018-12-12 23:15 - 000000000 ____D C:\ProgramData\Doctor Web
2018-12-12 20:12 - 2018-12-13 21:31 - 000038376 _____ C:\Users\Admin\Desktop\12674293_1088961061138202_1319469414_n.jpg.xqklbvnmdh
2018-12-12 19:06 - 2018-12-13 21:31 - 000159784 _____ C:\Users\Admin\Desktop\10937722_886904234677220_419765580_n 1.jpg.xqklbvnmdh
2018-12-12 19:02 - 2018-12-13 21:31 - 000083427 _____ C:\Users\Admin\Desktop\10937722_886904234677220_419765580_n_1280x1024_100KB.jpg.xqklbvnmdh
2018-12-12 18:39 - 2018-12-13 21:31 - 000057246 _____ C:\Users\Admin\Desktop\10937722_886904234677220_419765580_n.jpg.xqklbvnmdh
2018-12-11 23:10 - 2018-12-14 04:50 - 000000000 ____D C:\Users\Admin\Desktop\ESET NOD32 Antivirus 12.0.27.0 (x86+x64) + Activator [CracksMind]
2018-12-11 21:23 - 2018-12-14 04:33 - 000000000 ____D C:\Users\Admin\AppData\Roaming\sd41ewqbq4q
2018-12-11 21:23 - 2018-12-11 21:45 - 000000000 ____D C:\Program Files\7CJXBLP31N
2018-12-11 20:55 - 2018-12-14 04:50 - 000000000 ____D C:\Users\Admin\AppData\Roaming\wq5sruxtz0v
2018-12-11 20:55 - 2018-12-11 21:45 - 000000000 ____D C:\Program Files\5SLKNAUWK7
2018-12-11 20:55 - 2018-12-11 20:55 - 000000000 ____D C:\Program Files (x86)\FromAshes
2018-12-04 21:34 - 2018-11-11 03:29 - 005551336 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2018-12-04 21:34 - 2018-11-11 03:28 - 000708328 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2018-12-04 21:34 - 2018-11-11 03:28 - 000262376 _____ (Microsoft Corporation) C:\Windows\system32\hal.dll
2018-12-04 21:34 - 2018-11-11 03:28 - 000154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2018-12-04 21:34 - 2018-11-11 03:27 - 001664352 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2018-12-04 21:34 - 2018-11-11 03:27 - 000631680 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2018-12-04 21:34 - 2018-11-11 03:26 - 000503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2018-12-04 21:34 - 2018-11-11 03:26 - 000361984 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2018-12-04 21:34 - 2018-11-11 03:26 - 000243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2018-12-04 21:34 - 2018-11-11 03:26 - 000215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2018-12-04 21:34 - 2018-11-11 03:26 - 000210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2018-12-04 21:34 - 2018-11-11 03:26 - 000135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2018-12-04 21:34 - 2018-11-11 03:26 - 000094208 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2018-12-04 21:34 - 2018-11-11 03:26 - 000063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2018-12-04 21:34 - 2018-11-11 03:26 - 000050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2018-12-04 21:34 - 2018-11-11 03:26 - 000028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2018-12-04 21:34 - 2018-11-11 03:26 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2018-12-04 21:34 - 2018-11-11 03:25 - 002072576 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2018-12-04 21:34 - 2018-11-11 03:25 - 001461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2018-12-04 21:34 - 2018-11-11 03:25 - 001211904 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2018-12-04 21:34 - 2018-11-11 03:25 - 001163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2018-12-04 21:34 - 2018-11-11 03:25 - 000731648 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2018-12-04 21:34 - 2018-11-11 03:25 - 000419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2018-12-04 21:34 - 2018-11-11 03:25 - 000345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2018-12-04 21:34 - 2018-11-11 03:25 - 000316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2018-12-04 21:34 - 2018-11-11 03:25 - 000312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2018-12-04 21:34 - 2018-11-11 03:25 - 000190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2018-12-04 21:34 - 2018-11-11 03:25 - 000028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2018-12-04 21:34 - 2018-11-11 03:25 - 000016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:24 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:14 - 004054248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2018-12-04 21:34 - 2018-11-11 03:14 - 003960040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2018-12-04 21:34 - 2018-11-11 03:12 - 001314112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2018-12-04 21:34 - 2018-11-11 03:11 - 001114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2018-12-04 21:34 - 2018-11-11 03:11 - 000666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2018-12-04 21:34 - 2018-11-11 03:11 - 000275968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2018-12-04 21:34 - 2018-11-11 03:11 - 000172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2018-12-04 21:34 - 2018-11-11 03:11 - 000096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2018-12-04 21:34 - 2018-11-11 03:11 - 000082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2018-12-04 21:34 - 2018-11-11 03:11 - 000070144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2018-12-04 21:34 - 2018-11-11 03:11 - 000005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2018-12-04 21:34 - 2018-11-11 03:10 - 001425920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2018-12-04 21:34 - 2018-11-11 03:10 - 000554496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2018-12-04 21:34 - 2018-11-11 03:10 - 000261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2018-12-04 21:34 - 2018-11-11 03:10 - 000254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2018-12-04 21:34 - 2018-11-11 03:10 - 000223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2018-12-04 21:34 - 2018-11-11 03:10 - 000141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2018-12-04 21:34 - 2018-11-11 03:10 - 000022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2018-12-04 21:34 - 2018-11-11 03:10 - 000017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2018-12-04 21:34 - 2018-11-11 03:09 - 000644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2018-12-04 21:34 - 2018-11-11 03:09 - 000342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2018-12-04 21:34 - 2018-11-11 03:09 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2018-12-04 21:34 - 2018-11-11 03:09 - 000005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:09 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:09 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:09 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:09 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:09 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:09 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:09 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:09 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:09 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:09 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:09 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:09 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 03:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 02:53 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2018-12-04 21:34 - 2018-11-11 02:48 - 000338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2018-12-04 21:34 - 2018-11-11 02:48 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\videoprt.sys
2018-12-04 21:34 - 2018-11-11 02:47 - 000296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2018-12-04 21:34 - 2018-11-11 02:44 - 000291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2018-12-04 21:34 - 2018-11-11 02:44 - 000161280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2018-12-04 21:34 - 2018-11-11 02:44 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2018-12-04 21:34 - 2018-11-11 02:43 - 000112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2018-12-04 21:34 - 2018-11-11 02:43 - 000064512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\amdk8.sys
2018-12-04 21:34 - 2018-11-11 02:43 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\intelppm.sys
2018-12-04 21:34 - 2018-11-11 02:43 - 000060928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\processr.sys
2018-12-04 21:34 - 2018-11-11 02:43 - 000060928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\amdppm.sys
2018-12-04 21:34 - 2018-11-11 02:43 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2018-12-04 21:34 - 2018-11-11 02:41 - 000014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2018-12-04 21:34 - 2018-11-11 02:41 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2018-12-04 21:34 - 2018-11-11 02:40 - 000036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2018-12-04 21:34 - 2018-11-11 02:40 - 000006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 02:40 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 02:40 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2018-12-04 21:34 - 2018-11-11 02:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2018-12-04 21:34 - 2018-10-27 05:05 - 003227648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2018-12-04 21:34 - 2018-10-18 21:49 - 000396888 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2018-12-04 21:34 - 2018-10-18 20:51 - 000348760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2018-12-04 21:34 - 2018-10-18 04:48 - 025737728 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2018-12-04 21:34 - 2018-10-18 04:17 - 020281344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2018-12-04 21:34 - 2018-10-12 22:36 - 002724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2018-12-04 21:34 - 2018-10-12 22:26 - 000498176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2018-12-04 21:34 - 2018-10-12 22:25 - 000341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2018-12-04 21:34 - 2018-10-12 22:25 - 000062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2018-12-04 21:34 - 2018-10-12 22:24 - 000064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2018-12-04 21:34 - 2018-10-12 22:22 - 002295808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2018-12-04 21:34 - 2018-10-12 22:20 - 000047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2018-12-04 21:34 - 2018-10-12 22:20 - 000030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2018-12-04 21:34 - 2018-10-12 22:18 - 000476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2018-12-04 21:34 - 2018-10-12 22:17 - 000662016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2018-12-04 21:34 - 2018-10-12 22:17 - 000620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2018-12-04 21:34 - 2018-10-12 22:17 - 000115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2018-12-04 21:34 - 2018-10-12 22:11 - 000416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2018-12-04 21:34 - 2018-10-12 22:07 - 000091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2018-12-04 21:34 - 2018-10-12 22:07 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2018-12-04 21:34 - 2018-10-12 22:07 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2018-12-04 21:34 - 2018-10-12 22:05 - 000168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2018-12-04 21:34 - 2018-10-12 22:04 - 000076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2018-12-04 21:34 - 2018-10-12 22:03 - 004494848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2018-12-04 21:34 - 2018-10-12 22:03 - 000279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2018-12-04 21:34 - 2018-10-12 22:02 - 000130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2018-12-04 21:34 - 2018-10-12 21:59 - 013680640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2018-12-04 21:34 - 2018-10-12 21:57 - 000230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2018-12-04 21:34 - 2018-10-12 21:56 - 000696320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2018-12-04 21:34 - 2018-10-12 21:55 - 002059776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2018-12-04 21:34 - 2018-10-12 21:55 - 001155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2018-12-04 21:34 - 2018-10-12 21:42 - 004386816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2018-12-04 21:34 - 2018-10-12 21:38 - 001330176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2018-12-04 21:34 - 2018-10-12 21:36 - 000710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2018-12-04 21:34 - 2018-10-12 04:23 - 002724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2018-12-04 21:34 - 2018-10-12 04:23 - 000004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2018-12-04 21:34 - 2018-10-12 04:12 - 002902016 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2018-12-04 21:34 - 2018-10-12 04:11 - 000066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2018-12-04 21:34 - 2018-10-12 04:10 - 000576512 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2018-12-04 21:34 - 2018-10-12 04:10 - 000417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2018-12-04 21:34 - 2018-10-12 04:10 - 000088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2018-12-04 21:34 - 2018-10-12 04:10 - 000048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2018-12-04 21:34 - 2018-10-12 04:04 - 000054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2018-12-04 21:34 - 2018-10-12 04:03 - 000034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2018-12-04 21:34 - 2018-10-12 04:01 - 000615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2018-12-04 21:34 - 2018-10-12 04:00 - 000144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2018-12-04 21:34 - 2018-10-12 04:00 - 000116224 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2018-12-04 21:34 - 2018-10-12 03:59 - 005779456 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2018-12-04 21:34 - 2018-10-12 03:59 - 000814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2018-12-04 21:34 - 2018-10-12 03:59 - 000794624 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2018-12-04 21:34 - 2018-10-12 03:54 - 000969216 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2018-12-04 21:34 - 2018-10-12 03:51 - 000489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2018-12-04 21:34 - 2018-10-12 03:46 - 000077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2018-12-04 21:34 - 2018-10-12 03:45 - 000087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2018-12-04 21:34 - 2018-10-12 03:44 - 000107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2018-12-04 21:34 - 2018-10-12 03:42 - 000199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2018-12-04 21:34 - 2018-10-12 03:42 - 000092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2018-12-04 21:34 - 2018-10-12 03:40 - 000315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2018-12-04 21:34 - 2018-10-12 03:38 - 000152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2018-12-04 21:34 - 2018-10-12 03:30 - 000262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2018-12-04 21:34 - 2018-10-12 03:27 - 000809472 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2018-12-04 21:34 - 2018-10-12 03:27 - 000728064 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2018-12-04 21:34 - 2018-10-12 03:26 - 002136064 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2018-12-04 21:34 - 2018-10-12 03:26 - 001359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2018-12-04 21:34 - 2018-10-12 03:25 - 015283712 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2018-12-04 21:34 - 2018-10-12 03:19 - 004859904 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2018-12-04 21:34 - 2018-10-12 03:06 - 001555968 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2018-12-04 21:34 - 2018-10-12 02:55 - 000800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2018-12-04 21:34 - 2018-09-23 04:55 - 002319872 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll
2018-12-04 21:34 - 2018-09-23 04:54 - 002222080 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll
2018-12-04 21:34 - 2018-09-23 04:37 - 001549312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tquery.dll
2018-12-04 21:34 - 2018-09-23 04:37 - 001400320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssrch.dll
2018-12-04 21:34 - 2018-09-19 10:08 - 000343552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrd3x40.dll
2018-12-04 21:34 - 2018-09-09 03:02 - 001680072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2018-12-04 21:34 - 2018-09-09 03:02 - 000986824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2018-12-04 21:34 - 2018-09-09 03:02 - 000265416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2018-12-04 21:34 - 2018-09-09 02:59 - 002851840 _____ (Microsoft Corporation) C:\Windows\system32\themeui.dll
2018-12-04 21:34 - 2018-09-09 02:59 - 002009600 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2018-12-04 21:34 - 2018-09-09 02:58 - 000405504 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2018-12-04 21:34 - 2018-09-09 02:57 - 000144384 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2018-12-04 21:34 - 2018-09-09 02:44 - 002755584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\themeui.dll
2018-12-04 21:34 - 2018-09-09 02:44 - 000313344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2018-12-04 21:34 - 2018-09-09 02:43 - 001391104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2018-12-04 21:34 - 2018-08-28 08:24 - 014637568 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2018-12-04 21:34 - 2018-08-28 08:24 - 012574720 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2018-12-04 21:34 - 2018-08-28 08:24 - 000005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2018-12-04 21:34 - 2018-08-28 08:24 - 000005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2018-12-04 21:34 - 2018-08-28 08:09 - 012574208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2018-12-04 21:34 - 2018-08-28 08:09 - 011411968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2018-12-04 21:34 - 2018-08-28 07:52 - 000004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2018-12-04 21:34 - 2018-08-28 07:52 - 000004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2018-12-04 21:34 - 2018-08-16 04:18 - 000041984 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2018-12-04 21:34 - 2018-08-13 23:49 - 001391856 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2018-12-04 21:34 - 2018-08-13 17:54 - 000687616 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2018-12-04 21:34 - 2018-08-12 22:27 - 000680960 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2018-12-04 21:34 - 2018-08-08 17:54 - 000170496 _____ (Microsoft Corporation) C:\Windows\system32\itss.dll
2018-12-04 21:34 - 2018-08-08 17:40 - 000142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\itss.dll
2018-12-04 21:33 - 2018-11-11 03:28 - 000095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2018-12-04 21:33 - 2018-11-11 03:25 - 000516608 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2018-12-04 21:33 - 2018-11-11 03:25 - 000146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2018-12-04 21:33 - 2018-11-11 03:25 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2018-12-04 21:33 - 2018-11-11 03:25 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\oleres.dll
2018-12-04 21:33 - 2018-11-11 03:24 - 000690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2018-12-04 21:33 - 2018-11-11 03:24 - 000022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2018-12-04 21:33 - 2018-11-11 03:24 - 000008704 _____ (Microsoft Corporation) C:\Windows\system32\comcat.dll
2018-12-04 21:33 - 2018-11-11 03:24 - 000007168 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2018-12-04 21:33 - 2018-11-11 03:11 - 000043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2018-12-04 21:33 - 2018-11-11 03:10 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2018-12-04 21:33 - 2018-11-11 03:10 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2018-12-04 21:33 - 2018-11-11 03:10 - 000026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleres.dll
2018-12-04 21:33 - 2018-11-11 03:09 - 000690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2018-12-04 21:33 - 2018-11-11 03:09 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2018-12-04 21:33 - 2018-11-11 02:53 - 000148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2018-12-04 21:33 - 2018-11-11 02:53 - 000017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2018-12-04 21:33 - 2018-11-11 02:52 - 000064512 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2018-12-04 21:33 - 2018-11-11 02:47 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comcat.dll
2018-12-04 21:33 - 2018-11-11 02:45 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2018-12-04 21:33 - 2018-11-11 02:41 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2018-12-04 21:33 - 2018-11-11 02:41 - 000007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2018-12-04 21:33 - 2018-10-27 05:42 - 000230400 _____ (Microsoft Corporation) C:\Windows\system32\scrobj.dll
2018-12-04 21:33 - 2018-10-27 05:42 - 000202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2018-12-04 21:33 - 2018-10-27 05:42 - 000150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2018-12-04 21:33 - 2018-10-27 05:42 - 000028160 _____ (Microsoft Corporation) C:\Windows\system32\wshcon.dll
2018-12-04 21:33 - 2018-10-27 05:41 - 000018944 _____ (Microsoft Corporation) C:\Windows\system32\dispex.dll
2018-12-04 21:33 - 2018-10-27 05:27 - 000173568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrobj.dll
2018-12-04 21:33 - 2018-10-27 05:27 - 000164352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2018-12-04 21:33 - 2018-10-27 05:27 - 000121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
2018-12-04 21:33 - 2018-10-27 05:11 - 000168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2018-12-04 21:33 - 2018-10-27 05:11 - 000156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2018-12-04 21:33 - 2018-10-27 05:04 - 000141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2018-12-04 21:33 - 2018-10-27 05:04 - 000126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2018-12-04 21:33 - 2018-10-27 05:04 - 000025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshcon.dll
2018-12-04 21:33 - 2018-10-27 05:04 - 000015360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dispex.dll
2018-12-04 21:33 - 2018-10-12 22:25 - 000047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2018-12-04 21:33 - 2018-10-06 18:02 - 000366824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msrpc.sys
2018-12-04 21:33 - 2018-10-06 15:42 - 001988096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2018-12-04 21:33 - 2018-10-06 15:05 - 002565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2018-12-04 21:33 - 2018-09-23 04:54 - 000778240 _____ (Microsoft Corporation) C:\Windows\system32\mssvp.dll
2018-12-04 21:33 - 2018-09-23 04:54 - 000491520 _____ (Microsoft Corporation) C:\Windows\system32\mssph.dll
2018-12-04 21:33 - 2018-09-23 04:54 - 000288256 _____ (Microsoft Corporation) C:\Windows\system32\mssphtb.dll
2018-12-04 21:33 - 2018-09-23 04:54 - 000115200 _____ (Microsoft Corporation) C:\Windows\system32\mssitlb.dll
2018-12-04 21:33 - 2018-09-23 04:54 - 000099840 _____ (Microsoft Corporation) C:\Windows\system32\mssprxy.dll
2018-12-04 21:33 - 2018-09-23 04:54 - 000075264 _____ (Microsoft Corporation) C:\Windows\system32\msscntrs.dll
2018-12-04 21:33 - 2018-09-23 04:54 - 000014336 _____ (Microsoft Corporation) C:\Windows\system32\msshooks.dll
2018-12-04 21:33 - 2018-09-23 04:37 - 000666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssvp.dll
2018-12-04 21:33 - 2018-09-23 04:37 - 000337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssph.dll
2018-12-04 21:33 - 2018-09-23 04:37 - 000197120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssphtb.dll
2018-12-04 21:33 - 2018-09-23 04:37 - 000104448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssitlb.dll
2018-12-04 21:33 - 2018-09-23 04:37 - 000059392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscntrs.dll
2018-12-04 21:33 - 2018-09-23 04:37 - 000034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssprxy.dll
2018-12-04 21:33 - 2018-09-23 04:34 - 000591872 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe
2018-12-04 21:33 - 2018-09-23 04:34 - 000249856 _____ (Microsoft Corporation) C:\Windows\system32\SearchProtocolHost.exe
2018-12-04 21:33 - 2018-09-23 04:33 - 000113664 _____ (Microsoft Corporation) C:\Windows\system32\SearchFilterHost.exe
2018-12-04 21:33 - 2018-09-23 04:22 - 000427520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchIndexer.exe
2018-12-04 21:33 - 2018-09-23 04:22 - 000164352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
2018-12-04 21:33 - 2018-09-23 04:21 - 000086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFilterHost.exe
2018-12-04 21:33 - 2018-09-23 04:21 - 000009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msshooks.dll
2018-12-04 21:33 - 2018-09-09 02:59 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2018-12-04 21:33 - 2018-09-09 02:43 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2018-12-04 21:33 - 2018-08-28 08:24 - 000009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2018-12-04 21:33 - 2018-08-28 07:52 - 000008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2018-12-04 21:33 - 2018-08-28 05:48 - 000419608 _____ C:\Windows\SysWOW64\locale.nls
2018-12-04 21:33 - 2018-08-28 05:48 - 000419608 _____ C:\Windows\system32\locale.nls
2018-12-04 21:33 - 2018-08-12 22:32 - 000140976 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2018-12-04 21:33 - 2018-08-08 17:54 - 000194048 _____ (Microsoft Corporation) C:\Windows\system32\itircl.dll
2018-12-04 21:33 - 2018-08-08 17:40 - 000158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\itircl.dll
2018-12-04 21:01 - 2018-12-04 21:01 - 000000340 _____ C:\Floppy Disk Drive (A).lnk
2018-11-29 10:54 - 2018-11-29 10:54 - 000143448 _____ (ESET) C:\Windows\system32\Drivers\eamonm.sys

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-12-14 16:36 - 2017-09-10 15:35 - 000133262 _____ C:\Windows\ZAM.krnl.trace
2018-12-14 16:36 - 2017-09-10 15:35 - 000104252 _____ C:\Windows\ZAM_Guard.krnl.trace
2018-12-14 16:01 - 2017-12-21 23:05 - 000000000 ____D C:\ProgramData\TEMP
2018-12-14 15:59 - 2016-10-20 16:08 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trojan Remover
2018-12-14 15:59 - 2016-10-20 16:08 - 000000000 ____D C:\Program Files (x86)\Trojan Remover
2018-12-14 15:49 - 2016-09-11 19:30 - 000000000 ____D C:\ProgramData\F-Secure
2018-12-14 15:32 - 2009-07-14 06:45 - 000029200 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2018-12-14 15:32 - 2009-07-14 06:45 - 000029200 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2018-12-14 15:27 - 2015-12-18 08:23 - 000000000 ____D C:\ProgramData\NVIDIA
2018-12-14 15:26 - 2017-09-15 16:56 - 000000000 ____D C:\Program Files\Opera
2018-12-14 15:19 - 2018-06-04 17:44 - 000000000 ____D C:\ProgramData\Malwarebytes
2018-12-14 15:19 - 2009-07-14 07:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2018-12-14 15:05 - 2017-02-01 16:50 - 000000000 ____D C:\Users\Admin\AppData\Local\CrashDumps
2018-12-14 04:54 - 2017-11-18 21:11 - 000000000 ____D C:\WinSys
2018-12-14 04:54 - 2017-11-18 21:06 - 000000000 ____D C:\Windat
2018-12-14 04:53 - 2016-03-04 11:18 - 000000000 ____D C:\Users\Public\WinTV
2018-12-14 04:53 - 2009-07-14 05:20 - 000000000 __RHD C:\Users\Public\Libraries
2018-12-14 04:52 - 2018-10-25 19:34 - 000000000 ____D C:\Users\Admin\ansel
2018-12-14 04:52 - 2011-04-12 10:28 - 000000000 ____D C:\Users\Default\AppData\Roaming\Media Center Programs
2018-12-14 04:52 - 2011-04-12 10:28 - 000000000 ____D C:\Users\Default User\AppData\Roaming\Media Center Programs
2018-12-14 04:51 - 2018-09-11 17:07 - 000000000 ____D C:\Users\Admin\Music\Documents\Custom Office Templates
2018-12-14 04:51 - 2018-07-28 19:33 - 000000000 ____D C:\Users\Admin\Desktop\Фризер
2018-12-14 04:51 - 2018-07-26 20:05 - 000000000 ____D C:\Users\Admin\Desktop\Банциг
2018-12-14 04:51 - 2018-07-08 16:37 - 000000000 ____D C:\Users\Admin\Desktop\Рендов
2018-12-14 04:51 - 2018-04-04 21:07 - 000000000 ____D C:\Users\Admin\Desktop\плочи
2018-12-14 04:51 - 2018-02-22 17:44 - 000000000 ____D C:\Users\Admin\Desktop\leon
2018-12-14 04:51 - 2018-01-07 18:18 - 000000000 ____D C:\Users\Admin\Music\Documents\Шаблони на Office по избор
2018-12-14 04:51 - 2017-02-01 17:01 - 000000000 ____D C:\Users\Admin\Music\Documents\Downloaded Installations
2018-12-14 04:51 - 2015-12-18 00:04 - 000000000 ____D C:\Users\Admin
2018-12-14 04:50 - 2018-10-05 19:00 - 000000000 ____D C:\Users\Admin\Desktop\HANKOOK
2018-12-14 04:50 - 2018-06-07 21:41 - 000000000 ____D C:\Users\Admin\Desktop\Donka
2018-12-14 04:50 - 2018-04-04 21:30 - 000000000 ____D C:\Users\Admin\Desktop\New folder (2)
2018-12-14 04:50 - 2018-02-04 15:16 - 000000000 ____D C:\Users\Admin\Desktop\New folder
2018-12-14 04:50 - 2017-07-21 17:34 - 000000000 ____D C:\Users\Admin\Desktop\New folder (4)
2018-12-14 04:50 - 2017-05-30 22:12 - 000000000 ____D C:\Users\Admin\Desktop\207
2018-12-14 04:50 - 2015-12-18 18:39 - 000000000 ___RD C:\Users\Admin\Desktop\Other
2018-12-14 04:50 - 2015-12-18 18:39 - 000000000 ___RD C:\Users\Admin\Desktop\Dict
2018-12-14 04:35 - 2015-12-18 20:31 - 000000000 ____D C:\Users\Admin\AppData\Roaming\vlc
2018-12-14 04:33 - 2016-05-07 20:22 - 000000000 ____D C:\Users\Admin\AppData\Roaming\uTorrent
2018-12-14 03:51 - 2016-11-11 16:30 - 000000000 ____D C:\Users\Admin\AppData\Roaming\live-usb-install
2018-12-14 03:50 - 2016-03-05 16:20 - 000000000 ____D C:\Users\Admin\AppData\Roaming\dvdcss
2018-12-14 03:49 - 2015-12-18 19:29 - 000000000 ____D C:\Users\Admin\AppData\Roaming\Winamp
2018-12-14 03:49 - 2015-12-18 18:33 - 000000000 ____D C:\Users\Admin\AppData\Roaming\Yamicsoft
2018-12-14 03:48 - 2018-06-29 21:54 - 000000000 ____D C:\Users\Admin\AppData\Roaming\WinRAR
2018-12-14 03:47 - 2015-12-18 18:23 - 000000000 ____D C:\Users\Admin\AppData\Roaming\Opera Software
2018-12-14 03:29 - 2016-12-20 22:39 - 000000000 ____D C:\Users\Admin\AppData\Roaming\Obsidium
2018-12-14 03:29 - 2016-01-25 21:15 - 000000000 ____D C:\Users\Admin\AppData\Roaming\Mozilla
2018-12-14 03:20 - 2016-08-07 21:12 - 000000000 ____D C:\Users\Admin\AppData\Roaming\Lenovo
2018-12-14 03:20 - 2015-12-18 00:04 - 000000000 ____D C:\Users\Admin\AppData\Roaming\Media Center Programs
2018-12-14 03:19 - 2016-10-19 17:08 - 000000000 ____D C:\Users\Admin\AppData\Roaming\IObit
2018-12-14 03:17 - 2018-05-21 19:19 - 000000000 ____D C:\Users\Admin\AppData\Roaming\Bitradio
2018-12-14 03:17 - 2016-09-18 16:15 - 000000000 ____D C:\Users\Admin\AppData\Roaming\ApexDC++
2018-12-14 03:17 - 2016-02-18 17:38 - 000000000 ____D C:\Users\Admin\AppData\Roaming\BITS
2018-12-14 03:17 - 2015-12-18 00:04 - 000000000 ____D C:\Users\Admin\AppData\Roaming\Adobe
2018-12-14 03:15 - 2017-09-03 15:11 - 000000000 ____D C:\Users\Admin\AppData\Roaming\ADBDriverInstaller
2018-12-14 03:15 - 2015-12-18 22:53 - 000000000 ____D C:\Users\Admin\AppData\Roaming\ACD Systems
2018-12-14 03:12 - 2018-09-11 16:27 - 000000000 ____D C:\Program Files\Microsoft SQL Server
2018-12-14 03:12 - 2017-12-21 22:25 - 000000000 __RHD C:\MSOCache
2018-12-14 03:12 - 2017-11-18 21:10 - 000000000 ____D C:\Applications
2018-12-14 03:12 - 2017-11-18 21:06 - 000000000 ____D C:\Disk
2018-12-14 03:12 - 2016-08-07 21:09 - 000000000 ____D C:\MagicPlusMini
2018-12-14 03:12 - 2016-01-28 21:01 - 000000000 ____D C:\Intel
2018-12-14 03:12 - 2009-07-14 05:20 - 000000000 ____D C:\PerfLogs
2018-12-13 23:11 - 2009-07-14 05:20 - 000000000 ____D C:\Windows\inf
2018-12-13 22:28 - 2015-12-18 18:39 - 000000000 ___RD C:\Users\Admin\Desktop\Spy
2018-12-13 21:51 - 2018-10-06 15:38 - 000012872 _____ (SurfRight B.V.) C:\Windows\system32\bootdelete.exe
2018-12-13 21:51 - 2018-09-11 16:16 - 000000000 ____D C:\Users\Admin\Downloads\Torents
2018-12-13 21:51 - 2016-01-29 18:45 - 000005670 _____ C:\Windows\system32\.crusader
2018-12-13 21:40 - 2018-10-31 20:45 - 000008134 _____ C:\zoek-results.log.xqklbvnmdh
2018-12-13 21:40 - 2018-10-31 20:42 - 000000000 ____D C:\zoek_backup
2018-12-13 21:37 - 2011-04-12 10:28 - 000000000 ___RD C:\Users\Public\Recorded TV
2018-12-13 21:34 - 2018-10-03 21:25 - 000001292 _____ C:\Users\Admin\Music\Documents\32.txt.xqklbvnmdh
2018-12-13 21:34 - 2017-12-02 17:34 - 000043863 _____ C:\Users\Admin\Music\Documents\Понятието контрол произлиза от френската дума.docx.xqklbvnmdh
2018-12-13 21:34 - 2015-12-18 00:04 - 000000560 ___SH C:\Users\Admin\ntuser.ini.xqklbvnmdh
2018-12-13 21:33 - 2018-11-11 17:39 - 001217540 _____ C:\Users\Admin\Desktop\Notarialen akt.pdf.xqklbvnmdh
2018-12-13 21:33 - 2018-11-11 17:39 - 000052252 _____ C:\Users\Admin\Desktop\Predvaritelen dogovor Montana.doc.xqklbvnmdh
2018-12-13 21:33 - 2018-10-21 18:39 - 000856709 _____ C:\Users\Admin\Desktop\Индикатори на технически анализ.pptx.xqklbvnmdh
2018-12-13 21:33 - 2018-10-21 18:08 - 000012900 _____ C:\Users\Admin\Desktop\Въведение в техническите индикатори Какво представляват техническите индикатори.docx.xqklbvnmdh
2018-12-13 21:33 - 2018-10-21 16:09 - 000019132 _____ C:\Users\Admin\Desktop\pd31.png.xqklbvnmdh
2018-12-13 21:33 - 2018-10-21 16:08 - 000008128 _____ C:\Users\Admin\Desktop\pd30.png.xqklbvnmdh
2018-12-13 21:33 - 2018-10-21 16:04 - 000006821 _____ C:\Users\Admin\Desktop\pd38.png.xqklbvnmdh
2018-12-13 21:33 - 2018-07-02 19:40 - 000045596 _____ C:\Users\Admin\Desktop\Пълномощно Грета.doc.xqklbvnmdh
2018-12-13 21:33 - 2018-03-20 15:36 - 000012451 _____ C:\Users\Admin\Desktop\Г А Р А Ж.docx.xqklbvnmdh
2018-12-13 21:33 - 2018-03-14 20:46 - 000014221 _____ C:\Users\Admin\Desktop\ОБЯСНЕНИЕ.docx.xqklbvnmdh
2018-12-13 21:33 - 2018-02-22 21:57 - 000436252 _____ C:\Users\Admin\Desktop\Джанти PCD.doc.xqklbvnmdh
2018-12-13 21:33 - 2018-02-04 15:05 - 006512119 _____ C:\Users\Admin\Desktop\SANJA ILIC & BALKANIKA FEAT. CVIJA - DJIPAJ (OFFICIAL VIDEO).mp3.xqklbvnmdh
2018-12-13 21:33 - 2017-11-19 11:58 - 000154039 _____ C:\Users\Admin\Desktop\pojelaniq-za-rojden-den-za-jena.jpg.xqklbvnmdh
2018-12-13 21:33 - 2017-11-19 11:54 - 000158552 _____ C:\Users\Admin\Desktop\pojelanie-za-rojden-den-1.jpg.xqklbvnmdh
2018-12-13 21:33 - 2017-01-28 16:22 - 000338460 _____ C:\Users\Admin\Desktop\Копие на rpv2017v02ВЕДОМОСТ.xls.xqklbvnmdh
2018-12-13 21:33 - 2017-01-28 15:43 - 000651804 _____ C:\Users\Admin\Desktop\rpv2017v02.xls.xqklbvnmdh
2018-12-13 21:32 - 2018-11-07 17:32 - 000068189 _____ C:\Users\Admin\Desktop\m.mat.jpg.xqklbvnmdh
2018-12-13 21:32 - 2018-09-11 17:08 - 000012657 _____ C:\Users\Admin\Desktop\Ich will  Deutschland.docx.xqklbvnmdh
2018-12-13 21:32 - 2018-03-24 14:47 - 001829862 _____ C:\Users\Admin\Desktop\IMG_20180324_105902.jpg.xqklbvnmdh
2018-12-13 21:32 - 2017-10-22 17:37 - 000519634 _____ C:\Users\Admin\Desktop\kufar-bez-ime.jpg.xqklbvnmdh
2018-12-13 21:32 - 2017-10-01 18:13 - 003534114 _____ C:\Users\Admin\Desktop\Helena Paparizou - Haide (official Music Video).mp3.xqklbvnmdh
2018-12-13 21:32 - 2017-06-18 21:17 - 000352551 _____ C:\Users\Admin\Desktop\M1586BH.jpg.xqklbvnmdh
2018-12-13 21:32 - 2016-08-13 22:51 - 000053202 _____ C:\Users\Admin\Desktop\maxresdefault.jpg.xqklbvnmdh
2018-12-13 21:31 - 2018-11-11 16:24 - 000038428 _____ C:\Users\Admin\Desktop\doc19.doc.xqklbvnmdh
2018-12-13 21:31 - 2018-10-26 20:24 - 000025901 _____ C:\Users\Admin\Desktop\44664316_686390588428048_2179055213858521088_n.jpg.xqklbvnmdh
2018-12-13 21:31 - 2018-10-21 16:04 - 000036233 _____ C:\Users\Admin\Desktop\f91.png.xqklbvnmdh
2018-12-13 21:31 - 2018-09-19 19:58 - 000000000 ____D C:\Users\Admin\AppData\Roaming\VS Revo Group
2018-12-13 21:31 - 2018-08-14 15:54 - 000088471 _____ C:\Users\Admin\Desktop\38255347_2217816721566618_1918983055616245760_n.jpg.xqklbvnmdh
2018-12-13 21:31 - 2018-08-05 19:39 - 000034332 _____ C:\Users\Admin\Desktop\Deklaratsiya_po_chlen25.doc.xqklbvnmdh
2018-12-13 21:31 - 2018-08-05 19:39 - 000033820 _____ C:\Users\Admin\Desktop\Deklaratsiya_po_chlen264.doc.xqklbvnmdh
2018-12-13 21:31 - 2018-06-10 21:01 - 000091329 _____ C:\Users\Admin\Desktop\Gumi i djanti.png.xqklbvnmdh
2018-12-13 21:31 - 2018-03-27 20:28 - 000087120 _____ C:\Users\Admin\Desktop\Diksi.jpg.xqklbvnmdh
2018-12-13 21:31 - 2017-11-19 13:20 - 000099262 _____ C:\Users\Admin\Desktop\23622173_1911556045528147_2179962228224096992_n.jpg.xqklbvnmdh
2018-12-13 21:31 - 2017-11-11 20:50 - 000103324 _____ C:\Users\Admin\Desktop\Carscoop_Peugeot207SW_3632.jpg.xqklbvnmdh
2018-12-13 21:31 - 2017-11-11 18:25 - 000077633 _____ C:\Users\Admin\Desktop\$_86.JPG.xqklbvnmdh
2018-12-13 21:31 - 2017-10-15 20:44 - 000045487 _____ C:\Users\Admin\Desktop\22141177_1505081259584136_4287684947535575427_n.jpg.xqklbvnmdh
2018-12-13 21:31 - 2017-09-22 21:33 - 000080975 _____ C:\Users\Admin\Desktop\anonymous.jpg.xqklbvnmdh
2018-12-13 21:31 - 2017-01-27 18:21 - 000146451 _____ C:\Users\Admin\Desktop\ALIM5601-1-1-2.jpg.xqklbvnmdh
2018-12-13 21:31 - 2016-12-18 16:24 - 000060303 _____ C:\Users\Admin\Desktop\e2ce4037c74c.jpg.xqklbvnmdh
2018-12-13 21:31 - 2016-10-22 20:00 - 000041059 _____ C:\Users\Admin\Desktop\6-Mosaic-Push-Unique-Savoir-Faire_fixed_231x426.jpg.xqklbvnmdh
2018-12-13 21:31 - 2016-07-19 15:51 - 000000000 ____D C:\Users\Admin\AppData\Roaming\ZJMedia
2018-12-13 21:31 - 2016-05-16 15:13 - 000472715 _____ C:\Users\Admin\Desktop\332896_227208733995454_1747015_o(4).jpg.xqklbvnmdh
2018-12-13 21:31 - 2016-02-28 15:05 - 000962805 _____ C:\Users\Admin\Desktop\526390.jpg.xqklbvnmdh
2018-12-13 21:31 - 2016-02-28 14:44 - 000189265 _____ C:\Users\Admin\Desktop\1D35E740A.jpg.xqklbvnmdh
2018-12-13 21:22 - 2018-10-06 14:58 - 000000000 ____D C:\Users\Admin\AppData\Roaming\Python
2018-12-13 21:22 - 2016-11-23 17:00 - 000000000 ____D C:\Users\Admin\AppData\Roaming\PotPlayerMini64
2018-12-13 21:22 - 2016-11-18 20:35 - 000000000 ____D C:\Users\Admin\AppData\Roaming\PowerISO
2018-12-13 21:22 - 2016-10-20 16:08 - 000000000 ____D C:\Users\Admin\AppData\Roaming\Simply Super Software
2018-12-13 21:09 - 2018-10-06 14:57 - 000002350 _____ C:\Users\Admin\AppData\Roaming\M04DO93.exe.config.xqklbvnmdh
2018-12-13 21:09 - 2016-07-19 19:47 - 000000000 ____D C:\Users\Admin\AppData\Roaming\mgyun
2018-12-13 21:09 - 2016-02-24 22:52 - 000000000 ____D C:\Users\Admin\AppData\Roaming\Macromedia
2018-12-13 21:05 - 2017-04-17 15:14 - 000000000 ____D C:\Users\Admin\AppData\Roaming\JetBrains
2018-12-13 21:04 - 2018-10-06 14:57 - 000002350 _____ C:\Users\Admin\AppData\Roaming\F24BCMR.exe.config.xqklbvnmdh
2018-12-13 21:04 - 2017-07-21 21:20 - 000000000 ____D C:\Users\Admin\AppData\Roaming\Canneverbe Limited
2018-12-13 21:04 - 2017-07-21 12:38 - 000000000 ____D C:\Users\Admin\AppData\Roaming\Burnaware
2018-12-13 21:04 - 2016-11-11 16:32 - 000000000 ____D C:\Users\Admin\AppData\Roaming\gtk-2.0
2018-12-13 21:04 - 2016-02-23 17:52 - 000000000 ____D C:\Users\Admin\AppData\Roaming\HMYGSetting
2018-12-13 21:04 - 2016-02-02 22:28 - 000000000 ____D C:\Users\Admin\AppData\Roaming\DAEMON Tools Lite
2018-12-13 21:04 - 2016-01-28 20:23 - 000000000 ____D C:\Users\Admin\AppData\Roaming\InstallShield
2018-12-13 21:04 - 2015-12-18 15:54 - 000000000 ____D C:\Users\Admin\AppData\Roaming\ImgBurn
2018-12-13 21:03 - 2018-10-06 15:00 - 000002350 _____ C:\Users\Admin\AppData\Roaming\3BLN054.exe.config.xqklbvnmdh
2018-12-13 21:03 - 2018-10-06 14:59 - 000002350 _____ C:\Users\Admin\AppData\Roaming\2NLL47U.exe.config.xqklbvnmdh
2018-12-13 21:03 - 2018-10-06 14:57 - 000002350 _____ C:\Users\Admin\AppData\Roaming\8G5GQAM.exe.config.xqklbvnmdh
2018-12-13 21:03 - 2018-10-06 14:57 - 000002350 _____ C:\Users\Admin\AppData\Roaming\1DZZ338.exe.config.xqklbvnmdh
2018-12-13 21:03 - 2017-12-18 22:06 - 000000000 ____D C:\Users\Admin\AppData\Roaming\ABBYY
2018-12-13 21:03 - 2016-11-11 19:17 - 000000758 _____ C:\Users\Admin\.recently-used.xbel.xqklbvnmdh
2018-12-13 21:03 - 2015-12-18 19:00 - 000000000 ____D C:\TEMP
2018-12-13 21:02 - 2018-09-11 16:27 - 000000000 ____D C:\Program Files (x86)\Microsoft SQL Server
2018-12-12 22:35 - 2015-12-18 15:25 - 000001945 _____ C:\Windows\epplauncher.mif
2018-12-12 20:38 - 2009-07-14 07:13 - 000781790 _____ C:\Windows\system32\PerfStringBackup.INI
2018-12-12 18:44 - 2016-09-25 15:44 - 000002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2018-12-11 22:37 - 2016-09-09 17:26 - 000000000 ____D C:\ProgramData\Kaspersky Lab Setup Files
2018-12-11 21:31 - 2015-12-18 18:30 - 000000000 ____D C:\Program Files (x86)\Google
2018-12-11 00:04 - 2010-11-21 05:27 - 000592616 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2018-12-05 19:30 - 2009-07-14 05:20 - 000000000 ____D C:\Windows\rescache
2018-12-04 22:27 - 2009-07-14 06:57 - 000001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2018-12-04 22:25 - 2017-12-23 09:53 - 000309712 _____ C:\Windows\system32\FNTCACHE.DAT
2018-12-04 21:41 - 2015-12-18 08:37 - 000765656 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2018-12-04 20:56 - 2018-09-16 20:42 - 000170280 _____ (ESET) C:\Windows\system32\Drivers\ESETCleanersDriver.sys
2018-11-28 20:18 - 2017-09-15 16:57 - 000003834 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1505487414

==================== Files in the root of some directories =======

2016-01-17 21:52 - 2016-01-17 20:54 - 001724752 _____ (BitTorrent Inc.) C:\Program Files\uTorrent Stable(3.4.2 build 38397).exe
2018-10-06 14:57 - 2018-12-13 21:03 - 000002350 _____ () C:\Users\Admin\AppData\Roaming\1DZZ338.exe.config.xqklbvnmdh
2018-10-06 14:59 - 2018-12-13 21:03 - 000002350 _____ () C:\Users\Admin\AppData\Roaming\2NLL47U.exe.config.xqklbvnmdh
2018-10-06 15:00 - 2018-12-13 21:03 - 000002350 _____ () C:\Users\Admin\AppData\Roaming\3BLN054.exe.config.xqklbvnmdh
2018-10-06 14:57 - 2018-12-13 21:03 - 000002350 _____ () C:\Users\Admin\AppData\Roaming\8G5GQAM.exe.config.xqklbvnmdh
2018-10-06 14:57 - 2018-12-13 21:04 - 000002350 _____ () C:\Users\Admin\AppData\Roaming\F24BCMR.exe.config.xqklbvnmdh
2018-10-06 14:57 - 2018-12-13 21:09 - 000002350 _____ () C:\Users\Admin\AppData\Roaming\M04DO93.exe.config.xqklbvnmdh
2017-07-23 13:29 - 2018-02-23 20:43 - 000007168 _____ () C:\Users\Admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2017-11-18 21:11 - 2017-11-18 21:11 - 000140800 _____ () C:\Users\Admin\AppData\Local\installer.dat
2016-05-13 15:16 - 2016-05-13 15:45 - 000007599 _____ () C:\Users\Admin\AppData\Local\resmon.resmoncfg

Some files in TEMP:
====================
2018-12-11 21:03 - 2018-12-11 21:03 - 000014117 _____ () C:\Users\Admin\AppData\Local\Temp\Bottle.exe
2018-12-14 16:22 - 2015-02-12 23:16 - 000020480 _____ (E Dev) C:\Users\Admin\AppData\Local\Temp\DaS_21.exe
2018-12-14 15:08 - 2018-10-01 11:49 - 000858912 _____ (Malwarebytes) C:\Users\Admin\AppData\Local\Temp\mb-clean.exe
2018-12-14 15:08 - 2018-12-13 22:14 - 080774688 _____ (Malwarebytes                                                ) C:\Users\Admin\AppData\Local\Temp\mb3-setup-consumer-3.6.1.2711-1.0.463-1.0.7123.exe
2018-11-02 21:40 - 2018-10-11 09:12 - 005745648 _____ (NVIDIA Corporation) C:\Users\Admin\AppData\Local\Temp\NVI2_29.DLL
2018-11-02 21:39 - 2018-10-11 00:38 - 000396088 _____ (NVIDIA Corporation) C:\Users\Admin\AppData\Local\Temp\nvStInst.exe
2018-12-12 06:22 - 2018-12-12 06:22 - 016134000 _____ () C:\Users\Admin\AppData\Local\Temp\setup.dll
2018-12-14 16:22 - 2018-04-15 22:57 - 000533851 _____ () C:\Users\Admin\AppData\Local\Temp\sr.exe
2018-12-11 21:04 - 2018-12-11 20:54 - 000099901 _____ () C:\Users\Admin\AppData\Local\Temp\Uninstall.exe
2018-12-14 16:22 - 2018-04-06 19:25 - 000167936 _____ () C:\Users\Admin\AppData\Local\Temp\unzip.exe
2018-12-14 16:22 - 2009-11-10 20:09 - 000157184 _____ () C:\Users\Admin\AppData\Local\Temp\virustotal.exe
2018-12-14 16:22 - 2018-05-03 08:54 - 000818113 _____ () C:\Users\Admin\AppData\Local\Temp\z2.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


testsigning: ==> 'testsigning' is set. Check for possible unsigned driver <==== ATTENTION

LastRegBack: 2017-09-15 18:51

==================== End of FRST.txt ============================

Addition.txt

преди 6 минути, plamen_petrov_80 написа:

Значи след глобалното и пълно почистване на системата ползваш резервните копия на файловете.

Хубаво е да установиш как го вкара този крипто вирус и как да се пазиш от такива в бъдеще.

Благодаря!

преди 16 минути, plamen_petrov_80 написа:

Значи след глобалното и пълно почистване на системата ползваш резервните копия на файловете.

Хубаво е да установиш как го вкара този крипто вирус и как да се пазиш от такива в бъдеще.

По точно имам бекъп само на Уиндоуса с Acronis.Да считам ли всичко друго за безвъзвратно изгубено?

Виждам, че сте ползвали доста специализирани инструмент предполагам без да знаете кой за какво се използва (защото сте стартитали и такива, които нямат отношение към проблема ви като zoek).

Обикновено тези вируси се самоизтриват след като свършат с криптирането на документите. Можем да изчистим остатъците, но ако ще се връща бекъп няма много смисъл. Затова пишете дали да пиша инструкции за почистването.

Колкото до възстановяването на данните, първо трябва да се разбере с кой точни криптиращ бацил сте били "ударен". После ще видим дали има декриптор, но шанса наистина е малък.

Пратете един файл - например този - C:\Users\Admin\Desktop\12674293_1088961061138202_1319469414_n.jpg.xqklbvnmdh (или няколко) от криптираните на следния адрес:

https://id-ransomware.malwarehunterteam.com/

След това пишете какво е върнал сайта.

Поздрави!

  • Автор
преди 1 час, B-boy/StyLe/ написа:

Виждам, че сте ползвали доста специализирани инструмент предполагам без да знаете кой за какво се използва (защото сте стартитали и такива, които нямат отношение към проблема ви като zoek).

Обикновено тези вируси се самоизтриват след като свършат с криптирането на документите. Можем да изчистим остатъците, но ако ще се връща бекъп няма много смисъл. Затова пишете дали да пиша инструкции за почистването.

Колкото до възстановяването на данните, първо трябва да се разбере с кой точни криптиращ бацил сте били "ударен". После ще видим дали има декриптор, но шанса наистина е малък.

Пратете един файл - например този - C:\Users\Admin\Desktop\12674293_1088961061138202_1319469414_n.jpg.xqklbvnmdh (или няколко) от криптираните на следния адрес:

https://id-ransomware.malwarehunterteam.com/

След това пишете какво е върнал сайта.

Поздрави!

Сайта върна това - 

1 Result

GandCrab v4.0 / v5.0

 This ransomware may be decryptable under certain circumstances.

Please refer to the appropriate guide for more information.

Identified by

  • sample_bytes: [0x95E0 - 0x95E8] 0x1829899381820300

 

Click here for more information about GandCrab v4.0 / v5.0

Бекъп имам само на уиндоуса, а не на цялото РС.А повечето файлове,които са криптирани са на дялове D и Е.Все пак имам няколко папки със снимки и фактури от ЧЕЗ, които не са засегнати, но 99% са пострадали.Ако може пратете инструкции...Благодаря!

Ами то инструкциите ще са главно за почистването. А щом имате бекъп на Windows-a значи не ви вършат много работа ако ще връщате Image-a.

За декриптиране обикновено няма много какво да се направи (ако е нова версия на гадината).

Все пак вижте дали този декриптор ще помогне. Ако не помогне, значи засега друг декриптор няма (а има нови версии на GandCrab 5.05 и нагоре) и за тях шанс за спасение на файловете на този етап няма много.

https://www.bleepingcomputer.com/news/security/free-decrypter-available-for-the-latest-gandcrab-ransomware-versions/

  • Автор
преди 7 минути, B-boy/StyLe/ написа:

Ами то инструкциите ще са главно за почистването. А щом имате бекъп на Windows-a значи не ви вършат много работа ако ще връщате Image-a.

За декриптиране обикновено няма много какво да се направи (ако е нова версия на гадината).

Все пак вижте дали този декриптор ще помогне. Ако не помогне, значи засега друг декриптор няма (а има нови версии на GandCrab 5.05 и нагоре) и за тях шанс за спасение на файловете на този етап няма много.

https://www.bleepingcomputer.com/news/security/free-decrypter-available-for-the-latest-gandcrab-ransomware-versions/

Благодаря!След това ще пиша какъв е резултата.

Подозирам, че ще е неуспешен за съжаление

В  коментарите обаче под статията има мнение от потребител, който уж можел да помогне на потребители заразени с версия 5.04 да възстановят файловете си.

Дали да му се доверите обаче си решавате вие.

  • Автор
преди 18 минути, B-boy/StyLe/ написа:

Подозирам, че ще е неуспешен за съжаление

В  коментарите обаче под статията има мнение от потребител, който уж можел да помогне на потребители заразени с версия 5.04 да възстановят файловете си.

Дали да му се доверите обаче си решавате вие.

 

преди 18 минути, B-boy/StyLe/ написа:

Подозирам, че ще е неуспешен за съжаление

В  коментарите обаче под статията има мнение от потребител, който уж можел да помогне на потребители заразени с версия 5.04 да възстановят файловете си.

Дали да му се доверите обаче си решавате вие.

Дори да му повярвам трудно ще осъществя връзка с него тъй като не владея английски...:(

  • Автор
преди 10 минути, B-boy/StyLe/ написа:

Т.Е. декриптора не успя? Така ли да разбирам?

Още нямам крайния резултат...Ще пиша...

Вече го имам...:(((

Untitled.png

Свързах се с въпросния потребител. Отговори ми чак днес, но се оказа, че прекалено хубаво не е на хубаво. Каза, че може да помогне, но не безплатно. Това е разбираемо, защото сме малко баламите, които го правим доброволно, но все пак попитах каква е цената. Ако е поносима и желаете да си платите за услугите му (макар, че едва ли има гаранция за успех и екипа ни като цяло не насърчава плащане, освен ако данните не са жизнено важни) ще видим какво ще излезе. Би трябвало да е по-евтина от цената искана от самите автори на гадината (то иначе няма смисъл от посредници като него), но може и да не е много евтина. Като отговори ще пиша и вие ще си прецените дали да рискувате да му плащате и дали изобщо ще е по възможностите ви. С други думи шанса да си върнете файловете клони малко или много към нула, защото няма работещ декриптор в момента, а алтернативата да се плаща е в повечето случаи абсурдна.

Поздрави!

  • 2 месеца по-късно...

Само да спомена, че от днес има обновена версия на Bitdefender инструмента за декриптиране:

https://labs.bitdefender.com/2019/02/new-gandcrab-v5-1-decryptor-available-now/

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.

Назад

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.
Абонирайте се

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра
Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.