Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

Prosím o kontrolu - Zasekaný PC

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Zamčeno
Zpráva
Autor
PureHate44
Návštěvník
Návštěvník
Příspěvky: 154
Registrován: 28 čer 2011 17:49

Prosím o kontrolu - Zasekaný PC

#1 Příspěvek od PureHate44 »

PC mi neustále seká :-(

Logfile of random's system information tool 1.10 (written by random/random)
Run by Peter at 2017-10-08 14:35:36
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 26 GB (13%) free of 200 GB
Total RAM: 4095 MB (58% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:35:41, on 8. 10. 2017
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18792)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
C:\Users\Peter\AppData\Roaming\Spotify\SpotifyWebHelper.exe
C:\Users\Peter\AppData\Roaming\uTorrent\uTorrent.exe
C:\Program Files (x86)\Internet Download Manager\IDMan.exe
C:\Users\Peter\AppData\Local\Facebook\Games\FacebookGameroom.exe
C:\Users\Peter\AppData\Roaming\uTorrent\VirusGuard\BitTorrentAntivirus.exe
C:\Users\Peter\AppData\Local\Facebook\Games\Facebook Gameroom Browser.exe
C:\Users\Peter\AppData\Local\Facebook\Games\Facebook Gameroom Browser.exe
C:\Users\Peter\AppData\Local\Facebook\Games\Facebook Gameroom Browser.exe
C:\Users\Public\Facebook Games\171892509642087\38\vgw.exe
C:\Program Files\trend micro\Peter.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O1 - Hosts: ::1 localhost
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll
O4 - HKCU\..\Run: [IDMan] C:\Program Files (x86)\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [uTorrent] "C:\Users\Peter\AppData\Roaming\uTorrent\uTorrent.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 (User 'Default user')
O4 - Startup: Facebook Gameroom.lnk = Peter\AppData\Local\Facebook\Games\FacebookGameroom.exe
O4 - Startup: GoogleUpdate.lnk = C:\Users\Peter\AppData\Local\Temp\Google Updates\seachEn.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\Program Files\Microsoft Office\Root\Office16\ONBttnIE.dll/105
O8 - Extra context menu item: Stiahnuť s IDM - C:\Program Files (x86)\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Stiahnuť s IDM všetky prepojenia - C:\Program Files (x86)\Internet Download Manager\IEGetAll.htm
O9 - Extra button: Fiddler - {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - "C:\Program Files (x86)\Fiddler2\Fiddler.exe" (file missing)
O9 - Extra 'Tools' menuitem: Fiddler - {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - "C:\Program Files (x86)\Fiddler2\Fiddler.exe" (file missing)
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: http://help.eset.com (HKLM)
O15 - ESC Trusted Zone: http://help.eset.com (HKLM)
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: BWMeter Connections Service (BWMeterConSvc) - Unknown owner - C:\Program Files (x86)\BWMeter\BWMeterConSvc.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
O23 - Service: Disc Soft Ultra Bus Service - Disc Soft Ltd - C:\Users\Peter\DAEMON Tools Ultra\DiscSoftBusServiceUltra.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: OkayFreedom VPN Starter Service - Steganos Software GmbH - C:\Program Files (x86)\OkayFreedom\OkayFreedomService.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2015.SP1a\RpcAgentSrv.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: TeamViewer 12 (TeamViewer) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 9098 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
"C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe"
"C:\Windows\system32\nvvsvc.exe"
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
"C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe"
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files (x86)\BWMeter\BWMeterConSvc.exe"
C:\Windows\System32\svchost.exe -k utcsvc
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
"C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
"C:\Users\Peter\AppData\Roaming\Spotify\SpotifyWebHelper.exe"
"C:\Users\Peter\AppData\Roaming\uTorrent\uTorrent.exe"
"C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /onboot
"C:\Users\Peter\AppData\Local\Facebook\Games\FacebookGameroom.exe" fbgames://windows_startup/
"C:\Program Files (x86)\OkayFreedom\OkayFreedomService.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Users\Peter\DAEMON Tools Ultra\DiscSoftBusServiceUltra.exe"
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"taskhost.exe"
"C:/Program Files/NVIDIA Corporation/Display/nvtray.exe" -user_has_logged_in 1"
"C:\Users\Peter\AppData\Roaming\uTorrent\VirusGuard\BitTorrentAntivirus.exe"
"Facebook Gameroom Browser.exe" --type=gpu-process --no-sandbox --lang=en-US --log-file="C:\Users\Peter\AppData\Local\Facebook\Games\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 CanvasFrame/1.8.6429.23271 Safari/537.36 FacebookCanvasDesktop FBAN/GamesWindowsDesktopApp FBAV/1.8.6429.23271" --disable-direct-composition --supports-dual-gpus=false --gpu-driver-bug-workarounds=7,10,18,19,20,23,41,42,74,80 --disable-gl-extensions="GL_KHR_blend_equation_advanced GL_KHR_blend_equation_advanced_coherent" --gpu-vendor-id=0x10de --gpu-device-id=0x0a65 --gpu-driver-vendor=NVIDIA --gpu-driver-version=21.21.13.4201 --gpu-driver-date=11-14-2016 --lang=en-US --log-file="C:\Users\Peter\AppData\Local\Facebook\Games\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 CanvasFrame/1.8.6429.23271 Safari/537.36 FacebookCanvasDesktop FBAN/GamesWindowsDesktopApp FBAV/1.8.6429.23271" --service-request-channel-token=69FFB4349F038F1AD6904CB60326EA3A --mojo-platform-channel-handle=3212 /prefetch:2

"Facebook Gameroom Browser.exe" --type=renderer --force-device-scale-factor=1 --no-sandbox --primordial-pipe-token=F24A1EFB15C6E142B98A3C4251F23431 --lang=en-US --lang=en-US --log-file="C:\Users\Peter\AppData\Local\Facebook\Games\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 CanvasFrame/1.8.6429.23271 Safari/537.36 FacebookCanvasDesktop FBAN/GamesWindowsDesktopApp FBAV/1.8.6429.23271" --enable-system-flash=1 --ppapi-flash-path="C:\Users\Peter\AppData\Local\Facebook\Games\plugins\fenix27.0.0.130.dll" --ppapi-flash-version=27.0.0.130 --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=F24A1EFB15C6E142B98A3C4251F23431 --renderer-client-id=30 --mojo-platform-channel-handle=4196 /prefetch:1
"Facebook Gameroom Browser.exe" --type=renderer --force-device-scale-factor=1 --no-sandbox --primordial-pipe-token=AD289217BC4217D8E65A7E90B41D2FAD --lang=en-US --lang=en-US --log-file="C:\Users\Peter\AppData\Local\Facebook\Games\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 CanvasFrame/1.8.6429.23271 Safari/537.36 FacebookCanvasDesktop FBAN/GamesWindowsDesktopApp FBAV/1.8.6429.23271" --enable-system-flash=1 --ppapi-flash-path="C:\Users\Peter\AppData\Local\Facebook\Games\plugins\fenix27.0.0.130.dll" --ppapi-flash-version=27.0.0.130 --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=AD289217BC4217D8E65A7E90B41D2FAD --renderer-client-id=29 --mojo-platform-channel-handle=4900 /prefetch:1
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Users\Public\Facebook Games\171892509642087\38\vgw.exe" /pn 67f18a23-8556-40f0-9d49-3321f6aca2b0 /access_token "eyJ1c2VyX2lkIjoiMTAyMDUyNTk3MzI2OTI4MDUiLCJhY2Nlc3NfdG9rZW4iOiJFQUFDY1ZkZjZEV2NCQUxiUUZRYjlNVkpkSUNPM0pDdkFGQzQxdmlkYnNybzZrOUd5UmRtbE9iVFViR2c3WkJ0QjFWdEZhRTI3YTJOUm9iaVNzUlNEMm1RaTJaQzBDOXRDeFNVWDVldG15clVLMFNENUV0cjdNckRxSjlMbnVtaG1CdUtqTmczVkpONjhKM3JaQTVDRUxaQUxkR0o5VGJ2d1Jxek1OSGNRMkdqdUN5cVFwaFNVdmdkNnh5NFpBVjdtTEhDZDFRNXJOVnI3TkU1N1V5c0FJbjNrbTZjYXlzVGtxTFJPSDcyWFhGUVpEWkQiLCJleHBpcmF0aW9uX3RpbWVzdGFtcCI6IjUxODQwMDAiLCJwZXJtaXNzaW9ucyI6InVzZXJfZnJpZW5kcyxlbWFpbCxwdWJsaXNoX2FjdGlvbnMscHVibGljX3Byb2ZpbGUifQ==" -parentHWND 3281516
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Peter\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Peter\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=61.0.3163.100 --initial-client-data=0x80,0x84,0x88,0x7c,0x8c,0x7fef91a1988,0x7fef91a1948,0x7fef91a1958
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=7576 --on-initialized-event-handle=312 --parent-handle=316 /prefetch:6
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1124,12880894803022888889,15390546435592978718,131072 --disable-direct-composition --supports-dual-gpus=false --gpu-driver-bug-workarounds=9,12,13,20,22,23,24,27,49,84 --disable-gl-extensions="GL_KHR_blend_equation_advanced GL_KHR_blend_equation_advanced_coherent" --gpu-vendor-id=0x10de --gpu-device-id=0x0a65 --gpu-driver-vendor=NVIDIA --gpu-driver-version=21.21.13.4201 --gpu-driver-date=11-14-2016 --service-request-channel-token=74E09BA47A3F0AD425C0D9EA6B8CBD72 --mojo-platform-channel-handle=1132 --ignored=" --type=renderer " /prefetch:2
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,12880894803022888889,15390546435592978718,131072 --service-pipe-token=89D1A0F5AB770FC5F4CB91CEB468D981 --lang=sk --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=89D1A0F5AB770FC5F4CB91CEB468D981 --renderer-client-id=4 --mojo-platform-channel-handle=2880 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,12880894803022888889,15390546435592978718,131072 --service-pipe-token=231BC6F6FBDCBF94E261C9D7FBA480A5 --lang=sk --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=231BC6F6FBDCBF94E261C9D7FBA480A5 --renderer-client-id=5 --mojo-platform-channel-handle=2732 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,12880894803022888889,15390546435592978718,131072 --service-pipe-token=7D0615139470EE9DDD8877B93CE32BAD --lang=sk --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=7D0615139470EE9DDD8877B93CE32BAD --renderer-client-id=6 --mojo-platform-channel-handle=3040 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,12880894803022888889,15390546435592978718,131072 --service-pipe-token=8B518AA5187F0EE816E69A808603069F --lang=sk --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=8B518AA5187F0EE816E69A808603069F --renderer-client-id=11 --mojo-platform-channel-handle=5052 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,12880894803022888889,15390546435592978718,131072 --service-pipe-token=45E28772CB3010878E147CBF2EFC81A9 --lang=sk --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=45E28772CB3010878E147CBF2EFC81A9 --renderer-client-id=15 --mojo-platform-channel-handle=3984 /prefetch:1

"C:\Windows\system32\SearchFilterHost.exe" 0 520 524 532 65536 528
C:\Windows\system32\sppsvc.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,12880894803022888889,15390546435592978718,131072 --service-pipe-token=CB2732F527DAB10CAC4595E9187ABE6C --lang=sk --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=CB2732F527DAB10CAC4595E9187ABE6C --renderer-client-id=17 --mojo-platform-channel-handle=4724 /prefetch:1
"C:\Users\Peter\Downloads\RSITx64 (1).exe"

======Scheduled tasks folder======

C:\Windows\tasks\DLLSuite(022217131052).job - C:\Program Files (x86)\DLL Suite\DLLSuite.exe -s

=========Mozilla firefox=========

ProfilePath - C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\o6yasy6y.default-1506712320144

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 27.0.0.130 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_27_0_0_130.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3528.0331]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.2.4]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 27.0.0.130 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_27_0_0_130.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled


======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}]
IDM integration (IDMIEHlprObj Class) - C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll [2017-07-12 527928]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}]
IDM integration (IDMIEHlprObj Class) - C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll [2017-07-12 453688]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvBackend"=C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2015-02-20 1793736]
"WinUpdat"=wscript.exe //B C:\Users\Peter\AppData\Local\Temp\WinUpdat.vbs []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"IDMan"=C:\Program Files (x86)\Internet Download Manager\IDMan.exe [2017-08-05 4027504]
"uTorrent"=C:\Users\Peter\AppData\Roaming\uTorrent\uTorrent.exe [2017-05-12 2469376]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Ultra Agent]
C:\Users\Peter\DAEMON Tools Ultra\DTAgent.exe [2016-12-12 5021888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OKAYFREEDOM Notifier]
C:\Program Files (x86)\OkayFreedom\Notifier.exe [2017-03-02 4199408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OKAYFREEDOM_Agent]
C:\Program Files (x86)\OkayFreedom\OkayFreedomClient.exe [2017-03-02 6580208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify]
C:\Users\Peter\AppData\Roaming\Spotify\Spotify.exe [2017-05-02 7064176]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify Web Helper]
C:\Users\Peter\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2017-05-02 1446000]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
C:\Users\Peter\AppData\Roaming\uTorrent\uTorrent.exe [2017-05-12 2469376]

C:\Users\Peter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Facebook Gameroom.lnk - C:\Users\Peter\AppData\Local\Facebook\Games\FacebookGameroom.exe
GoogleUpdate.lnk - C:\Users\Peter\AppData\Local\Temp\Google Updates\seachEn.exe

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MBAMService]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files (x86)\xchat\xchat.exe"="C:\Program Files (x86)\xchat\xchat.exe:*:Enabled:XChat IRC Client"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"aux3"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave5"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer5"=wdmaud.drv
"wave6"=wdmaud.drv
"midi6"=wdmaud.drv
"mixer6"=wdmaud.drv
"wave7"=wdmaud.drv
"midi7"=wdmaud.drv
"mixer7"=wdmaud.drv
"wave8"=wdmaud.drv
"midi8"=wdmaud.drv
"mixer8"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2017-10-07 17:20:27 ----A---- C:\Windows\system32\drivers\VBoxUSBMon.sys
2017-10-07 17:20:26 ----DC---- C:\Windows\system32\DRVSTORE
2017-10-07 17:20:26 ----D---- C:\Program Files\DIFX
2017-10-05 16:35:53 ----A---- C:\Windows\system32\drivers\VBoxUSB.sys
2017-10-05 16:35:50 ----D---- C:\Program Files (x86)\Bignox
2017-10-05 16:34:26 ----D---- C:\Program Files (x86)\Nox
2017-09-29 21:41:40 ----D---- C:\Program Files\TapinRadio
2017-09-14 04:49:21 ----SHD---- C:\Config.Msi
2017-09-13 17:32:29 ----A---- C:\Windows\system32\mshtml.dll
2017-09-13 17:32:26 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2017-09-13 17:32:21 ----A---- C:\Windows\system32\ieframe.dll
2017-09-13 17:32:19 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2017-09-13 17:32:19 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2017-09-13 17:32:19 ----A---- C:\Windows\system32\jscript9.dll
2017-09-13 17:32:18 ----A---- C:\Windows\SYSWOW64\wininet.dll
2017-09-13 17:32:18 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2017-09-13 17:32:18 ----A---- C:\Windows\system32\wininet.dll
2017-09-13 17:32:18 ----A---- C:\Windows\system32\iertutil.dll
2017-09-13 17:32:18 ----A---- C:\Windows\system32\DXPTaskRingtone.dll
2017-09-13 17:32:17 ----A---- C:\Windows\SYSWOW64\DXPTaskRingtone.dll
2017-09-13 17:32:17 ----A---- C:\Windows\system32\win32k.sys
2017-09-13 17:32:17 ----A---- C:\Windows\system32\shell32.dll
2017-09-13 17:32:16 ----A---- C:\Windows\system32\urlmon.dll
2017-09-13 17:32:16 ----A---- C:\Windows\system32\mmcndmgr.dll
2017-09-13 17:32:16 ----A---- C:\Windows\system32\mmc.exe
2017-09-13 17:32:15 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2017-09-13 17:32:15 ----A---- C:\Windows\SYSWOW64\shell32.dll
2017-09-13 17:32:15 ----A---- C:\Windows\system32\msfeeds.dll
2017-09-13 17:32:14 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2017-09-13 17:32:14 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2017-09-13 17:32:14 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2017-09-13 17:32:14 ----A---- C:\Windows\system32\ntoskrnl.exe
2017-09-13 17:32:13 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2017-09-13 17:32:13 ----A---- C:\Windows\SYSWOW64\mmcndmgr.dll
2017-09-13 17:32:13 ----A---- C:\Windows\SYSWOW64\mmc.exe
2017-09-13 17:32:13 ----A---- C:\Windows\system32\localspl.dll
2017-09-13 17:32:12 ----A---- C:\Windows\SYSWOW64\Wldap32.dll
2017-09-13 17:32:12 ----A---- C:\Windows\SYSWOW64\win32spl.dll
2017-09-13 17:32:12 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2017-09-13 17:32:12 ----A---- C:\Windows\system32\Wldap32.dll
2017-09-13 17:32:12 ----A---- C:\Windows\system32\win32spl.dll
2017-09-13 17:32:12 ----A---- C:\Windows\system32\usp10.dll
2017-09-13 17:32:12 ----A---- C:\Windows\system32\iedkcs32.dll
2017-09-13 17:32:12 ----A---- C:\Windows\system32\ie4uinit.exe
2017-09-13 17:32:11 ----A---- C:\Windows\SYSWOW64\usp10.dll
2017-09-13 17:32:11 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2017-09-13 17:32:11 ----A---- C:\Windows\system32\nsisvc.dll
2017-09-13 17:32:11 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2017-09-13 17:32:11 ----A---- C:\Windows\system32\mmcbase.dll
2017-09-13 17:32:11 ----A---- C:\Windows\system32\drivers\srvnet.sys
2017-09-13 17:32:11 ----A---- C:\Windows\system32\drivers\netbt.sys
2017-09-13 17:32:11 ----A---- C:\Windows\system32\cic.dll
2017-09-13 17:32:10 ----A---- C:\Windows\SYSWOW64\ntprint.dll
2017-09-13 17:32:10 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2017-09-13 17:32:10 ----A---- C:\Windows\system32\webcheck.dll
2017-09-13 17:32:10 ----A---- C:\Windows\system32\ntprint.dll
2017-09-13 17:32:10 ----A---- C:\Windows\system32\ntdll.dll
2017-09-13 17:32:10 ----A---- C:\Windows\system32\mmcshext.dll
2017-09-13 17:32:10 ----A---- C:\Windows\system32\drivers\nsiproxy.sys
2017-09-13 17:32:10 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2017-09-13 17:32:10 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2017-09-13 17:32:08 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2017-09-13 17:32:08 ----A---- C:\Windows\SYSWOW64\shdocvw.dll
2017-09-13 17:32:08 ----A---- C:\Windows\SYSWOW64\msrating.dll
2017-09-13 17:32:08 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2017-09-13 17:32:08 ----A---- C:\Windows\SYSWOW64\mmcshext.dll
2017-09-13 17:32:08 ----A---- C:\Windows\SYSWOW64\mmcbase.dll
2017-09-13 17:32:08 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2017-09-13 17:32:08 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2017-09-13 17:32:08 ----A---- C:\Windows\SYSWOW64\cic.dll
2017-09-13 17:32:08 ----A---- C:\Windows\SYSWOW64\certcli.dll
2017-09-13 17:32:08 ----A---- C:\Windows\system32\winnsi.dll
2017-09-13 17:32:08 ----A---- C:\Windows\system32\shdocvw.dll
2017-09-13 17:32:08 ----A---- C:\Windows\system32\msrating.dll
2017-09-13 17:32:08 ----A---- C:\Windows\system32\mshtmled.dll
2017-09-13 17:32:08 ----A---- C:\Windows\system32\dxtrans.dll
2017-09-13 17:32:08 ----A---- C:\Windows\system32\dxtmsft.dll
2017-09-13 17:32:08 ----A---- C:\Windows\system32\certcli.dll
2017-09-13 17:32:07 ----A---- C:\Windows\SYSWOW64\winnsi.dll
2017-09-13 17:32:07 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2017-09-13 17:32:07 ----A---- C:\Windows\SYSWOW64\ieui.dll
2017-09-13 17:32:07 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2017-09-13 17:32:07 ----A---- C:\Windows\system32\nsi.dll
2017-09-13 17:32:07 ----A---- C:\Windows\system32\mshtmlmedia.dll
2017-09-13 17:32:07 ----A---- C:\Windows\system32\jscript9diag.dll
2017-09-13 17:32:07 ----A---- C:\Windows\system32\ieui.dll
2017-09-13 17:32:07 ----A---- C:\Windows\system32\iesetup.dll
2017-09-13 17:32:06 ----A---- C:\Windows\SYSWOW64\occache.dll
2017-09-13 17:32:06 ----A---- C:\Windows\SYSWOW64\nsi.dll
2017-09-13 17:32:06 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2017-09-13 17:32:06 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2017-09-13 17:32:06 ----A---- C:\Windows\SYSWOW64\jscript.dll
2017-09-13 17:32:06 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2017-09-13 17:32:06 ----A---- C:\Windows\SYSWOW64\inseng.dll
2017-09-13 17:32:06 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2017-09-13 17:32:06 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2017-09-13 17:32:06 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2017-09-13 17:32:06 ----A---- C:\Windows\system32\vbscript.dll
2017-09-13 17:32:06 ----A---- C:\Windows\system32\ole32.dll
2017-09-13 17:32:06 ----A---- C:\Windows\system32\occache.dll
2017-09-13 17:32:06 ----A---- C:\Windows\system32\MshtmlDac.dll
2017-09-13 17:32:06 ----A---- C:\Windows\system32\jsproxy.dll
2017-09-13 17:32:06 ----A---- C:\Windows\system32\jscript.dll
2017-09-13 17:32:06 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-09-13 17:32:06 ----A---- C:\Windows\system32\inseng.dll
2017-09-13 17:32:06 ----A---- C:\Windows\system32\ieUnatt.exe
2017-09-13 17:32:06 ----A---- C:\Windows\system32\iernonce.dll
2017-09-13 17:32:06 ----A---- C:\Windows\system32\ieetwproxystub.dll
2017-09-13 17:32:06 ----A---- C:\Windows\system32\ieetwcollector.exe
2017-09-13 17:32:05 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2017-09-13 17:32:05 ----A---- C:\Windows\SYSWOW64\ole32.dll
2017-09-13 17:32:05 ----A---- C:\Windows\SYSWOW64\ntprint.exe
2017-09-13 17:32:05 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2017-09-13 17:32:05 ----A---- C:\Windows\system32\smss.exe
2017-09-13 17:32:05 ----A---- C:\Windows\system32\schannel.dll
2017-09-13 17:32:05 ----A---- C:\Windows\system32\rpcss.dll
2017-09-13 17:32:05 ----A---- C:\Windows\system32\rpcrt4.dll
2017-09-13 17:32:05 ----A---- C:\Windows\system32\ntprint.exe
2017-09-13 17:32:05 ----A---- C:\Windows\system32\netbtugc.exe
2017-09-13 17:32:05 ----A---- C:\Windows\system32\lsasrv.dll
2017-09-13 17:32:05 ----A---- C:\Windows\system32\kernel32.dll
2017-09-13 17:32:05 ----A---- C:\Windows\system32\kerberos.dll
2017-09-13 17:32:05 ----A---- C:\Windows\system32\inetpp.dll
2017-09-13 17:32:05 ----A---- C:\Windows\system32\ieapfltr.dll
2017-09-13 17:32:05 ----A---- C:\Windows\system32\ExplorerFrame.dll
2017-09-13 17:32:05 ----A---- C:\Windows\system32\drivers\srv2.sys
2017-09-13 17:32:05 ----A---- C:\Windows\system32\drivers\srv.sys
2017-09-13 17:32:05 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2017-09-13 17:32:05 ----A---- C:\Windows\system32\advapi32.dll
2017-09-13 17:32:04 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2017-09-13 17:32:04 ----A---- C:\Windows\SYSWOW64\netbtugc.exe
2017-09-13 17:32:04 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2017-09-13 17:32:04 ----A---- C:\Windows\SYSWOW64\advapi32.dll
2017-09-13 17:32:04 ----A---- C:\Windows\system32\wow64win.dll
2017-09-13 17:32:04 ----A---- C:\Windows\system32\winsrv.dll
2017-09-13 17:32:04 ----A---- C:\Windows\system32\srcore.dll
2017-09-13 17:32:04 ----A---- C:\Windows\system32\ncrypt.dll
2017-09-13 17:32:04 ----A---- C:\Windows\system32\msv1_0.dll
2017-09-13 17:32:04 ----A---- C:\Windows\system32\KernelBase.dll
2017-09-13 17:32:04 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2017-09-13 17:32:03 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2017-09-13 17:32:03 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2017-09-13 17:32:03 ----A---- C:\Windows\SYSWOW64\schannel.dll
2017-09-13 17:32:03 ----A---- C:\Windows\SYSWOW64\rpchttp.dll
2017-09-13 17:32:03 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2017-09-13 17:32:03 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2017-09-13 17:32:03 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2017-09-13 17:32:03 ----A---- C:\Windows\SYSWOW64\ExplorerFrame.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\wow64.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\wdigest.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\TSpkg.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\sspisrv.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\sspicli.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\secur32.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\rpchttp.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\lsass.exe
2017-09-13 17:32:03 ----A---- C:\Windows\system32\inetppui.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2017-09-13 17:32:03 ----A---- C:\Windows\system32\drivers\appid.sys
2017-09-13 17:32:03 ----A---- C:\Windows\system32\csrsrv.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\cryptbase.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\conhost.exe
2017-09-13 17:32:03 ----A---- C:\Windows\system32\bcrypt.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-09-13 17:32:02 ----A---- C:\Windows\SYSWOW64\wow32.dll
2017-09-13 17:32:02 ----A---- C:\Windows\SYSWOW64\srclient.dll
2017-09-13 17:32:02 ----A---- C:\Windows\SYSWOW64\secur32.dll
2017-09-13 17:32:02 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2017-09-13 17:32:02 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2017-09-13 17:32:02 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2017-09-13 17:32:02 ----A---- C:\Windows\SYSWOW64\credssp.dll
2017-09-13 17:32:02 ----A---- C:\Windows\SYSWOW64\comcat.dll
2017-09-13 17:32:02 ----A---- C:\Windows\SYSWOW64\bcrypt.dll
2017-09-13 17:32:02 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2017-09-13 17:32:02 ----A---- C:\Windows\SYSWOW64\appidapi.dll
2017-09-13 17:32:02 ----A---- C:\Windows\system32\wpnpinst.exe
2017-09-13 17:32:02 ----A---- C:\Windows\system32\wow64cpu.dll
2017-09-13 17:32:02 ----A---- C:\Windows\system32\srclient.dll
2017-09-13 17:32:02 ----A---- C:\Windows\system32\setbcdlocale.dll
2017-09-13 17:32:02 ----A---- C:\Windows\system32\rstrui.exe
2017-09-13 17:32:02 ----A---- C:\Windows\system32\ntvdm64.dll
2017-09-13 17:32:02 ----A---- C:\Windows\system32\credssp.dll
2017-09-13 17:32:02 ----A---- C:\Windows\system32\comcat.dll
2017-09-13 17:32:02 ----A---- C:\Windows\system32\auditpol.exe
2017-09-13 17:32:02 ----A---- C:\Windows\system32\appidsvc.dll
2017-09-13 17:32:02 ----A---- C:\Windows\system32\appidpolicyconverter.exe
2017-09-13 17:32:02 ----A---- C:\Windows\system32\appidcertstorecheck.exe
2017-09-13 17:32:02 ----A---- C:\Windows\system32\appidapi.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-09-13 17:32:00 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2017-09-13 17:32:00 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2017-09-13 17:32:00 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2017-09-13 17:32:00 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2017-09-13 17:32:00 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2017-09-13 17:32:00 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-09-13 17:32:00 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-09-13 17:32:00 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-09-13 17:32:00 ----A---- C:\Windows\SYSWOW64\setup16.exe
2017-09-13 17:32:00 ----A---- C:\Windows\SYSWOW64\instnm.exe
2017-09-13 17:32:00 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2017-09-13 17:32:00 ----A---- C:\Windows\system32\PrintBrmUi.exe
2017-09-13 17:32:00 ----A---- C:\Windows\system32\apisetschema.dll
2017-09-13 17:31:59 ----A---- C:\Windows\SYSWOW64\user.exe
2017-09-13 17:31:58 ----A---- C:\Windows\SYSWOW64\oleres.dll
2017-09-13 17:31:58 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2017-09-13 17:31:58 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2017-09-13 17:31:58 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2017-09-13 17:31:58 ----A---- C:\Windows\system32\oleres.dll
2017-09-13 17:31:58 ----A---- C:\Windows\system32\msobjs.dll
2017-09-13 17:31:58 ----A---- C:\Windows\system32\msaudite.dll
2017-09-13 17:31:58 ----A---- C:\Windows\system32\adtschema.dll
2017-09-09 08:52:31 ----D---- C:\Program Files (x86)\Nend Software

======List of files/folders modified in the last 1 month======

2017-10-08 14:35:40 ----D---- C:\Program Files\trend micro
2017-10-08 14:35:32 ----D---- C:\Windows\Temp
2017-10-08 14:34:40 ----D---- C:\Users\Peter\AppData\Roaming\uTorrent
2017-10-08 14:34:28 ----D---- C:\Windows
2017-10-08 14:34:27 ----D---- C:\Windows\inf
2017-10-08 14:31:54 ----D---- C:\Users\Peter\AppData\Roaming\IDM
2017-10-08 08:13:01 ----D---- C:\Windows\system32\config
2017-10-08 08:07:21 ----D---- C:\Windows\SYSWOW64\Macromed
2017-10-07 17:25:05 ----D---- C:\Windows\system32\drivers
2017-10-07 17:20:26 ----RD---- C:\Program Files
2017-10-07 17:20:26 ----D---- C:\Windows\System32
2017-10-07 17:20:23 ----D---- C:\Windows\system32\DriverStore
2017-10-07 16:55:20 ----D---- C:\Users\Peter\AppData\Roaming\Charles
2017-10-06 16:22:51 ----SHD---- C:\System Volume Information
2017-10-05 16:36:09 ----D---- C:\Windows\Registration
2017-10-05 16:35:50 ----RD---- C:\Program Files (x86)
2017-10-05 16:34:21 ----D---- C:\Windows\Prefetch
2017-10-05 16:33:06 ----HD---- C:\ProgramData
2017-10-05 16:32:58 ----AD---- C:\Program Files (x86)\BlueStacks
2017-10-01 10:05:17 ----D---- C:\Windows\system32\Tasks
2017-10-01 09:44:46 ----D---- C:\ProgramData\ProductData
2017-09-30 08:09:52 ----D---- C:\Users\Peter\AppData\Roaming\DMCache
2017-09-30 06:59:46 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2017-09-29 21:11:58 ----D---- C:\Program Files (x86)\Mozilla Firefox
2017-09-22 20:37:12 ----D---- C:\Program Files\CCleaner
2017-09-21 05:39:30 ----D---- C:\Windows\debug
2017-09-17 14:01:26 ----D---- C:\Program Files (x86)\DLL Suite
2017-09-17 02:49:07 ----D---- C:\Windows\system32\wdi
2017-09-15 09:34:15 ----D---- C:\Program Files (x86)\TeamViewer
2017-09-15 03:57:27 ----D---- C:\Windows\rescache
2017-09-14 21:19:39 ----D---- C:\Windows\Microsoft.NET
2017-09-14 20:29:48 ----RSD---- C:\Windows\assembly
2017-09-14 05:48:23 ----A---- C:\Windows\system32\PerfStringBackup.INI
2017-09-14 05:43:05 ----D---- C:\Windows\winsxs
2017-09-14 05:39:46 ----D---- C:\Program Files\Internet Explorer
2017-09-14 05:39:45 ----D---- C:\Windows\SYSWOW64\sk-SK
2017-09-14 05:39:45 ----D---- C:\Windows\SYSWOW64\en-US
2017-09-14 05:39:45 ----D---- C:\Program Files (x86)\Internet Explorer
2017-09-14 05:39:44 ----D---- C:\Windows\SysWOW64
2017-09-14 05:39:41 ----D---- C:\Windows\system32\sk-SK
2017-09-14 05:39:41 ----D---- C:\Windows\system32\en-US
2017-09-14 05:39:37 ----D---- C:\Windows\AppPatch
2017-09-14 05:39:36 ----D---- C:\Windows\system32\Boot
2017-09-14 05:37:32 ----D---- C:\Users\Peter\AppData\Roaming\IObit
2017-09-14 05:34:22 ----D---- C:\AdwCleaner
2017-09-14 05:11:09 ----D---- C:\Windows\system32\MRT
2017-09-14 05:06:15 ----AC---- C:\Windows\system32\MRT.exe
2017-09-14 04:57:33 ----SHD---- C:\Windows\Installer
2017-09-14 04:53:33 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2017-09-13 17:27:28 ----D---- C:\Windows\system32\catroot2
2017-09-12 19:28:24 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2017-09-12 19:28:20 ----D---- C:\Windows\system32\Macromed

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 SmartDefragDriver;SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [2017-03-09 30744]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 199552]
R1 adgnetworkwfpdrv;adgnetworkwfpdrv; C:\Windows\system32\drivers\adgnetworkwfpdrv.sys [2017-03-27 70384]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 514560]
R1 dsnpfd;DeskSoft LightWeight Filter; C:\Windows\system32\DRIVERS\dsnpfd.sys [2017-02-22 37576]
R1 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2017-06-22 132824]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2017-05-04 178056]
R1 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2017-05-04 77224]
R1 HWiNFO32;HWiNFO32/64 Kernel Driver; \??\C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [2016-11-26 27552]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver; C:\Windows\system32\DRIVERS\VBoxUSBMon.sys [2017-10-05 144656]
R1 YSDrv;VBox Support Driver; \??\C:\Program Files (x86)\Bignox\BigNoxVM\RT\YSDrv.sys [2017-10-05 270608]
R2 IDMWFP;IDMWFP; C:\Windows\system32\DRIVERS\idmwfp.sys [2017-08-05 225568]
R3 dtultrascsibus;DAEMON Tools Ultra Virtual SCSI Bus; C:\Windows\system32\DRIVERS\dtultrascsibus.sys [2017-01-25 30264]
R3 dtultrausbbus;DAEMON Tools Ultra Virtual USB Bus; C:\Windows\system32\DRIVERS\dtultrausbbus.sys [2017-01-25 47672]
R3 ETDSMBus;ETDSMBus; C:\Windows\system32\DRIVERS\ETDSMBus.sys [2017-08-08 32840]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys [2016-11-26 15416]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys [2015-02-20 197408]
R3 P17;SB 5.1 VX; C:\Windows\system32\drivers\P17.sys [2016-11-26 1309696]
R3 tap0901;TAP-Windows Adapter V9; C:\Windows\system32\DRIVERS\tap0901.sys [2016-04-21 27136]
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudbus.sys [2016-12-03 129152]
S3 dtlitescsibus;DAEMON Tools Lite Virtual SCSI Bus; C:\Windows\system32\DRIVERS\dtlitescsibus.sys [2016-12-22 30264]
S3 dtliteusbbus;DAEMON Tools Lite Virtual USB Bus; C:\Windows\system32\DRIVERS\dtliteusbbus.sys [2016-12-22 47672]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 165888]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 6656]
S3 SANDRA;SANDRA; \??\C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2015.SP1a\WNt600x64\Sandra.sys [2009-08-07 23112]
S3 SmbDrvI;SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [2016-11-26 33960]
S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudmdm.sys [2016-12-14 221824]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 34688]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
S3 VBoxUSB;VirtualBox USB; C:\Windows\System32\Drivers\VBoxUSB.sys [2017-10-05 131856]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 21760]
S3 WinUsb;SAMSUNG Android USB Driver; C:\Windows\system32\DRIVERS\WinUSB.sys [2010-11-20 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2017-07-19 83032]
R2 BWMeterConSvc;BWMeter Connections Service; C:\Program Files (x86)\BWMeter\BWMeterConSvc.exe [2017-02-22 126976]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 CTAudSvcService;Creative Audio Service; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [2008-11-18 307200]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2017-06-13 2625368]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2016-11-14 932728]
R2 OkayFreedom VPN Starter Service;OkayFreedom VPN Starter Service; C:\Program Files (x86)\OkayFreedom\OkayFreedomService.exe [2017-03-02 355328]
R2 TeamViewer;TeamViewer 12; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [2016-11-28 10216688]
R3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
R3 Disc Soft Ultra Bus Service;Disc Soft Ultra Bus Service; C:\Users\Peter\DAEMON Tools Ultra\DiscSoftBusServiceUltra.exe [2016-12-12 4854464]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2017-04-21 107656]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2017-04-21 128648]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-11-26 153752]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-09-12 272384]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2016-11-26 79360]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-11-26 153752]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2017-08-13 116224]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2017-09-29 175568]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 SandraAgentSrv;SiSoftware Deployment Agent Service; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2015.SP1a\RpcAgentSrv.exe [2015-03-17 73200]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2017-06-10 1255736]
S4 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2017-04-21 52856]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-04-21 136312]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-04-21 136312]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-04-21 136312]

-----------------EOF-----------------

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 118197
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: Prosím o kontrolu - Zasekaný PC

#2 Příspěvek od Rudy »

Zdravím!
Spusťte tuto utilitu:
Stáhněte AdwCleaner https://toolslib.net/downloads/viewdown ... dwcleaner/
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve na >Scan<(hledání) a pak na >Clean< (mazání).
Proběhne skenováni a pak se objeví log, který sem vložte.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

PureHate44
Návštěvník
Návštěvník
Příspěvky: 154
Registrován: 28 čer 2011 17:49

Re: Prosím o kontrolu - Zasekaný PC

#3 Příspěvek od PureHate44 »

Všimol som si, že mi PC vyťažovalo nejaký “vgw” proces :-O
Ukončil som ho a PC mi už šlape lepšie :-)
Ale aj tak tu mám log z ADW cleaner :


# AdwCleaner 7.0.3.1 - Logfile created on Sun Oct 08 13:52:21 2017
# Updated on 2017/29/09 by Malwarebytes
# Running on Windows 7 Professional (X64)
# Mode: clean
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services deleted.

***** [ Folders ] *****

No malicious folders deleted.

***** [ Files ] *****

No malicious files deleted.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

Deleted: Driver Booster Scheduler


***** [ Registry ] *****

No malicious registry entries deleted.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries deleted.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries deleted.

*************************

::Tracing keys deleted
::Winsock settings cleared
::Additional Actions: 0



*************************

C:/AdwCleaner/AdwCleaner[C1].txt - [2700 B] - [2016/4/30 12:6:27]
C:/AdwCleaner/AdwCleaner[C2].txt - [2283 B] - [2016/9/10 18:20:6]
C:/AdwCleaner/AdwCleaner[C3].txt - [5437 B] - [2016/11/18 20:8:58]
C:/AdwCleaner/AdwCleaner[C4].txt - [10900 B] - [2016/11/22 18:30:52]
C:/AdwCleaner/AdwCleaner[C5].txt - [2009 B] - [2016/12/29 18:54:56]
C:/AdwCleaner/AdwCleaner[C6].txt - [2416 B] - [2017/6/11 19:43:2]
C:/AdwCleaner/AdwCleaner[S10].txt - [2066 B] - [2017/1/20 13:27:12]
C:/AdwCleaner/AdwCleaner[S11].txt - [2458 B] - [2017/6/11 19:42:51]
C:/AdwCleaner/AdwCleaner[S1].txt - [2775 B] - [2016/4/30 12:3:52]
C:/AdwCleaner/AdwCleaner[S3].txt - [2338 B] - [2016/9/10 18:19:39]
C:/AdwCleaner/AdwCleaner[S4].txt - [5264 B] - [2016/11/18 20:6:1]
C:/AdwCleaner/AdwCleaner[S5].txt - [13560 B] - [2016/11/22 18:25:30]
C:/AdwCleaner/AdwCleaner[S6].txt - [13582 B] - [2016/11/22 18:29:2]
C:/AdwCleaner/AdwCleaner[S7].txt - [1398 B] - [2015/3/25 20:32:4]
C:/AdwCleaner/AdwCleaner[S8].txt - [2363 B] - [2015/4/18 11:58:43]
C:/AdwCleaner/AdwCleaner[S9].txt - [2144 B] - [2016/12/29 18:54:39]


########## EOF - C:\AdwCleaner\AdwCleaner[C6].txt ##########

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 118197
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: Prosím o kontrolu - Zasekaný PC

#4 Příspěvek od Rudy »

OK. Dejte nový log RSIT.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

PureHate44
Návštěvník
Návštěvník
Příspěvky: 154
Registrován: 28 čer 2011 17:49

Re: Prosím o kontrolu - Zasekaný PC

#5 Příspěvek od PureHate44 »

Logfile of random's system information tool 1.10 (written by random/random)
Run by Peter at 2017-10-08 20:27:10
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 24 GB (12%) free of 200 GB
Total RAM: 4095 MB (58% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:27:18, on 8. 10. 2017
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18792)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\IObit\Smart Defrag\SmartDefrag.exe
C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
C:\Program Files (x86)\Internet Download Manager\IDMan.exe
C:\Users\Peter\AppData\Roaming\uTorrent\uTorrent.exe
C:\Users\Peter\AppData\Local\Facebook\Games\FacebookGameroom.exe
C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe
C:\Users\Peter\AppData\Roaming\uTorrent\VirusGuard\BitTorrentAntivirus.exe
C:\Program Files (x86)\OkayFreedom\OkayFreedomClient.exe
C:\Users\Peter\AppData\Local\Facebook\Games\Facebook Gameroom Browser.exe
C:\Program Files\trend micro\Peter.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O1 - Hosts: ::1 localhost
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll
O4 - HKCU\..\Run: [IDMan] C:\Program Files (x86)\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [uTorrent] "C:\Users\Peter\AppData\Roaming\uTorrent\uTorrent.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 (User 'Default user')
O4 - Startup: Facebook Gameroom.lnk = Peter\AppData\Local\Facebook\Games\FacebookGameroom.exe
O4 - Startup: GoogleUpdate.lnk = C:\Users\Peter\AppData\Local\Temp\Google Updates\seachEn.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\Program Files\Microsoft Office\Root\Office16\ONBttnIE.dll/105
O8 - Extra context menu item: Stiahnuť s IDM - C:\Program Files (x86)\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Stiahnuť s IDM všetky prepojenia - C:\Program Files (x86)\Internet Download Manager\IEGetAll.htm
O9 - Extra button: Fiddler - {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - "C:\Program Files (x86)\Fiddler2\Fiddler.exe" (file missing)
O9 - Extra 'Tools' menuitem: Fiddler - {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - "C:\Program Files (x86)\Fiddler2\Fiddler.exe" (file missing)
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: http://help.eset.com (HKLM)
O15 - ESC Trusted Zone: http://help.eset.com (HKLM)
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: BWMeter Connections Service (BWMeterConSvc) - Unknown owner - C:\Program Files (x86)\BWMeter\BWMeterConSvc.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
O23 - Service: Disc Soft Ultra Bus Service - Disc Soft Ltd - C:\Users\Peter\DAEMON Tools Ultra\DiscSoftBusServiceUltra.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: OkayFreedom VPN Starter Service - Steganos Software GmbH - C:\Program Files (x86)\OkayFreedom\OkayFreedomService.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2015.SP1a\RpcAgentSrv.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: TeamViewer 12 (TeamViewer) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 9009 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
"C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe"
"C:\Windows\system32\nvvsvc.exe"
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
"C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe"
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files (x86)\BWMeter\BWMeterConSvc.exe"
C:\Windows\System32\svchost.exe -k utcsvc
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
"taskhost.exe"
taskeng.exe {79CE1938-7B87-4A23-A9BC-9D8D3967CD94}
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files (x86)\OkayFreedom\OkayFreedomService.exe"
"C:\Program Files (x86)\IObit\Smart Defrag\SmartDefrag.exe" /STARTUP
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe"
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
"C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /onboot
"C:\Users\Peter\AppData\Roaming\uTorrent\uTorrent.exe"
"C:\Users\Peter\AppData\Local\Facebook\Games\FacebookGameroom.exe" fbgames://windows_startup/
"C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide
"C:/Program Files/NVIDIA Corporation/Display/nvtray.exe" -user_has_logged_in 1"
"C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe"
"C:\Users\Peter\AppData\Roaming\uTorrent\VirusGuard\BitTorrentAntivirus.exe"
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Program Files (x86)\OkayFreedom\OkayFreedomClient.exe"
"Facebook Gameroom Browser.exe" --type=gpu-process --no-sandbox --lang=en-US --log-file="C:\Users\Peter\AppData\Local\Facebook\Games\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 CanvasFrame/1.8.6429.23271 Safari/537.36 FacebookCanvasDesktop FBAN/GamesWindowsDesktopApp FBAV/1.8.6429.23271" --disable-direct-composition --supports-dual-gpus=false --gpu-driver-bug-workarounds=7,10,18,19,20,23,41,74 --disable-gl-extensions="GL_KHR_blend_equation_advanced GL_KHR_blend_equation_advanced_coherent" --gpu-vendor-id=0x10de --gpu-device-id=0x0a65 --gpu-driver-vendor=NVIDIA --gpu-driver-version=21.21.13.4201 --gpu-driver-date=11-14-2016 --lang=en-US --log-file="C:\Users\Peter\AppData\Local\Facebook\Games\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 CanvasFrame/1.8.6429.23271 Safari/537.36 FacebookCanvasDesktop FBAN/GamesWindowsDesktopApp FBAV/1.8.6429.23271" --service-request-channel-token=A4A48170D92CB52B9B41B74C5906E4D3 --mojo-platform-channel-handle=1916 /prefetch:2
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Peter\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Peter\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=61.0.3163.100 --initial-client-data=0x80,0x84,0x88,0x7c,0x8c,0x7fef8281988,0x7fef8281948,0x7fef8281958
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=4680 --on-initialized-event-handle=312 --parent-handle=316 /prefetch:6
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1120,15207744440194026194,6836760234027410302,131072 --disable-direct-composition --supports-dual-gpus=false --gpu-driver-bug-workarounds=9,12,13,20,22,23,24,27,49,84 --disable-gl-extensions="GL_KHR_blend_equation_advanced GL_KHR_blend_equation_advanced_coherent" --gpu-vendor-id=0x10de --gpu-device-id=0x0a65 --gpu-driver-vendor=NVIDIA --gpu-driver-version=21.21.13.4201 --gpu-driver-date=11-14-2016 --service-request-channel-token=1EEC6E29E72A0FD6D059459EF2A80136 --mojo-platform-channel-handle=1116 --ignored=" --type=renderer " /prefetch:2
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,15207744440194026194,6836760234027410302,131072 --service-pipe-token=C9AA56746095B37C836B323F17A352A8 --lang=sk --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=C9AA56746095B37C836B323F17A352A8 --renderer-client-id=4 --mojo-platform-channel-handle=3060 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,15207744440194026194,6836760234027410302,131072 --service-pipe-token=FE498014CDD0ADD6429DC148486592CF --lang=sk --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=FE498014CDD0ADD6429DC148486592CF --renderer-client-id=5 --mojo-platform-channel-handle=3308 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,15207744440194026194,6836760234027410302,131072 --service-pipe-token=5AACE7CD48C2DD02AC997FE55469825E --lang=sk --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=5AACE7CD48C2DD02AC997FE55469825E --renderer-client-id=6 --mojo-platform-channel-handle=3384 /prefetch:1

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,15207744440194026194,6836760234027410302,131072 --service-pipe-token=2EDA7EE11A297086F06FB868C9DBB8F1 --lang=sk --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=2EDA7EE11A297086F06FB868C9DBB8F1 --renderer-client-id=14 --mojo-platform-channel-handle=3092 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,15207744440194026194,6836760234027410302,131072 --service-pipe-token=E9A7CB6DD9A7047985D09ED73A5B6428 --lang=sk --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=E9A7CB6DD9A7047985D09ED73A5B6428 --renderer-client-id=17 --mojo-platform-channel-handle=4900 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,15207744440194026194,6836760234027410302,131072 --service-pipe-token=2E7E77378F22D98EFC733EDD7D623A78 --lang=sk --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=2E7E77378F22D98EFC733EDD7D623A78 --renderer-client-id=19 --mojo-platform-channel-handle=5212 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,15207744440194026194,6836760234027410302,131072 --service-pipe-token=9828161F5955C1EC2680724BAE66AC0A --lang=sk --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=9828161F5955C1EC2680724BAE66AC0A --renderer-client-id=20 --mojo-platform-channel-handle=3732 /prefetch:1
"C:\Users\Peter\Downloads\RSITx64 (1).exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\DLLSuite(022217131052).job - C:\Program Files (x86)\DLL Suite\DLLSuite.exe -s

=========Mozilla firefox=========

ProfilePath - C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\o6yasy6y.default-1506712320144

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 27.0.0.130 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_27_0_0_130.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3528.0331]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.2.4]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 27.0.0.130 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_27_0_0_130.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled


======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}]
IDM integration (IDMIEHlprObj Class) - C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll [2017-07-12 527928]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}]
IDM integration (IDMIEHlprObj Class) - C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll [2017-07-12 453688]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvBackend"=C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2015-02-20 1793736]
"WinUpdat"=wscript.exe //B C:\Users\Peter\AppData\Local\Temp\WinUpdat.vbs []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"IDMan"=C:\Program Files (x86)\Internet Download Manager\IDMan.exe [2017-08-05 4027504]
"uTorrent"=C:\Users\Peter\AppData\Roaming\uTorrent\uTorrent.exe [2017-05-12 2469376]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Ultra Agent]
C:\Users\Peter\DAEMON Tools Ultra\DTAgent.exe [2016-12-12 5021888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OKAYFREEDOM Notifier]
C:\Program Files (x86)\OkayFreedom\Notifier.exe [2017-03-02 4199408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OKAYFREEDOM_Agent]
C:\Program Files (x86)\OkayFreedom\OkayFreedomClient.exe [2017-03-02 6580208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify]
C:\Users\Peter\AppData\Roaming\Spotify\Spotify.exe [2017-05-02 7064176]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify Web Helper]
C:\Users\Peter\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2017-05-02 1446000]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
C:\Users\Peter\AppData\Roaming\uTorrent\uTorrent.exe [2017-05-12 2469376]

C:\Users\Peter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Facebook Gameroom.lnk - C:\Users\Peter\AppData\Local\Facebook\Games\FacebookGameroom.exe
GoogleUpdate.lnk - C:\Users\Peter\AppData\Local\Temp\Google Updates\seachEn.exe

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MBAMService]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files (x86)\xchat\xchat.exe"="C:\Program Files (x86)\xchat\xchat.exe:*:Enabled:XChat IRC Client"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"aux3"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave5"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer5"=wdmaud.drv
"wave6"=wdmaud.drv
"midi6"=wdmaud.drv
"mixer6"=wdmaud.drv
"wave7"=wdmaud.drv
"midi7"=wdmaud.drv
"mixer7"=wdmaud.drv
"wave8"=wdmaud.drv
"midi8"=wdmaud.drv
"mixer8"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2017-10-07 17:20:27 ----A---- C:\Windows\system32\drivers\VBoxUSBMon.sys
2017-10-07 17:20:26 ----DC---- C:\Windows\system32\DRVSTORE
2017-10-07 17:20:26 ----D---- C:\Program Files\DIFX
2017-10-05 16:35:53 ----A---- C:\Windows\system32\drivers\VBoxUSB.sys
2017-10-05 16:35:50 ----D---- C:\Program Files (x86)\Bignox
2017-10-05 16:34:26 ----D---- C:\Program Files (x86)\Nox
2017-09-29 21:41:40 ----D---- C:\Program Files\TapinRadio
2017-09-14 04:49:21 ----SHD---- C:\Config.Msi
2017-09-13 17:32:29 ----A---- C:\Windows\system32\mshtml.dll
2017-09-13 17:32:26 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2017-09-13 17:32:21 ----A---- C:\Windows\system32\ieframe.dll
2017-09-13 17:32:19 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2017-09-13 17:32:19 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2017-09-13 17:32:19 ----A---- C:\Windows\system32\jscript9.dll
2017-09-13 17:32:18 ----A---- C:\Windows\SYSWOW64\wininet.dll
2017-09-13 17:32:18 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2017-09-13 17:32:18 ----A---- C:\Windows\system32\wininet.dll
2017-09-13 17:32:18 ----A---- C:\Windows\system32\iertutil.dll
2017-09-13 17:32:18 ----A---- C:\Windows\system32\DXPTaskRingtone.dll
2017-09-13 17:32:17 ----A---- C:\Windows\SYSWOW64\DXPTaskRingtone.dll
2017-09-13 17:32:17 ----A---- C:\Windows\system32\win32k.sys
2017-09-13 17:32:17 ----A---- C:\Windows\system32\shell32.dll
2017-09-13 17:32:16 ----A---- C:\Windows\system32\urlmon.dll
2017-09-13 17:32:16 ----A---- C:\Windows\system32\mmcndmgr.dll
2017-09-13 17:32:16 ----A---- C:\Windows\system32\mmc.exe
2017-09-13 17:32:15 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2017-09-13 17:32:15 ----A---- C:\Windows\SYSWOW64\shell32.dll
2017-09-13 17:32:15 ----A---- C:\Windows\system32\msfeeds.dll
2017-09-13 17:32:14 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2017-09-13 17:32:14 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2017-09-13 17:32:14 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2017-09-13 17:32:14 ----A---- C:\Windows\system32\ntoskrnl.exe
2017-09-13 17:32:13 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2017-09-13 17:32:13 ----A---- C:\Windows\SYSWOW64\mmcndmgr.dll
2017-09-13 17:32:13 ----A---- C:\Windows\SYSWOW64\mmc.exe
2017-09-13 17:32:13 ----A---- C:\Windows\system32\localspl.dll
2017-09-13 17:32:12 ----A---- C:\Windows\SYSWOW64\Wldap32.dll
2017-09-13 17:32:12 ----A---- C:\Windows\SYSWOW64\win32spl.dll
2017-09-13 17:32:12 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2017-09-13 17:32:12 ----A---- C:\Windows\system32\Wldap32.dll
2017-09-13 17:32:12 ----A---- C:\Windows\system32\win32spl.dll
2017-09-13 17:32:12 ----A---- C:\Windows\system32\usp10.dll
2017-09-13 17:32:12 ----A---- C:\Windows\system32\iedkcs32.dll
2017-09-13 17:32:12 ----A---- C:\Windows\system32\ie4uinit.exe
2017-09-13 17:32:11 ----A---- C:\Windows\SYSWOW64\usp10.dll
2017-09-13 17:32:11 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2017-09-13 17:32:11 ----A---- C:\Windows\system32\nsisvc.dll
2017-09-13 17:32:11 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2017-09-13 17:32:11 ----A---- C:\Windows\system32\mmcbase.dll
2017-09-13 17:32:11 ----A---- C:\Windows\system32\drivers\srvnet.sys
2017-09-13 17:32:11 ----A---- C:\Windows\system32\drivers\netbt.sys
2017-09-13 17:32:11 ----A---- C:\Windows\system32\cic.dll
2017-09-13 17:32:10 ----A---- C:\Windows\SYSWOW64\ntprint.dll
2017-09-13 17:32:10 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2017-09-13 17:32:10 ----A---- C:\Windows\system32\webcheck.dll
2017-09-13 17:32:10 ----A---- C:\Windows\system32\ntprint.dll
2017-09-13 17:32:10 ----A---- C:\Windows\system32\ntdll.dll
2017-09-13 17:32:10 ----A---- C:\Windows\system32\mmcshext.dll
2017-09-13 17:32:10 ----A---- C:\Windows\system32\drivers\nsiproxy.sys
2017-09-13 17:32:10 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2017-09-13 17:32:10 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2017-09-13 17:32:08 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2017-09-13 17:32:08 ----A---- C:\Windows\SYSWOW64\shdocvw.dll
2017-09-13 17:32:08 ----A---- C:\Windows\SYSWOW64\msrating.dll
2017-09-13 17:32:08 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2017-09-13 17:32:08 ----A---- C:\Windows\SYSWOW64\mmcshext.dll
2017-09-13 17:32:08 ----A---- C:\Windows\SYSWOW64\mmcbase.dll
2017-09-13 17:32:08 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2017-09-13 17:32:08 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2017-09-13 17:32:08 ----A---- C:\Windows\SYSWOW64\cic.dll
2017-09-13 17:32:08 ----A---- C:\Windows\SYSWOW64\certcli.dll
2017-09-13 17:32:08 ----A---- C:\Windows\system32\winnsi.dll
2017-09-13 17:32:08 ----A---- C:\Windows\system32\shdocvw.dll
2017-09-13 17:32:08 ----A---- C:\Windows\system32\msrating.dll
2017-09-13 17:32:08 ----A---- C:\Windows\system32\mshtmled.dll
2017-09-13 17:32:08 ----A---- C:\Windows\system32\dxtrans.dll
2017-09-13 17:32:08 ----A---- C:\Windows\system32\dxtmsft.dll
2017-09-13 17:32:08 ----A---- C:\Windows\system32\certcli.dll
2017-09-13 17:32:07 ----A---- C:\Windows\SYSWOW64\winnsi.dll
2017-09-13 17:32:07 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2017-09-13 17:32:07 ----A---- C:\Windows\SYSWOW64\ieui.dll
2017-09-13 17:32:07 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2017-09-13 17:32:07 ----A---- C:\Windows\system32\nsi.dll
2017-09-13 17:32:07 ----A---- C:\Windows\system32\mshtmlmedia.dll
2017-09-13 17:32:07 ----A---- C:\Windows\system32\jscript9diag.dll
2017-09-13 17:32:07 ----A---- C:\Windows\system32\ieui.dll
2017-09-13 17:32:07 ----A---- C:\Windows\system32\iesetup.dll
2017-09-13 17:32:06 ----A---- C:\Windows\SYSWOW64\occache.dll
2017-09-13 17:32:06 ----A---- C:\Windows\SYSWOW64\nsi.dll
2017-09-13 17:32:06 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2017-09-13 17:32:06 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2017-09-13 17:32:06 ----A---- C:\Windows\SYSWOW64\jscript.dll
2017-09-13 17:32:06 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2017-09-13 17:32:06 ----A---- C:\Windows\SYSWOW64\inseng.dll
2017-09-13 17:32:06 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2017-09-13 17:32:06 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2017-09-13 17:32:06 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2017-09-13 17:32:06 ----A---- C:\Windows\system32\vbscript.dll
2017-09-13 17:32:06 ----A---- C:\Windows\system32\ole32.dll
2017-09-13 17:32:06 ----A---- C:\Windows\system32\occache.dll
2017-09-13 17:32:06 ----A---- C:\Windows\system32\MshtmlDac.dll
2017-09-13 17:32:06 ----A---- C:\Windows\system32\jsproxy.dll
2017-09-13 17:32:06 ----A---- C:\Windows\system32\jscript.dll
2017-09-13 17:32:06 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-09-13 17:32:06 ----A---- C:\Windows\system32\inseng.dll
2017-09-13 17:32:06 ----A---- C:\Windows\system32\ieUnatt.exe
2017-09-13 17:32:06 ----A---- C:\Windows\system32\iernonce.dll
2017-09-13 17:32:06 ----A---- C:\Windows\system32\ieetwproxystub.dll
2017-09-13 17:32:06 ----A---- C:\Windows\system32\ieetwcollector.exe
2017-09-13 17:32:05 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2017-09-13 17:32:05 ----A---- C:\Windows\SYSWOW64\ole32.dll
2017-09-13 17:32:05 ----A---- C:\Windows\SYSWOW64\ntprint.exe
2017-09-13 17:32:05 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2017-09-13 17:32:05 ----A---- C:\Windows\system32\smss.exe
2017-09-13 17:32:05 ----A---- C:\Windows\system32\schannel.dll
2017-09-13 17:32:05 ----A---- C:\Windows\system32\rpcss.dll
2017-09-13 17:32:05 ----A---- C:\Windows\system32\rpcrt4.dll
2017-09-13 17:32:05 ----A---- C:\Windows\system32\ntprint.exe
2017-09-13 17:32:05 ----A---- C:\Windows\system32\netbtugc.exe
2017-09-13 17:32:05 ----A---- C:\Windows\system32\lsasrv.dll
2017-09-13 17:32:05 ----A---- C:\Windows\system32\kernel32.dll
2017-09-13 17:32:05 ----A---- C:\Windows\system32\kerberos.dll
2017-09-13 17:32:05 ----A---- C:\Windows\system32\inetpp.dll
2017-09-13 17:32:05 ----A---- C:\Windows\system32\ieapfltr.dll
2017-09-13 17:32:05 ----A---- C:\Windows\system32\ExplorerFrame.dll
2017-09-13 17:32:05 ----A---- C:\Windows\system32\drivers\srv2.sys
2017-09-13 17:32:05 ----A---- C:\Windows\system32\drivers\srv.sys
2017-09-13 17:32:05 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2017-09-13 17:32:05 ----A---- C:\Windows\system32\advapi32.dll
2017-09-13 17:32:04 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2017-09-13 17:32:04 ----A---- C:\Windows\SYSWOW64\netbtugc.exe
2017-09-13 17:32:04 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2017-09-13 17:32:04 ----A---- C:\Windows\SYSWOW64\advapi32.dll
2017-09-13 17:32:04 ----A---- C:\Windows\system32\wow64win.dll
2017-09-13 17:32:04 ----A---- C:\Windows\system32\winsrv.dll
2017-09-13 17:32:04 ----A---- C:\Windows\system32\srcore.dll
2017-09-13 17:32:04 ----A---- C:\Windows\system32\ncrypt.dll
2017-09-13 17:32:04 ----A---- C:\Windows\system32\msv1_0.dll
2017-09-13 17:32:04 ----A---- C:\Windows\system32\KernelBase.dll
2017-09-13 17:32:04 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2017-09-13 17:32:03 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2017-09-13 17:32:03 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2017-09-13 17:32:03 ----A---- C:\Windows\SYSWOW64\schannel.dll
2017-09-13 17:32:03 ----A---- C:\Windows\SYSWOW64\rpchttp.dll
2017-09-13 17:32:03 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2017-09-13 17:32:03 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2017-09-13 17:32:03 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2017-09-13 17:32:03 ----A---- C:\Windows\SYSWOW64\ExplorerFrame.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\wow64.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\wdigest.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\TSpkg.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\sspisrv.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\sspicli.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\secur32.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\rpchttp.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\lsass.exe
2017-09-13 17:32:03 ----A---- C:\Windows\system32\inetppui.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2017-09-13 17:32:03 ----A---- C:\Windows\system32\drivers\appid.sys
2017-09-13 17:32:03 ----A---- C:\Windows\system32\csrsrv.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\cryptbase.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\conhost.exe
2017-09-13 17:32:03 ----A---- C:\Windows\system32\bcrypt.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-09-13 17:32:02 ----A---- C:\Windows\SYSWOW64\wow32.dll
2017-09-13 17:32:02 ----A---- C:\Windows\SYSWOW64\srclient.dll
2017-09-13 17:32:02 ----A---- C:\Windows\SYSWOW64\secur32.dll
2017-09-13 17:32:02 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2017-09-13 17:32:02 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2017-09-13 17:32:02 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2017-09-13 17:32:02 ----A---- C:\Windows\SYSWOW64\credssp.dll
2017-09-13 17:32:02 ----A---- C:\Windows\SYSWOW64\comcat.dll
2017-09-13 17:32:02 ----A---- C:\Windows\SYSWOW64\bcrypt.dll
2017-09-13 17:32:02 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2017-09-13 17:32:02 ----A---- C:\Windows\SYSWOW64\appidapi.dll
2017-09-13 17:32:02 ----A---- C:\Windows\system32\wpnpinst.exe
2017-09-13 17:32:02 ----A---- C:\Windows\system32\wow64cpu.dll
2017-09-13 17:32:02 ----A---- C:\Windows\system32\srclient.dll
2017-09-13 17:32:02 ----A---- C:\Windows\system32\setbcdlocale.dll
2017-09-13 17:32:02 ----A---- C:\Windows\system32\rstrui.exe
2017-09-13 17:32:02 ----A---- C:\Windows\system32\ntvdm64.dll
2017-09-13 17:32:02 ----A---- C:\Windows\system32\credssp.dll
2017-09-13 17:32:02 ----A---- C:\Windows\system32\comcat.dll
2017-09-13 17:32:02 ----A---- C:\Windows\system32\auditpol.exe
2017-09-13 17:32:02 ----A---- C:\Windows\system32\appidsvc.dll
2017-09-13 17:32:02 ----A---- C:\Windows\system32\appidpolicyconverter.exe
2017-09-13 17:32:02 ----A---- C:\Windows\system32\appidcertstorecheck.exe
2017-09-13 17:32:02 ----A---- C:\Windows\system32\appidapi.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-09-13 17:32:00 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2017-09-13 17:32:00 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2017-09-13 17:32:00 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2017-09-13 17:32:00 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2017-09-13 17:32:00 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2017-09-13 17:32:00 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-09-13 17:32:00 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-09-13 17:32:00 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-09-13 17:32:00 ----A---- C:\Windows\SYSWOW64\setup16.exe
2017-09-13 17:32:00 ----A---- C:\Windows\SYSWOW64\instnm.exe
2017-09-13 17:32:00 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2017-09-13 17:32:00 ----A---- C:\Windows\system32\PrintBrmUi.exe
2017-09-13 17:32:00 ----A---- C:\Windows\system32\apisetschema.dll
2017-09-13 17:31:59 ----A---- C:\Windows\SYSWOW64\user.exe
2017-09-13 17:31:58 ----A---- C:\Windows\SYSWOW64\oleres.dll
2017-09-13 17:31:58 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2017-09-13 17:31:58 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2017-09-13 17:31:58 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2017-09-13 17:31:58 ----A---- C:\Windows\system32\oleres.dll
2017-09-13 17:31:58 ----A---- C:\Windows\system32\msobjs.dll
2017-09-13 17:31:58 ----A---- C:\Windows\system32\msaudite.dll
2017-09-13 17:31:58 ----A---- C:\Windows\system32\adtschema.dll
2017-09-09 08:52:31 ----D---- C:\Program Files (x86)\Nend Software

======List of files/folders modified in the last 1 month======

2017-10-08 20:27:15 ----D---- C:\Program Files\trend micro
2017-10-08 20:25:57 ----D---- C:\Users\Peter\AppData\Roaming\uTorrent
2017-10-08 20:10:22 ----D---- C:\Windows\Temp
2017-10-08 16:39:10 ----D---- C:\Windows\system32\config
2017-10-08 15:55:37 ----D---- C:\Windows\Prefetch
2017-10-08 15:54:05 ----D---- C:\ProgramData\ProductData
2017-10-08 15:53:51 ----D---- C:\Windows
2017-10-08 15:53:51 ----AD---- C:\Program Files (x86)\BlueStacks
2017-10-08 15:49:04 ----D---- C:\AdwCleaner
2017-10-08 14:34:27 ----D---- C:\Windows\inf
2017-10-08 14:31:54 ----D---- C:\Users\Peter\AppData\Roaming\IDM
2017-10-08 08:07:21 ----D---- C:\Windows\SYSWOW64\Macromed
2017-10-07 17:25:05 ----D---- C:\Windows\system32\drivers
2017-10-07 17:20:26 ----RD---- C:\Program Files
2017-10-07 17:20:26 ----D---- C:\Windows\System32
2017-10-07 17:20:23 ----D---- C:\Windows\system32\DriverStore
2017-10-07 16:55:20 ----D---- C:\Users\Peter\AppData\Roaming\Charles
2017-10-06 16:22:51 ----SHD---- C:\System Volume Information
2017-10-05 16:36:09 ----D---- C:\Windows\Registration
2017-10-05 16:35:50 ----RD---- C:\Program Files (x86)
2017-10-05 16:33:06 ----HD---- C:\ProgramData
2017-10-01 10:05:17 ----D---- C:\Windows\system32\Tasks
2017-09-30 08:09:52 ----D---- C:\Users\Peter\AppData\Roaming\DMCache
2017-09-30 06:59:46 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2017-09-29 21:11:58 ----D---- C:\Program Files (x86)\Mozilla Firefox
2017-09-22 20:37:12 ----D---- C:\Program Files\CCleaner
2017-09-21 05:39:30 ----D---- C:\Windows\debug
2017-09-17 14:01:26 ----D---- C:\Program Files (x86)\DLL Suite
2017-09-17 02:49:07 ----D---- C:\Windows\system32\wdi
2017-09-15 09:34:15 ----D---- C:\Program Files (x86)\TeamViewer
2017-09-15 03:57:27 ----D---- C:\Windows\rescache
2017-09-14 21:19:39 ----D---- C:\Windows\Microsoft.NET
2017-09-14 20:29:48 ----RSD---- C:\Windows\assembly
2017-09-14 05:48:23 ----A---- C:\Windows\system32\PerfStringBackup.INI
2017-09-14 05:43:05 ----D---- C:\Windows\winsxs
2017-09-14 05:39:46 ----D---- C:\Program Files\Internet Explorer
2017-09-14 05:39:45 ----D---- C:\Windows\SYSWOW64\sk-SK
2017-09-14 05:39:45 ----D---- C:\Windows\SYSWOW64\en-US
2017-09-14 05:39:45 ----D---- C:\Program Files (x86)\Internet Explorer
2017-09-14 05:39:44 ----D---- C:\Windows\SysWOW64
2017-09-14 05:39:41 ----D---- C:\Windows\system32\sk-SK
2017-09-14 05:39:41 ----D---- C:\Windows\system32\en-US
2017-09-14 05:39:37 ----D---- C:\Windows\AppPatch
2017-09-14 05:39:36 ----D---- C:\Windows\system32\Boot
2017-09-14 05:37:32 ----D---- C:\Users\Peter\AppData\Roaming\IObit
2017-09-14 05:11:09 ----D---- C:\Windows\system32\MRT
2017-09-14 05:06:15 ----AC---- C:\Windows\system32\MRT.exe
2017-09-14 04:57:33 ----SHD---- C:\Windows\Installer
2017-09-14 04:53:33 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2017-09-13 17:27:28 ----D---- C:\Windows\system32\catroot2
2017-09-12 19:28:24 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2017-09-12 19:28:20 ----D---- C:\Windows\system32\Macromed

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 SmartDefragDriver;SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [2017-03-09 30744]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 199552]
R1 adgnetworkwfpdrv;adgnetworkwfpdrv; C:\Windows\system32\drivers\adgnetworkwfpdrv.sys [2017-03-27 70384]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 514560]
R1 dsnpfd;DeskSoft LightWeight Filter; C:\Windows\system32\DRIVERS\dsnpfd.sys [2017-02-22 37576]
R1 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2017-06-22 132824]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2017-05-04 178056]
R1 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2017-05-04 77224]
R1 HWiNFO32;HWiNFO32/64 Kernel Driver; \??\C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [2016-11-26 27552]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver; C:\Windows\system32\DRIVERS\VBoxUSBMon.sys [2017-10-05 144656]
R1 YSDrv;VBox Support Driver; \??\C:\Program Files (x86)\Bignox\BigNoxVM\RT\YSDrv.sys [2017-10-05 270608]
R2 IDMWFP;IDMWFP; C:\Windows\system32\DRIVERS\idmwfp.sys [2017-08-05 225568]
R3 dtultrascsibus;DAEMON Tools Ultra Virtual SCSI Bus; C:\Windows\system32\DRIVERS\dtultrascsibus.sys [2017-01-25 30264]
R3 dtultrausbbus;DAEMON Tools Ultra Virtual USB Bus; C:\Windows\system32\DRIVERS\dtultrausbbus.sys [2017-01-25 47672]
R3 ETDSMBus;ETDSMBus; C:\Windows\system32\DRIVERS\ETDSMBus.sys [2017-08-08 32840]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys [2016-11-26 15416]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys [2015-02-20 197408]
R3 P17;SB 5.1 VX; C:\Windows\system32\drivers\P17.sys [2016-11-26 1309696]
R3 tap0901;TAP-Windows Adapter V9; C:\Windows\system32\DRIVERS\tap0901.sys [2016-04-21 27136]
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudbus.sys [2016-12-03 129152]
S3 dtlitescsibus;DAEMON Tools Lite Virtual SCSI Bus; C:\Windows\system32\DRIVERS\dtlitescsibus.sys [2016-12-22 30264]
S3 dtliteusbbus;DAEMON Tools Lite Virtual USB Bus; C:\Windows\system32\DRIVERS\dtliteusbbus.sys [2016-12-22 47672]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 165888]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 6656]
S3 SANDRA;SANDRA; \??\C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2015.SP1a\WNt600x64\Sandra.sys [2009-08-07 23112]
S3 SmbDrvI;SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [2016-11-26 33960]
S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudmdm.sys [2016-12-14 221824]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 34688]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
S3 VBoxUSB;VirtualBox USB; C:\Windows\System32\Drivers\VBoxUSB.sys [2017-10-05 131856]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 21760]
S3 WinUsb;SAMSUNG Android USB Driver; C:\Windows\system32\DRIVERS\WinUSB.sys [2010-11-20 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2017-07-19 83032]
R2 BWMeterConSvc;BWMeter Connections Service; C:\Program Files (x86)\BWMeter\BWMeterConSvc.exe [2017-02-22 126976]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 CTAudSvcService;Creative Audio Service; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [2008-11-18 307200]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2017-06-13 2625368]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2016-11-14 932728]
R2 OkayFreedom VPN Starter Service;OkayFreedom VPN Starter Service; C:\Program Files (x86)\OkayFreedom\OkayFreedomService.exe [2017-03-02 355328]
R2 TeamViewer;TeamViewer 12; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [2016-11-28 10216688]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2017-04-21 107656]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2017-04-21 128648]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-11-26 153752]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-09-12 272384]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2016-11-26 79360]
S3 Disc Soft Ultra Bus Service;Disc Soft Ultra Bus Service; C:\Users\Peter\DAEMON Tools Ultra\DiscSoftBusServiceUltra.exe [2016-12-12 4854464]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-11-26 153752]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2017-08-13 116224]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2017-09-29 175568]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 SandraAgentSrv;SiSoftware Deployment Agent Service; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2015.SP1a\RpcAgentSrv.exe [2015-03-17 73200]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2017-06-10 1255736]
S4 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2017-04-21 52856]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-04-21 136312]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-04-21 136312]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-04-21 136312]

-----------------EOF-----------------

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 118197
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: Prosím o kontrolu - Zasekaný PC

#6 Příspěvek od Rudy »

Stáhněte OTM: http://oldtimer.geekstogo.com/OTM.exe a uložte na plochu. Spusťte a do levého okna zkopírujte:
:files
C:\Users\Peter\AppData\Local\Temp\Google Updates\seachEn.exe
C:\Users\Peter\AppData\Local\Temp\WinUpdat.vbs

:reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"WinUpdat"=-

:commands
[Purity]
[Emptytemp]
[Emptyflash]
a klikněte na >MoveIt!<. Po skenu restartujte PC a dejte nový log RSIT.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

PureHate44
Návštěvník
Návštěvník
Příspěvky: 154
Registrován: 28 čer 2011 17:49

Re: Prosím o kontrolu - Zasekaný PC

#7 Příspěvek od PureHate44 »

All processes killed
========== FILES ==========
File/Folder C:\Users\Peter\AppData\Local\Temp\Google Updates\seachEn.exe not found.
File/Folder C:\Users\Peter\AppData\Local\Temp\WinUpdat.vbs not found.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\WinUpdat not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Peter
->Temp folder emptied: 64143231 bytes
->Temporary Internet Files folder emptied: 388736 bytes
->FireFox cache emptied: 10427538 bytes
->Google Chrome cache emptied: 280679384 bytes
->Flash cache emptied: 506 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 257 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 836 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 35754 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 58525348 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 395,00 mb


[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: Peter
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0,00 mb


OTM by OldTimer - Version 3.1.21.0 log created on 10092017_053012

Files moved on Reboot...
C:\Users\Peter\AppData\Local\Temp\NVIDIA Corporation\NV_Cache\b9928bf7aa10148369087e55f224ad6b_fce8394c8fd8a807_6229ccd76215aea1_0_0.bin moved successfully.
C:\Users\Peter\AppData\Local\Temp\NVIDIA Corporation\NV_Cache\b9928bf7aa10148369087e55f224ad6b_fce8394c8fd8a807_6229ccd76215aea1_0_0.toc moved successfully.
C:\Users\Peter\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Peter\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.

Registry entries deleted on Reboot...

PureHate44
Návštěvník
Návštěvník
Příspěvky: 154
Registrován: 28 čer 2011 17:49

Re: Prosím o kontrolu - Zasekaný PC

#8 Příspěvek od PureHate44 »

Logfile of random's system information tool 1.10 (written by random/random)
Run by Peter at 2017-10-09 05:36:58
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 25 GB (12%) free of 200 GB
Total RAM: 4095 MB (48% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 5:37:11, on 9. 10. 2017
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18792)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\IObit\Smart Defrag\SmartDefrag.exe
C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
C:\Users\Peter\AppData\Roaming\uTorrent\uTorrent.exe
C:\Users\Peter\AppData\Local\Facebook\Games\FacebookGameroom.exe
C:\Program Files (x86)\OkayFreedom\OkayFreedomClient.exe
C:\Users\Peter\AppData\Roaming\uTorrent\VirusGuard\BitTorrentAntivirus.exe
C:\Program Files\trend micro\Peter.exe
C:\Users\Peter\AppData\Local\Facebook\Games\Facebook Gameroom Browser.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O1 - Hosts: ::1 localhost
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll
O4 - HKCU\..\Run: [IDMan] C:\Program Files (x86)\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [uTorrent] "C:\Users\Peter\AppData\Roaming\uTorrent\uTorrent.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 (User 'Default user')
O4 - Startup: Facebook Gameroom.lnk = Peter\AppData\Local\Facebook\Games\FacebookGameroom.exe
O4 - Startup: GoogleUpdate.lnk = C:\Users\Peter\AppData\Local\Temp\Google Updates\seachEn.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\Program Files\Microsoft Office\Root\Office16\ONBttnIE.dll/105
O8 - Extra context menu item: Stiahnuť s IDM - C:\Program Files (x86)\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Stiahnuť s IDM všetky prepojenia - C:\Program Files (x86)\Internet Download Manager\IEGetAll.htm
O9 - Extra button: Fiddler - {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - "C:\Program Files (x86)\Fiddler2\Fiddler.exe" (file missing)
O9 - Extra 'Tools' menuitem: Fiddler - {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - "C:\Program Files (x86)\Fiddler2\Fiddler.exe" (file missing)
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: http://help.eset.com (HKLM)
O15 - ESC Trusted Zone: http://help.eset.com (HKLM)
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: BWMeter Connections Service (BWMeterConSvc) - Unknown owner - C:\Program Files (x86)\BWMeter\BWMeterConSvc.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
O23 - Service: Disc Soft Ultra Bus Service - Disc Soft Ltd - C:\Users\Peter\DAEMON Tools Ultra\DiscSoftBusServiceUltra.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: OkayFreedom VPN Starter Service - Steganos Software GmbH - C:\Program Files (x86)\OkayFreedom\OkayFreedomService.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2015.SP1a\RpcAgentSrv.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: TeamViewer 12 (TeamViewer) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8884 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
"C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe"
"C:\Windows\system32\nvvsvc.exe"
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs

"C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe"
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
taskeng.exe {C0383BB5-B128-4F0B-8DEB-B2BE73A386AB}
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
C:\Windows\AutoKMS\AutoKMS.exe
\??\C:\Windows\system32\conhost.exe "-589867025-236016277595771244-1535790683955956982-527741610657927726-1409462610
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"taskhost.exe"
"C:\Program Files (x86)\BWMeter\BWMeterConSvc.exe"
C:\Windows\System32\svchost.exe -k utcsvc
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
taskeng.exe {ED909009-B0CF-4510-B6E0-8D31F4165F71}
"C:\Program Files (x86)\IObit\Smart Defrag\SmartDefrag.exe" /STARTUP
"C:\Program Files (x86)\OkayFreedom\OkayFreedomService.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide
"C:/Program Files/NVIDIA Corporation/Display/nvtray.exe" -user_has_logged_in 1"
"C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
"C:\Users\Peter\AppData\Roaming\uTorrent\uTorrent.exe"
"C:\Users\Peter\AppData\Local\Facebook\Games\FacebookGameroom.exe" fbgames://windows_startup/
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\sppsvc.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Peter\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Peter\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=61.0.3163.100 --initial-client-data=0x80,0x84,0x88,0x7c,0x8c,0x7fedf961988,0x7fedf961948,0x7fedf961958
"C:\Program Files (x86)\OkayFreedom\OkayFreedomClient.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=3996 --on-initialized-event-handle=312 --parent-handle=316 /prefetch:6
"C:\Users\Peter\AppData\Roaming\uTorrent\VirusGuard\BitTorrentAntivirus.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1128,17778199882799575549,15864554826346848879,131072 --disable-direct-composition --supports-dual-gpus=false --gpu-driver-bug-workarounds=9,12,13,20,22,23,24,27,49,84 --disable-gl-extensions="GL_KHR_blend_equation_advanced GL_KHR_blend_equation_advanced_coherent" --gpu-vendor-id=0x10de --gpu-device-id=0x0a65 --gpu-driver-vendor=NVIDIA --gpu-driver-version=21.21.13.4201 --gpu-driver-date=11-14-2016 --service-request-channel-token=28D7C22CBC6772CA4117799AF947EA05 --mojo-platform-channel-handle=1120 --ignored=" --type=renderer " /prefetch:2
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,17778199882799575549,15864554826346848879,131072 --service-pipe-token=57C4F53D30CB09A5C0086D554B3A49FE --lang=sk --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=57C4F53D30CB09A5C0086D554B3A49FE --renderer-client-id=8 --mojo-platform-channel-handle=2036 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,17778199882799575549,15864554826346848879,131072 --service-pipe-token=7D41FC4A7DA4AB0812BB10472AAA1151 --lang=sk --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=7D41FC4A7DA4AB0812BB10472AAA1151 --renderer-client-id=4 --mojo-platform-channel-handle=2592 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,17778199882799575549,15864554826346848879,131072 --service-pipe-token=0A9648E3E5BD88A9A9B48254C3639F68 --lang=sk --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=0A9648E3E5BD88A9A9B48254C3639F68 --renderer-client-id=5 --mojo-platform-channel-handle=2704 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,17778199882799575549,15864554826346848879,131072 --service-pipe-token=A6B903FF90C6A7CA995709C7DD2F09D8 --lang=sk --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=A6B903FF90C6A7CA995709C7DD2F09D8 --renderer-client-id=6 --mojo-platform-channel-handle=2808 /prefetch:1
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,17778199882799575549,15864554826346848879,131072 --service-pipe-token=F23C17F93683571E15F4B3509C1606D3 --lang=sk --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=F23C17F93683571E15F4B3509C1606D3 --renderer-client-id=11 --mojo-platform-channel-handle=4696 /prefetch:1
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1762337417-2231521048-3039012980-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1762337417-2231521048-3039012980-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
"C:\Windows\system32\SearchFilterHost.exe" 0 520 524 532 65536 528
"C:\Users\Peter\Desktop\RSITx64.exe"
"Facebook Gameroom Browser.exe" --type=gpu-process --no-sandbox --lang=en-US --log-file="C:\Users\Peter\AppData\Local\Facebook\Games\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 CanvasFrame/1.8.6429.23271 Safari/537.36 FacebookCanvasDesktop FBAN/GamesWindowsDesktopApp FBAV/1.8.6429.23271" --disable-direct-composition --supports-dual-gpus=false --gpu-driver-bug-workarounds=7,10,18,19,20,23,41,74 --disable-gl-extensions="GL_KHR_blend_equation_advanced GL_KHR_blend_equation_advanced_coherent" --gpu-vendor-id=0x10de --gpu-device-id=0x0a65 --gpu-driver-vendor=NVIDIA --gpu-driver-version=21.21.13.4201 --gpu-driver-date=11-14-2016 --lang=en-US --log-file="C:\Users\Peter\AppData\Local\Facebook\Games\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 CanvasFrame/1.8.6429.23271 Safari/537.36 FacebookCanvasDesktop FBAN/GamesWindowsDesktopApp FBAV/1.8.6429.23271" --service-request-channel-token=E8941B09C6D9490CF09EC552CCAF215A --mojo-platform-channel-handle=2440 /prefetch:2

======Scheduled tasks folder======

C:\Windows\tasks\DLLSuite(022217131052).job - C:\Program Files (x86)\DLL Suite\DLLSuite.exe -s

=========Mozilla firefox=========

ProfilePath - C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\o6yasy6y.default-1506712320144

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 27.0.0.130 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_27_0_0_130.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3528.0331]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.2.4]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 27.0.0.130 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_27_0_0_130.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled


======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}]
IDM integration (IDMIEHlprObj Class) - C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll [2017-09-22 527928]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}]
IDM integration (IDMIEHlprObj Class) - C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll [2017-09-22 453688]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvBackend"=C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2015-02-20 1793736]
"WinUpdat"=wscript.exe //B C:\Users\Peter\AppData\Local\Temp\WinUpdat.vbs []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"IDMan"=C:\Program Files (x86)\Internet Download Manager\IDMan.exe [2017-10-03 4035696]
"uTorrent"=C:\Users\Peter\AppData\Roaming\uTorrent\uTorrent.exe [2017-05-12 2469376]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Ultra Agent]
C:\Users\Peter\DAEMON Tools Ultra\DTAgent.exe [2016-12-12 5021888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OKAYFREEDOM Notifier]
C:\Program Files (x86)\OkayFreedom\Notifier.exe [2017-03-02 4199408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OKAYFREEDOM_Agent]
C:\Program Files (x86)\OkayFreedom\OkayFreedomClient.exe [2017-03-02 6580208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify]
C:\Users\Peter\AppData\Roaming\Spotify\Spotify.exe [2017-05-02 7064176]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify Web Helper]
C:\Users\Peter\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2017-05-02 1446000]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
C:\Users\Peter\AppData\Roaming\uTorrent\uTorrent.exe [2017-05-12 2469376]

C:\Users\Peter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Facebook Gameroom.lnk - C:\Users\Peter\AppData\Local\Facebook\Games\FacebookGameroom.exe
GoogleUpdate.lnk - C:\Users\Peter\AppData\Local\Temp\Google Updates\seachEn.exe

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MBAMService]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files (x86)\xchat\xchat.exe"="C:\Program Files (x86)\xchat\xchat.exe:*:Enabled:XChat IRC Client"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"aux3"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave5"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer5"=wdmaud.drv
"wave6"=wdmaud.drv
"midi6"=wdmaud.drv
"mixer6"=wdmaud.drv
"wave7"=wdmaud.drv
"midi7"=wdmaud.drv
"mixer7"=wdmaud.drv
"wave8"=wdmaud.drv
"midi8"=wdmaud.drv
"mixer8"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2017-10-07 17:20:27 ----A---- C:\Windows\system32\drivers\VBoxUSBMon.sys
2017-10-07 17:20:26 ----DC---- C:\Windows\system32\DRVSTORE
2017-10-07 17:20:26 ----D---- C:\Program Files\DIFX
2017-10-06 18:17:03 ----A---- C:\Windows\system32\drivers\idmwfp.sys
2017-10-05 16:35:53 ----A---- C:\Windows\system32\drivers\VBoxUSB.sys
2017-10-05 16:35:50 ----D---- C:\Program Files (x86)\Bignox
2017-10-05 16:34:26 ----D---- C:\Program Files (x86)\Nox
2017-09-29 21:41:40 ----D---- C:\Program Files\TapinRadio
2017-09-14 04:49:21 ----SHD---- C:\Config.Msi
2017-09-13 17:32:29 ----A---- C:\Windows\system32\mshtml.dll
2017-09-13 17:32:26 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2017-09-13 17:32:21 ----A---- C:\Windows\system32\ieframe.dll
2017-09-13 17:32:19 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2017-09-13 17:32:19 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2017-09-13 17:32:19 ----A---- C:\Windows\system32\jscript9.dll
2017-09-13 17:32:18 ----A---- C:\Windows\SYSWOW64\wininet.dll
2017-09-13 17:32:18 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2017-09-13 17:32:18 ----A---- C:\Windows\system32\wininet.dll
2017-09-13 17:32:18 ----A---- C:\Windows\system32\iertutil.dll
2017-09-13 17:32:18 ----A---- C:\Windows\system32\DXPTaskRingtone.dll
2017-09-13 17:32:17 ----A---- C:\Windows\SYSWOW64\DXPTaskRingtone.dll
2017-09-13 17:32:17 ----A---- C:\Windows\system32\win32k.sys
2017-09-13 17:32:17 ----A---- C:\Windows\system32\shell32.dll
2017-09-13 17:32:16 ----A---- C:\Windows\system32\urlmon.dll
2017-09-13 17:32:16 ----A---- C:\Windows\system32\mmcndmgr.dll
2017-09-13 17:32:16 ----A---- C:\Windows\system32\mmc.exe
2017-09-13 17:32:15 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2017-09-13 17:32:15 ----A---- C:\Windows\SYSWOW64\shell32.dll
2017-09-13 17:32:15 ----A---- C:\Windows\system32\msfeeds.dll
2017-09-13 17:32:14 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2017-09-13 17:32:14 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2017-09-13 17:32:14 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2017-09-13 17:32:14 ----A---- C:\Windows\system32\ntoskrnl.exe
2017-09-13 17:32:13 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2017-09-13 17:32:13 ----A---- C:\Windows\SYSWOW64\mmcndmgr.dll
2017-09-13 17:32:13 ----A---- C:\Windows\SYSWOW64\mmc.exe
2017-09-13 17:32:13 ----A---- C:\Windows\system32\localspl.dll
2017-09-13 17:32:12 ----A---- C:\Windows\SYSWOW64\Wldap32.dll
2017-09-13 17:32:12 ----A---- C:\Windows\SYSWOW64\win32spl.dll
2017-09-13 17:32:12 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2017-09-13 17:32:12 ----A---- C:\Windows\system32\Wldap32.dll
2017-09-13 17:32:12 ----A---- C:\Windows\system32\win32spl.dll
2017-09-13 17:32:12 ----A---- C:\Windows\system32\usp10.dll
2017-09-13 17:32:12 ----A---- C:\Windows\system32\iedkcs32.dll
2017-09-13 17:32:12 ----A---- C:\Windows\system32\ie4uinit.exe
2017-09-13 17:32:11 ----A---- C:\Windows\SYSWOW64\usp10.dll
2017-09-13 17:32:11 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2017-09-13 17:32:11 ----A---- C:\Windows\system32\nsisvc.dll
2017-09-13 17:32:11 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2017-09-13 17:32:11 ----A---- C:\Windows\system32\mmcbase.dll
2017-09-13 17:32:11 ----A---- C:\Windows\system32\drivers\srvnet.sys
2017-09-13 17:32:11 ----A---- C:\Windows\system32\drivers\netbt.sys
2017-09-13 17:32:11 ----A---- C:\Windows\system32\cic.dll
2017-09-13 17:32:10 ----A---- C:\Windows\SYSWOW64\ntprint.dll
2017-09-13 17:32:10 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2017-09-13 17:32:10 ----A---- C:\Windows\system32\webcheck.dll
2017-09-13 17:32:10 ----A---- C:\Windows\system32\ntprint.dll
2017-09-13 17:32:10 ----A---- C:\Windows\system32\ntdll.dll
2017-09-13 17:32:10 ----A---- C:\Windows\system32\mmcshext.dll
2017-09-13 17:32:10 ----A---- C:\Windows\system32\drivers\nsiproxy.sys
2017-09-13 17:32:10 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2017-09-13 17:32:10 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2017-09-13 17:32:08 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2017-09-13 17:32:08 ----A---- C:\Windows\SYSWOW64\shdocvw.dll
2017-09-13 17:32:08 ----A---- C:\Windows\SYSWOW64\msrating.dll
2017-09-13 17:32:08 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2017-09-13 17:32:08 ----A---- C:\Windows\SYSWOW64\mmcshext.dll
2017-09-13 17:32:08 ----A---- C:\Windows\SYSWOW64\mmcbase.dll
2017-09-13 17:32:08 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2017-09-13 17:32:08 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2017-09-13 17:32:08 ----A---- C:\Windows\SYSWOW64\cic.dll
2017-09-13 17:32:08 ----A---- C:\Windows\SYSWOW64\certcli.dll
2017-09-13 17:32:08 ----A---- C:\Windows\system32\winnsi.dll
2017-09-13 17:32:08 ----A---- C:\Windows\system32\shdocvw.dll
2017-09-13 17:32:08 ----A---- C:\Windows\system32\msrating.dll
2017-09-13 17:32:08 ----A---- C:\Windows\system32\mshtmled.dll
2017-09-13 17:32:08 ----A---- C:\Windows\system32\dxtrans.dll
2017-09-13 17:32:08 ----A---- C:\Windows\system32\dxtmsft.dll
2017-09-13 17:32:08 ----A---- C:\Windows\system32\certcli.dll
2017-09-13 17:32:07 ----A---- C:\Windows\SYSWOW64\winnsi.dll
2017-09-13 17:32:07 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2017-09-13 17:32:07 ----A---- C:\Windows\SYSWOW64\ieui.dll
2017-09-13 17:32:07 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2017-09-13 17:32:07 ----A---- C:\Windows\system32\nsi.dll
2017-09-13 17:32:07 ----A---- C:\Windows\system32\mshtmlmedia.dll
2017-09-13 17:32:07 ----A---- C:\Windows\system32\jscript9diag.dll
2017-09-13 17:32:07 ----A---- C:\Windows\system32\ieui.dll
2017-09-13 17:32:07 ----A---- C:\Windows\system32\iesetup.dll
2017-09-13 17:32:06 ----A---- C:\Windows\SYSWOW64\occache.dll
2017-09-13 17:32:06 ----A---- C:\Windows\SYSWOW64\nsi.dll
2017-09-13 17:32:06 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2017-09-13 17:32:06 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2017-09-13 17:32:06 ----A---- C:\Windows\SYSWOW64\jscript.dll
2017-09-13 17:32:06 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2017-09-13 17:32:06 ----A---- C:\Windows\SYSWOW64\inseng.dll
2017-09-13 17:32:06 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2017-09-13 17:32:06 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2017-09-13 17:32:06 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2017-09-13 17:32:06 ----A---- C:\Windows\system32\vbscript.dll
2017-09-13 17:32:06 ----A---- C:\Windows\system32\ole32.dll
2017-09-13 17:32:06 ----A---- C:\Windows\system32\occache.dll
2017-09-13 17:32:06 ----A---- C:\Windows\system32\MshtmlDac.dll
2017-09-13 17:32:06 ----A---- C:\Windows\system32\jsproxy.dll
2017-09-13 17:32:06 ----A---- C:\Windows\system32\jscript.dll
2017-09-13 17:32:06 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-09-13 17:32:06 ----A---- C:\Windows\system32\inseng.dll
2017-09-13 17:32:06 ----A---- C:\Windows\system32\ieUnatt.exe
2017-09-13 17:32:06 ----A---- C:\Windows\system32\iernonce.dll
2017-09-13 17:32:06 ----A---- C:\Windows\system32\ieetwproxystub.dll
2017-09-13 17:32:06 ----A---- C:\Windows\system32\ieetwcollector.exe
2017-09-13 17:32:05 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2017-09-13 17:32:05 ----A---- C:\Windows\SYSWOW64\ole32.dll
2017-09-13 17:32:05 ----A---- C:\Windows\SYSWOW64\ntprint.exe
2017-09-13 17:32:05 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2017-09-13 17:32:05 ----A---- C:\Windows\system32\smss.exe
2017-09-13 17:32:05 ----A---- C:\Windows\system32\schannel.dll
2017-09-13 17:32:05 ----A---- C:\Windows\system32\rpcss.dll
2017-09-13 17:32:05 ----A---- C:\Windows\system32\rpcrt4.dll
2017-09-13 17:32:05 ----A---- C:\Windows\system32\ntprint.exe
2017-09-13 17:32:05 ----A---- C:\Windows\system32\netbtugc.exe
2017-09-13 17:32:05 ----A---- C:\Windows\system32\lsasrv.dll
2017-09-13 17:32:05 ----A---- C:\Windows\system32\kernel32.dll
2017-09-13 17:32:05 ----A---- C:\Windows\system32\kerberos.dll
2017-09-13 17:32:05 ----A---- C:\Windows\system32\inetpp.dll
2017-09-13 17:32:05 ----A---- C:\Windows\system32\ieapfltr.dll
2017-09-13 17:32:05 ----A---- C:\Windows\system32\ExplorerFrame.dll
2017-09-13 17:32:05 ----A---- C:\Windows\system32\drivers\srv2.sys
2017-09-13 17:32:05 ----A---- C:\Windows\system32\drivers\srv.sys
2017-09-13 17:32:05 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2017-09-13 17:32:05 ----A---- C:\Windows\system32\advapi32.dll
2017-09-13 17:32:04 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2017-09-13 17:32:04 ----A---- C:\Windows\SYSWOW64\netbtugc.exe
2017-09-13 17:32:04 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2017-09-13 17:32:04 ----A---- C:\Windows\SYSWOW64\advapi32.dll
2017-09-13 17:32:04 ----A---- C:\Windows\system32\wow64win.dll
2017-09-13 17:32:04 ----A---- C:\Windows\system32\winsrv.dll
2017-09-13 17:32:04 ----A---- C:\Windows\system32\srcore.dll
2017-09-13 17:32:04 ----A---- C:\Windows\system32\ncrypt.dll
2017-09-13 17:32:04 ----A---- C:\Windows\system32\msv1_0.dll
2017-09-13 17:32:04 ----A---- C:\Windows\system32\KernelBase.dll
2017-09-13 17:32:04 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2017-09-13 17:32:03 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2017-09-13 17:32:03 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2017-09-13 17:32:03 ----A---- C:\Windows\SYSWOW64\schannel.dll
2017-09-13 17:32:03 ----A---- C:\Windows\SYSWOW64\rpchttp.dll
2017-09-13 17:32:03 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2017-09-13 17:32:03 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2017-09-13 17:32:03 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2017-09-13 17:32:03 ----A---- C:\Windows\SYSWOW64\ExplorerFrame.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\wow64.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\wdigest.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\TSpkg.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\sspisrv.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\sspicli.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\secur32.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\rpchttp.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\lsass.exe
2017-09-13 17:32:03 ----A---- C:\Windows\system32\inetppui.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2017-09-13 17:32:03 ----A---- C:\Windows\system32\drivers\appid.sys
2017-09-13 17:32:03 ----A---- C:\Windows\system32\csrsrv.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\cryptbase.dll
2017-09-13 17:32:03 ----A---- C:\Windows\system32\conhost.exe
2017-09-13 17:32:03 ----A---- C:\Windows\system32\bcrypt.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-09-13 17:32:02 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-09-13 17:32:02 ----A---- C:\Windows\SYSWOW64\wow32.dll
2017-09-13 17:32:02 ----A---- C:\Windows\SYSWOW64\srclient.dll
2017-09-13 17:32:02 ----A---- C:\Windows\SYSWOW64\secur32.dll
2017-09-13 17:32:02 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2017-09-13 17:32:02 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2017-09-13 17:32:02 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2017-09-13 17:32:02 ----A---- C:\Windows\SYSWOW64\credssp.dll
2017-09-13 17:32:02 ----A---- C:\Windows\SYSWOW64\comcat.dll
2017-09-13 17:32:02 ----A---- C:\Windows\SYSWOW64\bcrypt.dll
2017-09-13 17:32:02 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2017-09-13 17:32:02 ----A---- C:\Windows\SYSWOW64\appidapi.dll
2017-09-13 17:32:02 ----A---- C:\Windows\system32\wpnpinst.exe
2017-09-13 17:32:02 ----A---- C:\Windows\system32\wow64cpu.dll
2017-09-13 17:32:02 ----A---- C:\Windows\system32\srclient.dll
2017-09-13 17:32:02 ----A---- C:\Windows\system32\setbcdlocale.dll
2017-09-13 17:32:02 ----A---- C:\Windows\system32\rstrui.exe
2017-09-13 17:32:02 ----A---- C:\Windows\system32\ntvdm64.dll
2017-09-13 17:32:02 ----A---- C:\Windows\system32\credssp.dll
2017-09-13 17:32:02 ----A---- C:\Windows\system32\comcat.dll
2017-09-13 17:32:02 ----A---- C:\Windows\system32\auditpol.exe
2017-09-13 17:32:02 ----A---- C:\Windows\system32\appidsvc.dll
2017-09-13 17:32:02 ----A---- C:\Windows\system32\appidpolicyconverter.exe
2017-09-13 17:32:02 ----A---- C:\Windows\system32\appidcertstorecheck.exe
2017-09-13 17:32:02 ----A---- C:\Windows\system32\appidapi.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-09-13 17:32:01 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-09-13 17:32:00 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2017-09-13 17:32:00 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2017-09-13 17:32:00 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2017-09-13 17:32:00 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2017-09-13 17:32:00 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2017-09-13 17:32:00 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-09-13 17:32:00 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-09-13 17:32:00 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-09-13 17:32:00 ----A---- C:\Windows\SYSWOW64\setup16.exe
2017-09-13 17:32:00 ----A---- C:\Windows\SYSWOW64\instnm.exe
2017-09-13 17:32:00 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2017-09-13 17:32:00 ----A---- C:\Windows\system32\PrintBrmUi.exe
2017-09-13 17:32:00 ----A---- C:\Windows\system32\apisetschema.dll
2017-09-13 17:31:59 ----A---- C:\Windows\SYSWOW64\user.exe
2017-09-13 17:31:58 ----A---- C:\Windows\SYSWOW64\oleres.dll
2017-09-13 17:31:58 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2017-09-13 17:31:58 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2017-09-13 17:31:58 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2017-09-13 17:31:58 ----A---- C:\Windows\system32\oleres.dll
2017-09-13 17:31:58 ----A---- C:\Windows\system32\msobjs.dll
2017-09-13 17:31:58 ----A---- C:\Windows\system32\msaudite.dll
2017-09-13 17:31:58 ----A---- C:\Windows\system32\adtschema.dll

======List of files/folders modified in the last 1 month======

2017-10-09 05:37:04 ----D---- C:\Program Files\trend micro
2017-10-09 05:37:01 ----D---- C:\Windows\Temp
2017-10-09 05:36:31 ----D---- C:\Users\Peter\AppData\Roaming\uTorrent
2017-10-09 05:32:56 ----D---- C:\Program Files (x86)\Internet Download Manager
2017-10-09 05:30:46 ----D---- C:\Windows\SysWOW64
2017-10-09 05:30:46 ----D---- C:\Windows
2017-10-09 05:29:35 ----D---- C:\Users\Peter\AppData\Roaming\DMCache
2017-10-09 05:28:02 ----D---- C:\Windows\system32\drivers
2017-10-09 05:27:47 ----D---- C:\Users\Peter\AppData\Roaming\IDM
2017-10-09 04:41:12 ----D---- C:\Windows\system32\config
2017-10-08 15:55:37 ----D---- C:\Windows\Prefetch
2017-10-08 15:54:05 ----D---- C:\ProgramData\ProductData
2017-10-08 15:53:51 ----AD---- C:\Program Files (x86)\BlueStacks
2017-10-08 15:49:04 ----D---- C:\AdwCleaner
2017-10-08 14:34:27 ----D---- C:\Windows\inf
2017-10-08 08:07:21 ----D---- C:\Windows\SYSWOW64\Macromed
2017-10-07 17:20:26 ----RD---- C:\Program Files
2017-10-07 17:20:26 ----D---- C:\Windows\System32
2017-10-07 17:20:23 ----D---- C:\Windows\system32\DriverStore
2017-10-07 16:55:20 ----D---- C:\Users\Peter\AppData\Roaming\Charles
2017-10-06 16:22:51 ----SHD---- C:\System Volume Information
2017-10-05 16:36:09 ----D---- C:\Windows\Registration
2017-10-05 16:35:50 ----RD---- C:\Program Files (x86)
2017-10-05 16:33:06 ----HD---- C:\ProgramData
2017-10-01 10:05:17 ----D---- C:\Windows\system32\Tasks
2017-09-30 06:59:46 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2017-09-29 21:11:58 ----D---- C:\Program Files (x86)\Mozilla Firefox
2017-09-22 20:37:12 ----D---- C:\Program Files\CCleaner
2017-09-21 05:39:30 ----D---- C:\Windows\debug
2017-09-17 14:01:26 ----D---- C:\Program Files (x86)\DLL Suite
2017-09-17 02:49:07 ----D---- C:\Windows\system32\wdi
2017-09-15 09:34:15 ----D---- C:\Program Files (x86)\TeamViewer
2017-09-15 03:57:27 ----D---- C:\Windows\rescache
2017-09-14 21:19:39 ----D---- C:\Windows\Microsoft.NET
2017-09-14 20:29:48 ----RSD---- C:\Windows\assembly
2017-09-14 05:48:23 ----A---- C:\Windows\system32\PerfStringBackup.INI
2017-09-14 05:43:05 ----D---- C:\Windows\winsxs
2017-09-14 05:39:46 ----D---- C:\Program Files\Internet Explorer
2017-09-14 05:39:45 ----D---- C:\Windows\SYSWOW64\sk-SK
2017-09-14 05:39:45 ----D---- C:\Windows\SYSWOW64\en-US
2017-09-14 05:39:45 ----D---- C:\Program Files (x86)\Internet Explorer
2017-09-14 05:39:41 ----D---- C:\Windows\system32\sk-SK
2017-09-14 05:39:41 ----D---- C:\Windows\system32\en-US
2017-09-14 05:39:37 ----D---- C:\Windows\AppPatch
2017-09-14 05:39:36 ----D---- C:\Windows\system32\Boot
2017-09-14 05:37:32 ----D---- C:\Users\Peter\AppData\Roaming\IObit
2017-09-14 05:11:09 ----D---- C:\Windows\system32\MRT
2017-09-14 05:06:15 ----AC---- C:\Windows\system32\MRT.exe
2017-09-14 04:57:33 ----SHD---- C:\Windows\Installer
2017-09-14 04:53:33 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2017-09-13 17:27:28 ----D---- C:\Windows\system32\catroot2
2017-09-12 19:28:24 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2017-09-12 19:28:20 ----D---- C:\Windows\system32\Macromed

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 SmartDefragDriver;SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [2017-03-09 30744]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 199552]
R1 adgnetworkwfpdrv;adgnetworkwfpdrv; C:\Windows\system32\drivers\adgnetworkwfpdrv.sys [2017-03-27 70384]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 514560]
R1 dsnpfd;DeskSoft LightWeight Filter; C:\Windows\system32\DRIVERS\dsnpfd.sys [2017-02-22 37576]
R1 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2017-06-22 132824]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2017-05-04 178056]
R1 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2017-05-04 77224]
R1 HWiNFO32;HWiNFO32/64 Kernel Driver; \??\C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [2016-11-26 27552]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver; C:\Windows\system32\DRIVERS\VBoxUSBMon.sys [2017-10-05 144656]
R1 YSDrv;VBox Support Driver; \??\C:\Program Files (x86)\Bignox\BigNoxVM\RT\YSDrv.sys [2017-10-05 270608]
R2 IDMWFP;IDMWFP; C:\Windows\system32\DRIVERS\idmwfp.sys [2017-08-05 225568]
R3 dtultrascsibus;DAEMON Tools Ultra Virtual SCSI Bus; C:\Windows\system32\DRIVERS\dtultrascsibus.sys [2017-01-25 30264]
R3 dtultrausbbus;DAEMON Tools Ultra Virtual USB Bus; C:\Windows\system32\DRIVERS\dtultrausbbus.sys [2017-01-25 47672]
R3 ETDSMBus;ETDSMBus; C:\Windows\system32\DRIVERS\ETDSMBus.sys [2017-08-08 32840]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys [2016-11-26 15416]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys [2015-02-20 197408]
R3 P17;SB 5.1 VX; C:\Windows\system32\drivers\P17.sys [2016-11-26 1309696]
R3 tap0901;TAP-Windows Adapter V9; C:\Windows\system32\DRIVERS\tap0901.sys [2016-04-21 27136]
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudbus.sys [2016-12-03 129152]
S3 dtlitescsibus;DAEMON Tools Lite Virtual SCSI Bus; C:\Windows\system32\DRIVERS\dtlitescsibus.sys [2016-12-22 30264]
S3 dtliteusbbus;DAEMON Tools Lite Virtual USB Bus; C:\Windows\system32\DRIVERS\dtliteusbbus.sys [2016-12-22 47672]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 165888]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 6656]
S3 SANDRA;SANDRA; \??\C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2015.SP1a\WNt600x64\Sandra.sys [2009-08-07 23112]
S3 SmbDrvI;SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [2016-11-26 33960]
S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudmdm.sys [2016-12-14 221824]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 34688]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
S3 VBoxUSB;VirtualBox USB; C:\Windows\System32\Drivers\VBoxUSB.sys [2017-10-05 131856]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 21760]
S3 WinUsb;SAMSUNG Android USB Driver; C:\Windows\system32\DRIVERS\WinUSB.sys [2010-11-20 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2017-07-19 83032]
R2 BWMeterConSvc;BWMeter Connections Service; C:\Program Files (x86)\BWMeter\BWMeterConSvc.exe [2017-02-22 126976]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 CTAudSvcService;Creative Audio Service; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [2008-11-18 307200]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2017-06-13 2625368]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2016-11-14 932728]
R2 OkayFreedom VPN Starter Service;OkayFreedom VPN Starter Service; C:\Program Files (x86)\OkayFreedom\OkayFreedomService.exe [2017-03-02 355328]
R2 TeamViewer;TeamViewer 12; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [2016-11-28 10216688]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2017-04-21 107656]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2017-04-21 128648]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-11-26 153752]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-09-12 272384]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2016-11-26 79360]
S3 Disc Soft Ultra Bus Service;Disc Soft Ultra Bus Service; C:\Users\Peter\DAEMON Tools Ultra\DiscSoftBusServiceUltra.exe [2016-12-12 4854464]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-11-26 153752]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2017-08-13 116224]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2017-09-29 175568]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 SandraAgentSrv;SiSoftware Deployment Agent Service; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2015.SP1a\RpcAgentSrv.exe [2015-03-17 73200]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2017-06-10 1255736]
S4 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2017-04-21 52856]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-04-21 136312]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-04-21 136312]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-04-21 136312]

-----------------EOF-----------------

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 118197
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: Prosím o kontrolu - Zasekaný PC

#9 Příspěvek od Rudy »

Smazáno. Nastala nějaká změna?
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

PureHate44
Návštěvník
Návštěvník
Příspěvky: 154
Registrován: 28 čer 2011 17:49

Re: Prosím o kontrolu - Zasekaný PC

#10 Příspěvek od PureHate44 »

Parádne :)
Ďakujem za pomoc :-)

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 118197
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: Prosím o kontrolu - Zasekaný PC

#11 Příspěvek od Rudy »

Nemáte zač! :)
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

Zamčeno