Kontrola po odvšivení

[JerryK_736]

Hezký den, dobří lidé, nedávno jsem pucoval zavšivený přístroj jedné kolegyně z práce.
Chtěl bych Vás požádat o kontrolu FRST logů, jestli jsem náhodou nějakej moribundus nepřehlídl. Díky.

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 14-05-2017
Ran by Robin (administrator) on CINKOVI (16-05-2017 19:12:07)
Running from D:\Programy\Antivir\FRST
Loaded Profiles: Robin (Available Profiles: Robin)
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) Language: Čeština (Česká republika)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(Disc Soft Ltd) C:\Program Files\DAEMON Tools Lite\DTAgent.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe
(AVAST Software s.r.o.) C:\Program Files\AVAST Software\Avast\aswidsagent.exe
(Disc Soft Ltd) C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe
() D:\Programy\Double Commander\doublecmd.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10996368 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [213824 2017-05-10] (AVAST Software)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [587288 2017-03-15] (Oracle Corporation)
HKU\S-1-5-21-2280049570-3098916696-629672514-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [7456984 2017-04-11] (Piriform Ltd)
HKU\S-1-5-21-2280049570-3098916696-629672514-1001\...\Run: [Steam] => C:\Program Files\Steam\steam.exe [3019552 2017-04-26] (Valve Corporation)
HKU\S-1-5-21-2280049570-3098916696-629672514-1001\...\Run: [DAEMON Tools Lite Automount] => C:\Program Files\DAEMON Tools Lite\DTAgent.exe [3777728 2017-02-07] (Disc Soft Ltd)
HKU\S-1-5-21-2280049570-3098916696-629672514-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\avastSS.scr [53208 2016-11-16] (AVAST Software)
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2017-05-10] (AVAST Software)
GroupPolicyScripts: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 217.31.204.130 193.29.206.206
Tcpip\..\Interfaces\{009B4E6F-8DB7-4D10-98CA-660475CBD69C}: [DhcpNameServer] 217.31.204.130 193.29.206.206

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=i ... ar=msnhome
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-2280049570-3098916696-629672514-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=i ... ar=msnhome
HKU\S-1-5-21-2280049570-3098916696-629672514-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM -> DefaultScope {15C4DF55-4B67-495A-A3D3-A497C4A49EE0} URL =
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_131\bin\ssv.dll [2017-05-11] (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2017-04-04] (AVAST Software)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_131\bin\jp2ssv.dll [2017-05-11] (Oracle Corporation)

FireFox:
========
FF DefaultProfile: Robin
FF ProfilePath: C:\Users\Robin\AppData\Roaming\Mozilla\Firefox\Profiles\Robin [2017-05-16]
FF NewTab: Mozilla\Firefox\Profiles\Robin -> about:newtab
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\Robin -> Seznam
FF DefaultSearchUrl: Mozilla\Firefox\Profiles\Robin -> hxxp://search.seznam.cz/?sourceid=quicksearch_22668&q={searchTerms}&
FF SearchEngineOrder.1: Mozilla\Firefox\Profiles\Robin -> Seznam
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\Robin -> Seznam
FF Homepage: Mozilla\Firefox\Profiles\Robin -> hxxps://www.seznam.cz/
FF Extension: (uBlock Origin) - C:\Users\Robin\AppData\Roaming\Mozilla\Firefox\Profiles\Robin\Extensions\uBlock0@raymondhill.net.xpi [2017-05-11]
FF Extension: (Avast Online Security) - C:\Users\Robin\AppData\Roaming\Mozilla\Firefox\Profiles\Robin\Extensions\wrc@avast.com.xpi [2017-05-10]
FF Extension: (Firefox Screenshots) - C:\Program Files\Mozilla Firefox\browser\features\screenshots@mozilla.org.xpi [2017-05-11] [not signed]
FF Plugin: @java.com/DTPlugin,version=11.131.2 -> C:\Program Files\Java\jre1.8.0_131\bin\dtplugin\npDeployJava1.dll [2017-05-11] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.131.2 -> C:\Program Files\Java\jre1.8.0_131\bin\plugin2\npjp2.dll [2017-05-11] (Oracle Corporation)

Chrome:
=======
CHR DefaultProfile: ChromeDefaultData

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\aswidsagent.exe [5732136 2017-05-10] (AVAST Software s.r.o.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [263304 2017-05-10] (AVAST Software)
R3 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe [1142464 2017-02-07] (Disc Soft Ltd)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 aswbidsdriver; C:\Windows\system32\drivers\aswbidsdriverx.sys [258288 2017-05-10] (AVAST Software s.r.o.)
R0 aswbidsh; C:\Windows\system32\drivers\aswbidshx.sys [148696 2017-05-10] (AVAST Software s.r.o.)
R0 aswblog; C:\Windows\system32\drivers\aswblogx.sys [268016 2017-05-10] (AVAST Software s.r.o.)
R0 aswbuniv; C:\Windows\system32\drivers\aswbunivx.sys [41664 2017-05-10] (AVAST Software s.r.o.)
S3 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [34136 2017-05-10] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [107928 2017-05-10] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [90336 2017-05-10] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\drivers\aswRvrt.sys [62152 2017-05-10] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [764576 2017-05-10] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [482608 2017-05-10] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [115152 2017-05-12] (AVAST Software)
R0 aswVmm; C:\Windows\system32\drivers\aswVmm.sys [279800 2017-05-10] (AVAST Software)
R3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [26168 2017-04-27] (Disc Soft Ltd)
R3 dtliteusbbus; C:\Windows\System32\DRIVERS\dtliteusbbus.sys [40504 2017-04-27] (Disc Soft Ltd)
R1 GUBootStartup; C:\Windows\System32\drivers\GUBootStartup.sys [17472 2016-11-20] (Glarysoft Ltd)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\mbamswissarmy.sys [40776 2017-05-12] (Malwarebytes Corporation)

========================== Drivers MD5 =======================

C:\Windows\System32\DRIVERS\1394ohci.sys ==> MD5 is legit
C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit
C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit
C:\Windows\system32\drivers\adp94xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\adpahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\adpu320.sys ==> MD5 is legit
C:\Windows\system32\drivers\afd.sys F582FC7976F1248AC5FBD6875C626B41
C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit
C:\Windows\system32\drivers\djsvs.sys ==> MD5 is legit
C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdagp.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdk8.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AmdLLD.sys AD8FA28D8ED0D0A689A0559085CE0F18
C:\Windows\System32\DRIVERS\amdppm.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdsata.sys D320BF87125326F996D4904FE24300FC
C:\Windows\system32\drivers\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdxata.sys 46387FB17B086D16DEA267D5BE23A2F2
C:\Windows\system32\drivers\appid.sys F3DF63315C8DB5ADDB24DA9408ECBEBF
C:\Windows\system32\drivers\arc.sys ==> MD5 is legit
C:\Windows\system32\drivers\arcsas.sys ==> MD5 is legit
C:\Windows\system32\drivers\aswbidsdriverx.sys 9635A4EDD2CE4FF5EF0F17260AF77796
C:\Windows\system32\drivers\aswbidshx.sys A0B577D535ECAB12A7EC9E99930D5BDE
C:\Windows\system32\drivers\aswblogx.sys A276EE33D3B1AF0BF4E945F4D7FDEDED
C:\Windows\system32\drivers\aswbunivx.sys 95051C90F87D302F0AFB1A39F158204E
C:\Windows\system32\drivers\aswHwid.sys 696854F7A7220212B19AF4437EE62DAE
C:\Windows\system32\drivers\aswMonFlt.sys 77BF6097D3E2A51745516060ADFA2C28
C:\Windows\system32\drivers\aswRdr2.sys 8E8BEAEDE1CD8DAA16B7E30B488036D2
C:\Windows\system32\drivers\aswRvrt.sys 84D096A4F4068D0DB870BB1506A5CBA1
C:\Windows\system32\drivers\aswSnx.sys 7322AA4781AE307803E52F6B058D9235
C:\Windows\system32\drivers\aswSP.sys 51899919FDF36770A15186DB241AF253
C:\Windows\system32\drivers\aswStm.sys 5D4CF2186F7D3058917D04AE4A183111
C:\Windows\system32\drivers\aswVmm.sys E1CC7A2FA9F5A186FF2E1AE64C5F930A
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\System32\drivers\atapi.sys ==> MD5 is legit
C:\Windows\system32\drivers\bxvbdx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\b57nd60x.sys ==> MD5 is legit
C:\Windows\system32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bowser.sys 28AF7D4427868B7CE4C00CAB1864C7F6
C:\Windows\system32\drivers\BrFiltLo.sys ==> MD5 is legit
C:\Windows\system32\drivers\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bridge.sys 77361D72A04F18809D0EFB6CCEB74D4B
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\system32\drivers\bthmodem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit
C:\Windows\system32\drivers\circlass.sys ==> MD5 is legit
C:\Windows\System32\CLFS.sys 1136E4A71849BCFCB057140AD03AAEE6
C:\Windows\system32\drivers\CmBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cng.sys 7F7D4B16389CEF932950F6B2604D2601
C:\Windows\system32\drivers\compbatt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\CompositeBus.sys ==> MD5 is legit
C:\Windows\system32\drivers\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\csc.sys ==> MD5 is legit
C:\Windows\System32\Drivers\dfsc.sys EA9DBD76CE9254C77BAAB4339DD4C4FB
C:\Windows\System32\drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\drivers\disk.sys B7B470F163002A0D0E381EE45834BF6B
C:\Windows\system32\drivers\dmvsc.sys 2A958EF85DB1B61FFCA65044FA4BCE9E
C:\Windows\system32\drivers\drmkaud.sys A3F684B866A7D89AE396276CE7AFD416
C:\Windows\System32\DRIVERS\dtlitescsibus.sys 8A32FF671D452D36CC7421171B78F939
C:\Windows\System32\DRIVERS\dtliteusbbus.sys 0098B71A5D28FEAF321B4AC4549765D9
C:\Windows\System32\drivers\dxgkrnl.sys 2B5333F55D4E92FDE230BD204AAE9852
C:\Windows\system32\drivers\evbdx.sys ==> MD5 is legit
C:\Windows\system32\drivers\elxstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit
C:\Windows\system32\Drivers\exfat.sys 53E8732CC70CC0991839DF9FC8996E4A
C:\Windows\system32\Drivers\fastfat.sys 24F422E5D7517FEBDA2324116F1A7BE6
C:\Windows\system32\drivers\fdc.sys ==> MD5 is legit
C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit
C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit
C:\Windows\system32\drivers\flpydisk.sys ==> MD5 is legitB
C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\system32\Drivers\Fs_Rec.sys 7DAE5EBCC80E45D3253F4923DC424D05
C:\Windows\System32\DRIVERS\fvevol.sys E306A24D9694C724FA2491278BF50FDB
C:\Windows\system32\drivers\gagp30kx.sys ==> MD5 is legit
C:\Windows\System32\drivers\GUBootStartup.sys 05C11D2DA6B396F6AD8C590D32CF81D7
C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit
C:\Windows\System32\drivers\HdAudio.sys A5EF29D5315111C80A5C1ABAD14C8972
C:\Windows\System32\DRIVERS\HDAudBus.sys ==> MD5 is legit
C:\Windows\system32\drivers\HidBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\hidbth.sys ==> MD5 is legit
C:\Windows\system32\drivers\hidir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit
C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\drivers\HTTP.sys 487569E5DA56A5A432FF8AF6D3599CF9
C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\i8042prt.sys ==> MD5 is legit
C:\Windows\system32\drivers\iaStorV.sys 5CD5F9A5444E6CDCB0AC89BD62D8B76E
C:\Windows\system32\drivers\iirsp.sys ==> MD5 is legit
C:\Windows\System32\drivers\RTKVHDA.sys F2C17D2C3D70C389193D9954E375E5E3
C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit
C:\Windows\system32\drivers\intelppm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit
C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit
C:\Windows\system32\drivers\msiscsi.sys EB34CE31FABD4DC4343FD2AD16D2CAF9
C:\Windows\System32\DRIVERS\kbdclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ksecdd.sys 63BAEBED98D210658EBB69C75F4BA86B
C:\Windows\System32\Drivers\ksecpkg.sys C7EBA240A4E723F15EA971656E5D07BC
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_fc.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_sas2.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mbamswissarmy.sys 0DB7527DB188C7D967A37BB51BBF3963
C:\Windows\system32\drivers\megasas.sys ==> MD5 is legit
C:\Windows\system32\drivers\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\drivers\mountmgr.sys D1BDF813C9FE5ED53134EDF360927735
C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mrxdav.sys 06AC0310138E4B2C35AF7344D18BC686
C:\Windows\System32\DRIVERS\mrxsmb.sys D88E6E726F515A71B405CAF5777A3C70
C:\Windows\System32\DRIVERS\mrxsmb10.sys 838908EEE1C7FC42D836B6C1208AD0E1
C:\Windows\System32\DRIVERS\mrxsmb20.sys 88E48AF93B8E19108F888C451A457F28
C:\Windows\system32\drivers\msahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit
C:\Windows\system32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\system32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\system32\drivers\MTConfig.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit
C:\Windows\System32\drivers\ndis.sys 9804FB2E46077F2977552347DFCA7E05
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\system32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys A00996C9BFEF29A93B9F21DBE1DC502D
C:\Windows\system32\drivers\nfrd960.sys ==> MD5 is legit
C:\Windows\system32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit
C:\Windows\system32\Drivers\Ntfs.sys 978E7A2E4BF4E8E70D0776EF0D9E97FB
C:\Windows\system32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\nvm62x32.sys B5E37E31C053BC9950455A257526514B
C:\Windows\System32\DRIVERS\nvlddmkm.sys 2FBFB4FA3CF0495C0F5AF2AED1C4835A
C:\Windows\System32\DRIVERS\nvmf6232.sys 0219B05730635FCAB3A9925D3374C464
C:\Windows\system32\drivers\nvraid.sys B3E25EE28883877076E0E1FF877D02E0
C:\Windows\System32\drivers\nvstor.sys 4380E59A170D88C4F1022EFF6719A8A4
C:\Windows\System32\DRIVERS\nvstor32.sys 97778C3CB3AF6B2243648D0DCD4D8916
C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit
C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys 3F34A1B4C5F6475F320C275E63AFCE9B
C:\Windows\System32\DRIVERS\parvdm.sys ==> MD5 is legit
C:\Windows\System32\drivers\pci.sys ==> MD5 is legit
C:\Windows\System32\drivers\pciide.sys ==> MD5 is legit
C:\Windows\system32\drivers\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys 0C941A3F148B4228867908F98F394461
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\drivers\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\system32\drivers\ql2300.sys ==> MD5 is legit
C:\Windows\system32\drivers\ql40xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpdr.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\system32\Drivers\RDPWD.sys CD9214A6AE17D188D17C3CF8CB9CC693
C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\system32\drivers\vms3cap.sys ==> MD5 is legit
C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\system32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\serenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\serial.sys ==> MD5 is legit
C:\Windows\system32\drivers\sermouse.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit
C:\Windows\system32\drivers\sfloppy.sys ==> MD5 is legit
C:\Windows\system32\drivers\sisagp.sys ==> MD5 is legit
C:\Windows\system32\drivers\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\drivers\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\system32\Drivers\spldr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\srv.sys EE337A0E80C2554D42487E29C4E41E24
C:\Windows\System32\DRIVERS\srv2.sys 722EDCF256AFD35538E69A933A908CA2
C:\Windows\System32\DRIVERS\srvnet.sys BDF998A504EED01787CCA371980EAEDE
C:\Windows\system32\drivers\stexstor.sys ==> MD5 is legit
C:\Windows\System32\drivers\vmstorfl.sys ==> MD5 is legit
C:\Windows\system32\drivers\storvsc.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\swenum.sys ==> MD5 is legit
C:\Windows\System32\drivers\tcpip.sys C7CF3C1D1EC800230E5FE658C77FC9CA
C:\Windows\System32\DRIVERS\tcpip.sys C7CF3C1D1EC800230E5FE658C77FC9CA
C:\Windows\System32\drivers\tcpipreg.sys A4BF8BE9D1F7D563C7868AC7B2561545
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdtcp.sys 2C2C5AFE7EE4F620D69C23C0617651A8
C:\Windows\System32\DRIVERS\tdx.sys 0D4CE846B6461A89CF246636E6098323
C:\Windows\System32\DRIVERS\termdd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tssecsrv.sys 6C5139E4283249518F7743D7043775B3
C:\Windows\System32\drivers\tsusbflt.sys ==> MD5 is legit
C:\Windows\system32\drivers\TsUsbGD.sys 01246F0BAAD7B68EC0F472AA41E33282
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\system32\drivers\uagp35.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\umbus.sys ==> MD5 is legit
C:\Windows\system32\drivers\umpass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbccgp.sys 325A69967CC7B4BFB170F5636143A94A
C:\Windows\system32\drivers\usbcir.sys 2352AB5F9F8F097BF9D41D5A4718A041
C:\Windows\system32\drivers\usbehci.sys 5D57798CAE5A0DD0B8F61C52B8E7C3D1
C:\Windows\System32\DRIVERS\usbhub.sys 3835ECC1E928042F92D7AA1963D40523
C:\Windows\system32\drivers\usbohci.sys 81E1E90305A4C7A13BADC5DFA22ABA37
C:\Windows\system32\drivers\usbprint.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\USBSTOR.SYS 144DA53294922A84FFAA3D90B1453745
C:\Windows\system32\drivers\usbuhci.sys B4A1789BE90403D9549EF9DBAD37A429
C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaagp.sys ==> MD5 is legit
C:\Windows\system32\drivers\viac7.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit
C:\Windows\system32\drivers\vmbus.sys ==> MD5 is legit
C:\Windows\system32\drivers\VMBusHID.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit
C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit
C:\Windows\system32\drivers\vsmraid.sys ==> MD5 is legit
C:\Windows\System32\drivers\vwifibus.sys ==> MD5 is legit
C:\Windows\system32\drivers\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\system32\drivers\wd.sys ==> MD5 is legit
C:\Windows\System32\drivers\Wdf01000.sys 25944D2CC49E0A6C581D02A74B7D6645
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WinUsb.sys A67E5F9A400F3BD1BE3D80613B45F708
C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\drivers\WudfPf.sys 06E6F32C8D0A3F66D956F57B43A2E070
C:\Windows\System32\DRIVERS\WUDFRd.sys 867C301E8B790040AE9CF6486E8041DF

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Three Months Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-05-16 19:11 - 2017-05-16 19:12 - 00000000 ____D C:\FRST
2017-05-13 00:05 - 2017-05-13 00:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2017-05-13 00:05 - 2017-05-13 00:05 - 00000000 ____D C:\Program Files\7-Zip
2017-05-12 22:09 - 2017-05-12 22:50 - 00040776 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamswissarmy.sys
2017-05-12 22:09 - 2017-05-12 22:09 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-05-12 22:04 - 2017-05-12 22:04 - 00371512 _____ C:\Windows\system32\FNTCACHE.DAT
2017-05-12 21:49 - 2017-05-12 21:49 - 44036096 _____ C:\Windows\system32\config\~gSOFT01.tmp
2017-05-12 21:49 - 2017-05-12 21:49 - 16875520 _____ C:\Windows\system32\config\~gSYST02.tmp
2017-05-12 21:49 - 2017-05-12 21:49 - 01253376 _____ C:\Windows\system32\config\~gDEFA03.tmp
2017-05-12 21:49 - 2017-05-12 21:49 - 00065536 _____ C:\Windows\system32\config\~gSAM05.tmp
2017-05-12 21:49 - 2017-05-12 21:49 - 00024576 _____ C:\Windows\system32\config\~gSECU04.tmp
2017-05-11 22:02 - 2017-05-11 22:02 - 00000000 ____D C:\Program Files\Common Files\Java
2017-05-11 22:00 - 2017-05-11 22:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2017-05-11 21:55 - 2017-05-12 22:04 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2017-05-11 21:55 - 2017-05-11 21:55 - 00001123 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-05-11 21:52 - 2017-05-11 21:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XnView
2017-05-11 21:41 - 2017-04-28 02:36 - 04000488 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2017-05-11 21:41 - 2017-04-28 02:36 - 03945192 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2017-05-11 21:41 - 2017-04-28 02:36 - 00137960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2017-05-11 21:41 - 2017-04-28 02:36 - 00067304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2017-05-11 21:41 - 2017-04-28 02:34 - 01310528 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2017-05-11 21:41 - 2017-04-28 02:32 - 01062912 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2017-05-11 21:41 - 2017-04-28 02:32 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2017-05-11 21:41 - 2017-04-28 02:32 - 00655360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2017-05-11 21:41 - 2017-04-28 02:32 - 00644096 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2017-05-11 21:41 - 2017-04-28 02:32 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2017-05-11 21:41 - 2017-04-28 02:32 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2017-05-11 21:41 - 2017-04-28 02:32 - 00261120 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2017-05-11 21:41 - 2017-04-28 02:32 - 00254464 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2017-05-11 21:41 - 2017-04-28 02:32 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2017-05-11 21:41 - 2017-04-28 02:32 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2017-05-11 21:41 - 2017-04-28 02:32 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2017-05-11 21:41 - 2017-04-28 02:32 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2017-05-11 21:41 - 2017-04-28 02:32 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2017-05-11 21:41 - 2017-04-28 02:32 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2017-05-11 21:41 - 2017-04-28 02:32 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2017-05-11 21:41 - 2017-04-28 02:32 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2017-05-11 21:41 - 2017-04-28 02:32 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2017-05-11 21:41 - 2017-04-28 02:32 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2017-05-11 21:41 - 2017-04-28 02:32 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2017-05-11 21:41 - 2017-04-28 02:32 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2017-05-11 21:41 - 2017-04-28 02:32 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2017-05-11 21:41 - 2017-04-28 02:32 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2017-05-11 21:41 - 2017-04-28 02:32 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2017-05-11 21:41 - 2017-04-28 02:11 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2017-05-11 21:41 - 2017-04-28 02:11 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2017-05-11 21:41 - 2017-04-28 02:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2017-05-11 21:41 - 2017-04-28 02:11 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2017-05-11 21:41 - 2017-04-28 02:11 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2017-05-11 21:41 - 2017-04-28 02:09 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2017-05-11 21:41 - 2017-04-28 02:07 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2017-05-11 21:41 - 2017-04-28 02:07 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2017-05-11 21:41 - 2017-04-28 02:07 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2017-05-11 21:41 - 2017-04-28 02:07 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2017-05-11 21:41 - 2017-04-28 02:07 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2017-05-11 21:41 - 2017-04-28 02:07 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2017-05-11 21:41 - 2017-04-28 02:07 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2017-05-11 21:41 - 2017-04-26 16:51 - 02400768 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2017-05-11 21:41 - 2017-04-21 17:15 - 00805376 _____ (Microsoft Corporation) C:\Windows\system32\cdosys.dll
2017-05-11 21:41 - 2017-04-20 01:16 - 00346320 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2017-05-11 21:41 - 2017-04-17 17:12 - 01417728 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2017-05-11 21:41 - 2017-04-17 17:12 - 00872448 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2017-05-11 21:41 - 2017-04-17 17:12 - 00581632 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2017-05-11 21:41 - 2017-04-17 17:12 - 00377344 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2017-05-11 21:41 - 2017-04-17 17:12 - 00294400 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2017-05-11 21:41 - 2017-04-17 17:12 - 00171008 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2017-05-11 21:41 - 2017-04-17 17:12 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\oleres.dll
2017-05-11 21:41 - 2017-04-17 17:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-05-11 21:41 - 2017-04-17 17:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-05-11 21:41 - 2017-04-17 17:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-05-11 21:41 - 2017-04-17 17:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-05-11 21:41 - 2017-04-17 17:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-05-11 21:41 - 2017-04-17 17:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-05-11 21:41 - 2017-04-17 17:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-05-11 21:41 - 2017-04-17 17:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-05-11 21:41 - 2017-04-17 17:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-05-11 21:41 - 2017-04-17 17:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-05-11 21:41 - 2017-04-17 17:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-05-11 21:41 - 2017-04-17 17:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-05-11 21:41 - 2017-04-17 17:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-05-11 21:41 - 2017-04-17 17:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-05-11 21:41 - 2017-04-17 17:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-05-11 21:41 - 2017-04-17 17:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-05-11 21:41 - 2017-04-17 17:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-05-11 21:41 - 2017-04-17 17:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-05-11 21:41 - 2017-04-17 17:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-05-11 21:41 - 2017-04-17 17:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-05-11 21:41 - 2017-04-17 17:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-05-11 21:41 - 2017-04-17 17:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-05-11 21:41 - 2017-04-17 17:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-05-11 21:41 - 2017-04-17 17:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-05-11 21:41 - 2017-04-17 16:54 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\comcat.dll
2017-05-11 21:41 - 2017-04-17 16:51 - 00271360 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2017-05-11 21:41 - 2017-04-17 16:48 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-05-11 21:41 - 2017-04-17 16:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-05-11 21:41 - 2017-04-17 16:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-05-11 21:41 - 2017-04-17 16:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-05-11 21:41 - 2017-04-16 10:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2017-05-11 21:41 - 2017-04-16 10:19 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2017-05-11 21:41 - 2017-04-16 10:02 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2017-05-11 21:41 - 2017-04-16 10:01 - 00499200 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2017-05-11 21:41 - 2017-04-16 10:01 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2017-05-11 21:41 - 2017-04-16 10:01 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2017-05-11 21:41 - 2017-04-16 10:00 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2017-05-11 21:41 - 2017-04-16 09:53 - 02290176 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2017-05-11 21:41 - 2017-04-16 09:52 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2017-05-11 21:41 - 2017-04-16 09:52 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2017-05-11 21:41 - 2017-04-16 09:49 - 20278272 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2017-05-11 21:41 - 2017-04-16 09:48 - 00476160 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2017-05-11 21:41 - 2017-04-16 09:47 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2017-05-11 21:41 - 2017-04-16 09:47 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2017-05-11 21:41 - 2017-04-16 09:47 - 00104960 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2017-05-11 21:41 - 2017-04-16 09:46 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2017-05-11 21:41 - 2017-04-16 09:39 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2017-05-11 21:41 - 2017-04-16 09:35 - 00416256 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2017-05-11 21:41 - 2017-04-16 09:30 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-05-11 21:41 - 2017-04-16 09:29 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2017-05-11 21:41 - 2017-04-16 09:28 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2017-05-11 21:41 - 2017-04-16 09:25 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2017-05-11 21:41 - 2017-04-16 09:24 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2017-05-11 21:41 - 2017-04-16 09:22 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2017-05-11 21:41 - 2017-04-16 09:20 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2017-05-11 21:41 - 2017-04-16 09:12 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2017-05-11 21:41 - 2017-04-16 09:10 - 00693248 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2017-05-11 21:41 - 2017-04-16 09:10 - 00689664 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2017-05-11 21:41 - 2017-04-16 09:08 - 04548608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2017-05-11 21:41 - 2017-04-16 09:08 - 02057216 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2017-05-11 21:41 - 2017-04-16 09:08 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2017-05-11 21:41 - 2017-04-16 08:53 - 13661184 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2017-05-11 21:41 - 2017-04-16 08:37 - 02767872 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2017-05-11 21:41 - 2017-04-16 08:34 - 01314816 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2017-05-11 21:41 - 2017-04-16 08:34 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2017-05-11 21:41 - 2017-04-12 17:26 - 00179200 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2017-05-11 21:41 - 2017-04-12 17:25 - 01176064 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2017-05-11 21:41 - 2017-04-12 17:25 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2017-05-11 21:41 - 2017-04-12 17:25 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2017-05-11 21:41 - 2017-04-07 17:26 - 00730344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2017-05-11 21:41 - 2017-04-07 17:26 - 00218856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2017-05-11 21:41 - 2017-04-07 17:21 - 00306688 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2017-05-11 21:41 - 2017-04-07 17:20 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2017-05-11 21:41 - 2017-04-05 17:00 - 00313856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2017-05-11 21:41 - 2017-04-05 17:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2017-05-11 21:41 - 2017-04-05 17:00 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2017-05-11 21:41 - 2017-04-04 17:25 - 01309928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2017-05-11 21:41 - 2017-04-04 17:25 - 00240872 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2017-05-11 21:41 - 2017-04-04 17:25 - 00187624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2017-05-11 21:41 - 2017-04-04 16:52 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2017-05-11 21:41 - 2017-04-04 16:52 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2017-05-11 21:41 - 2017-03-10 18:20 - 01508352 _____ (Microsoft Corporation) C:\Windows\system32\pla.dll
2017-05-11 21:41 - 2017-03-10 18:20 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\pdh.dll
2017-05-11 21:41 - 2017-03-10 17:52 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\plasrv.exe
2017-05-11 21:41 - 2017-03-10 17:51 - 00148992 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fastfat.sys
2017-05-11 21:41 - 2017-03-10 17:51 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\exfat.sys
2017-05-11 21:41 - 2017-03-09 18:19 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2017-05-11 21:20 - 2017-05-11 21:20 - 00000000 ____D C:\Windows\erdnt
2017-05-11 21:14 - 2017-05-11 21:14 - 00000000 ____D C:\Users\Robin\AppData\Roaming\www.shadowexplorer.com
2017-05-11 16:23 - 2017-05-11 22:22 - 00024688 _____ C:\Windows\system32\Drivers\TrueSight.sys
2017-05-11 16:23 - 2017-05-11 19:46 - 00000000 ____D C:\ProgramData\RogueKiller
2017-05-10 16:13 - 2017-05-10 16:12 - 00330768 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2017-04-27 15:42 - 2007-06-29 14:47 - 00034304 _____ (AMD, Inc.) C:\Windows\system32\Drivers\AmdLLD.sys
2017-04-27 15:25 - 2017-04-27 15:27 - 00040504 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtliteusbbus.sys
2017-04-27 15:23 - 2017-04-27 15:27 - 00000000 ____D C:\Program Files\DAEMON Tools Lite
2017-04-27 15:23 - 2017-04-27 15:23 - 00026168 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtlitescsibus.sys
2017-04-27 15:23 - 2017-04-27 15:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite
2017-04-22 22:03 - 2017-04-22 22:03 - 00000000 ____D C:\Program Files\Creative
2017-04-22 22:03 - 2002-06-06 14:38 - 00139264 _____ (Creative Technology Ltd) C:\Windows\system32\eax.dll
2017-04-22 22:03 - 1998-10-29 16:45 - 00306688 _____ (InstallShield Software Corporation) C:\Windows\IsUninst.exe
2017-04-18 17:22 - 2017-04-18 17:22 - 00000000 ____D C:\Users\Robin\AppData\Roaming\LibreOffice
2017-04-18 17:21 - 2017-04-18 17:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice 5.3
2017-04-18 17:20 - 2017-04-18 17:21 - 00000000 ____D C:\Program Files\LibreOffice 5
2017-04-16 11:00 - 2017-03-22 17:24 - 02953216 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2017-04-16 11:00 - 2017-03-22 17:24 - 00174080 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2017-04-16 11:00 - 2017-03-22 17:06 - 02091520 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2017-04-16 11:00 - 2017-03-22 17:05 - 00573440 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2017-04-16 11:00 - 2017-03-22 17:05 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2017-04-16 11:00 - 2017-03-22 17:05 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2017-04-16 11:00 - 2017-03-22 17:05 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2017-04-16 11:00 - 2017-03-22 17:05 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2017-04-16 11:00 - 2017-03-10 18:27 - 00308456 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2017-04-16 11:00 - 2017-03-07 18:17 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\asycfilt.dll
2017-04-16 11:00 - 2017-03-04 03:14 - 01329664 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2017-04-16 11:00 - 2017-03-04 03:14 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\mfmjpegdec.dll
2017-04-16 11:00 - 2017-02-14 18:19 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2017-04-16 11:00 - 2017-02-09 18:14 - 00575488 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll
2017-04-16 11:00 - 2017-02-09 18:14 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\samlib.dll
2017-04-16 11:00 - 2017-01-18 17:35 - 00922432 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2017-04-16 11:00 - 2017-01-18 17:35 - 00066400 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2017-04-16 11:00 - 2017-01-18 17:35 - 00022368 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2017-04-16 11:00 - 2017-01-18 17:35 - 00019808 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2017-04-16 11:00 - 2017-01-18 17:35 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2017-04-16 11:00 - 2017-01-18 17:35 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2017-04-16 11:00 - 2017-01-18 17:35 - 00016224 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2017-04-16 11:00 - 2017-01-18 17:35 - 00015712 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2017-04-16 11:00 - 2017-01-18 17:35 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2017-04-16 11:00 - 2017-01-18 17:35 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2017-04-16 11:00 - 2017-01-18 17:35 - 00013664 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2017-04-16 11:00 - 2017-01-18 17:35 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2017-04-16 11:00 - 2017-01-18 17:35 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2017-04-16 11:00 - 2017-01-18 17:35 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2017-04-16 11:00 - 2017-01-18 17:35 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2017-04-16 11:00 - 2017-01-18 17:35 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2017-04-16 11:00 - 2017-01-18 17:35 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2017-04-16 11:00 - 2017-01-18 17:35 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2017-04-16 11:00 - 2017-01-18 17:35 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2017-04-16 11:00 - 2017-01-18 17:35 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2017-04-16 11:00 - 2017-01-18 17:35 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2017-04-16 11:00 - 2017-01-18 17:35 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2017-04-16 11:00 - 2017-01-18 17:35 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
2017-04-16 10:59 - 2017-03-22 17:20 - 00073728 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2017-04-16 10:59 - 2017-03-22 17:05 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2017-04-16 10:59 - 2017-03-22 17:05 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2017-04-16 10:59 - 2017-03-10 18:19 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2017-04-16 10:59 - 2017-03-10 18:19 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2017-04-16 10:59 - 2017-03-10 18:19 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2017-04-16 10:59 - 2017-03-10 17:53 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2017-03-26 20:33 - 2017-03-26 20:33 - 00028344 _____ (Microsoft Corporation) C:\Windows\system32\aspnet_counters.dll
2017-03-26 20:33 - 2017-03-26 20:33 - 00019104 _____ (Microsoft Corporation) C:\Windows\system32\msvcr110_clr0400.dll
2017-03-26 20:33 - 2017-03-26 20:33 - 00019104 _____ (Microsoft Corporation) C:\Windows\system32\msvcr100_clr0400.dll
2017-03-26 20:33 - 2017-03-26 20:33 - 00019104 _____ (Microsoft Corporation) C:\Windows\system32\msvcp110_clr0400.dll
2017-03-18 17:07 - 2017-05-10 16:12 - 00268016 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswblogx.sys
2017-03-18 17:07 - 2017-05-10 16:12 - 00258288 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbidsdriverx.sys
2017-03-18 17:07 - 2017-05-10 16:12 - 00148696 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbidshx.sys
2017-03-18 17:07 - 2017-05-10 16:12 - 00041664 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbunivx.sys
2017-03-16 17:17 - 2017-02-10 18:17 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2017-03-16 17:17 - 2017-02-10 16:33 - 01251328 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2017-03-16 17:17 - 2017-02-10 16:33 - 00909824 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2017-03-16 17:17 - 2017-02-09 18:14 - 00481792 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll
2017-03-16 17:17 - 2017-02-09 18:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\icm32.dll
2017-03-16 17:17 - 2017-02-09 17:51 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\WcsPlugInService.dll
2017-03-16 17:17 - 2017-02-06 18:03 - 00497152 _____ (Microsoft Corporation) C:\Windows\HelpPane.exe
2017-03-16 17:17 - 2017-01-13 19:45 - 00741888 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2017-03-16 17:17 - 2017-01-13 19:45 - 00084480 _____ (Microsoft Corporation) C:\Windows\system32\INETRES.dll
2017-03-16 17:17 - 2017-01-11 19:43 - 01241088 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2017-03-16 17:17 - 2017-01-11 19:43 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll

==================== Three Months Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-05-16 19:05 - 2009-07-14 06:34 - 00021280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-05-16 19:05 - 2009-07-14 06:34 - 00021280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-05-16 19:01 - 2010-11-21 03:16 - 00668138 _____ C:\Windows\system32\perfh005.dat
2017-05-16 19:01 - 2010-11-21 03:16 - 00140798 _____ C:\Windows\system32\perfc005.dat
2017-05-16 19:01 - 2010-11-20 23:01 - 01582262 _____ C:\Windows\system32\PerfStringBackup.INI
2017-05-16 19:01 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\inf
2017-05-16 18:58 - 2017-01-17 18:27 - 00000000 ____D C:\Program Files\Steam
2017-05-16 18:56 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-05-14 11:45 - 2016-11-26 22:19 - 00000000 ____D C:\Users\Robin\AppData\LocalLow\Mozilla
2017-05-13 00:01 - 2016-11-20 15:03 - 00000000 ____D C:\Users\Robin
2017-05-12 23:56 - 2016-11-26 16:31 - 00000000 ____D C:\Program Files\Mozilla Firefox
2017-05-12 22:46 - 2016-11-20 15:22 - 00000000 ____D C:\Users\Robin\AppData\Roaming\vlc
2017-05-12 22:34 - 2016-11-16 21:20 - 00000000 ____D C:\Program Files\XnView
2017-05-12 21:11 - 2016-11-16 22:08 - 00115152 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2017-05-12 21:03 - 2016-11-16 21:09 - 00000000 ____D C:\ProgramData\NVIDIA
2017-05-12 15:59 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2017-05-11 22:10 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\PolicyDefinitions
2017-05-11 22:01 - 2016-11-16 21:05 - 00000000 ____D C:\ProgramData\Oracle
2017-05-11 22:01 - 2016-11-16 21:05 - 00000000 ____D C:\Program Files\Java
2017-05-11 22:00 - 2016-11-16 21:05 - 00095808 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2017-05-11 21:46 - 2016-11-18 12:54 - 00000000 ____D C:\Windows\system32\MRT
2017-05-11 21:44 - 2016-11-18 12:54 - 153591048 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-05-11 18:58 - 2016-12-16 09:07 - 00000000 ____D C:\Program Files\Seznam.cz
2017-05-11 18:58 - 2016-12-16 09:06 - 00000000 ____D C:\Users\Robin\AppData\Roaming\Seznam.cz
2017-05-11 18:12 - 2017-01-20 18:22 - 00000000 ____D C:\Users\Robin\AppData\Roaming\DAEMON Tools Lite
2017-05-11 18:11 - 2017-01-23 18:42 - 00000000 ____D C:\Windows\Minidump
2017-05-10 16:13 - 2016-11-16 22:08 - 00482608 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2017-05-10 16:13 - 2016-11-16 22:08 - 00279800 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
2017-05-10 16:13 - 2016-11-16 22:08 - 00107928 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2017-05-10 16:13 - 2016-11-16 22:08 - 00090336 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2017-05-10 16:13 - 2016-11-16 22:08 - 00062152 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2017-05-10 16:13 - 2016-11-16 22:08 - 00034136 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2017-05-10 16:12 - 2016-11-16 22:08 - 00764576 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2017-05-03 21:02 - 2017-01-22 09:55 - 00000000 ____D C:\Windows\system32\appmgmt
2017-04-29 09:18 - 2017-01-17 18:17 - 00000000 ____D C:\Program Files\Common Files\Steam
2017-04-27 21:28 - 2016-11-20 15:03 - 00001399 _____ C:\Users\Robin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2017-04-27 16:11 - 2017-01-22 01:33 - 00000000 ____D C:\Users\Robin\AppData\Roaming\NVIDIA
2017-04-27 15:45 - 2017-01-17 18:56 - 00000000 ____D C:\Windows\system32\directx
2017-04-24 21:48 - 2009-07-14 06:52 - 00000000 ____D C:\Windows\system32\FxsTmp

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

==================== BCD ================================

Správce spouštění systému Windows
--------------------
identifikátor {bootmgr}
device partition=C:
description Windows Boot Manager
locale cs-CZ
inherit {globalsettings}
default {current}
resumeobject {8dad4da0-ac24-11e6-9ec5-84645d583c32}
displayorder {current}
toolsdisplayorder {memdiag}
timeout 30

Zaváděcí program pro spouštění systému Windows
-------------------
identifikátor {current}
device partition=C:
path \Windows\system32\winload.exe
description Windows 7
locale cs-CZ
inherit {bootloadersettings}
recoverysequence {8dad4da2-ac24-11e6-9ec5-84645d583c32}
recoveryenabled Yes
osdevice partition=C:
systemroot \Windows
resumeobject {8dad4da0-ac24-11e6-9ec5-84645d583c32}
nx OptIn

Zaváděcí program pro spouštění systému Windows
-------------------
identifikátor {8dad4da2-ac24-11e6-9ec5-84645d583c32}
device ramdisk=[C:]\Recovery\8dad4da2-ac24-11e6-9ec5-84645d583c32\Winre.wim,{8dad4da3-ac24-11e6-9ec5-84645d583c32}
path \windows\system32\winload.exe
description Windows Recovery Environment
inherit {bootloadersettings}
osdevice ramdisk=[C:]\Recovery\8dad4da2-ac24-11e6-9ec5-84645d583c32\Winre.wim,{8dad4da3-ac24-11e6-9ec5-84645d583c32}
systemroot \windows
nx OptIn
winpe Yes

Obnovení z hibernace
---------------------
identifikátor {8dad4da0-ac24-11e6-9ec5-84645d583c32}
device partition=C:
path \Windows\system32\winresume.exe
description Windows Resume Application
locale cs-CZ
inherit {resumeloadersettings}
filedevice partition=C:
filepath \hiberfil.sys
pae Yes
debugoptionenabled No

Testování paměti systému Windows
---------------------
identifikátor {memdiag}
device partition=C:
path \boot\memtest.exe
description Diagnostika pamŘti syst‚mu Windows
locale cs-CZ
inherit {globalsettings}
badmemoryaccess Yes

Nastavení služby EMS
------------
identifikátor {emssettings}
bootems Yes

Nastavení ladicího programu
-----------------
identifikátor {dbgsettings}
debugtype Serial
debugport 1
baudrate 115200

Chyby paměti RAM
-----------
identifikátor {badmemory}

Globální nastavení
---------------
identifikátor {globalsettings}
inherit {dbgsettings}
{emssettings}
{badmemory}

Nastavení spouštěcího zavaděče
--------------------
identifikátor {bootloadersettings}
inherit {globalsettings}
{hypervisorsettings}

Nastavení hypervisoru
-------------------
identifikátor {hypervisorsettings}
hypervisordebugtype Serial
hypervisordebugport 1
hypervisorbaudrate 115200

Nastavení zavaděče obnovení
----------------------
identifikátor {resumeloadersettings}
inherit {globalsettings}

Parametry zařízení
--------------
identifikátor {8dad4da3-ac24-11e6-9ec5-84645d583c32}
description Ramdisk Options
ramdisksdidevice partition=C:
ramdisksdipath \Recovery\8dad4da2-ac24-11e6-9ec5-84645d583c32\boot.sdi


LastRegBack: 2017-05-13 14:56

==================== End of FRST.txt ============================

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 14-05-2017
Ran by Robin (16-05-2017 19:12:24)
Running from D:\Programy\Antivir\FRST
Microsoft Windows 7 Professional Service Pack 1 (X86) (2016-11-16 18:00:04)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Admin (S-1-5-21-2280049570-3098916696-629672514-500 - Administrator - Enabled)
Guest (S-1-5-21-2280049570-3098916696-629672514-501 - Limited - Disabled)
Robin (S-1-5-21-2280049570-3098916696-629672514-1001 - Administrator - Enabled) => C:\Users\Robin

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avast Antivirus (Enabled - Up to date) {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avast Antivirus (Enabled - Up to date) {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM\...\{90120000-0012-0000-0000-0000000FF1CE}_STANDARD_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
2007 Microsoft Office Suite Service Pack 3 (SP3) (Version: - Microsoft) Hidden
7-Zip 16.04 (HKLM\...\7-Zip) (Version: 16.04 - Igor Pavlov)
Aktualizace produktu Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0405-0000-0000000FF1CE}_STANDARD_{0A1FAC46-B899-421D-B1A2-470896DC45DB}) (Version: - Microsoft)
Aktualizace produktu Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0405-0000-0000000FF1CE}_STANDARD_{5260BB53-C1F7-4A3B-9AEB-3EC9B37FF194}) (Version: - Microsoft)
Aktualizace produktu Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0405-0000-0000000FF1CE}_STANDARD_{E68DD413-B834-4923-8181-0A03B7555187}) (Version: - Microsoft)
Ashampoo Burning Studio 6 FREE v.6.81 (HKLM\...\Ashampoo Burning Studio 6 FREE_is1) (Version: 6.8.1 - Ashampoo GmbH & Co. KG)
Avast Free Antivirus (HKLM\...\Avast Antivirus) (Version: 17.4.2294 - AVAST Software)
CCleaner (HKLM\...\CCleaner) (Version: 5.29 - Piriform)
DAEMON Tools Lite (HKLM\...\DAEMON Tools Lite) (Version: 10.5.1.0230 - Disc Soft Ltd)
EAX Unified (HKLM\...\EAX Unified) (Version: - )
Gameforge Live 2.0.12 (HKLM\...\{9C98989A-3A15-42DA-A3B9-D20331437D67}}_is1) (Version: 2.0.12 - Gameforge)
Google Update Helper (Version: 1.3.21.169 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.33.5 - Google Inc.) Hidden
Java 8 Update 131 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F32180131F0}) (Version: 8.0.1310.11 - Oracle Corporation)
LibreOffice 5.3.2.2 (HKLM\...\{8DA98699-6AD4-49CF-A9A0-B5E7B7981BE6}) (Version: 5.3.2.2 - The Document Foundation)
Microsoft .NET Framework 4.6.1 (čeština) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1029) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft .NET Framework 4.6.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Standard 2007 (HKLM\...\STANDARD) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Mozilla Firefox 54.0 (x86 cs) (HKLM\...\Mozilla Firefox 54.0 (x86 cs)) (Version: 54.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 54.0.0.6340 - Mozilla)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.57.35 - NVIDIA Corporation)
NVIDIA Ovladač 3D Vision 342.00 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 342.00 - NVIDIA Corporation)
NVIDIA Ovladače grafiky 342.00 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 342.00 - NVIDIA Corporation)
NVIDIA Systémový software PhysX 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
Ovládací panel NVIDIA 342.00 (Version: 342.00 - NVIDIA Corporation) Hidden
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6662 - Realtek Semiconductor Corp.)
Steam (HKLM\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0012-0000-0000-0000000FF1CE}_STANDARD_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
VLC media player (HKLM\...\VLC media player) (Version: 2.2.4 - VideoLAN)
XnView 2.39 (HKLM\...\XnView_is1) (Version: 2.39 - Gougelet Pierre-e)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {818C99B4-027A-4430-8279-6C31B7255E5A} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2017-04-11] (Piriform Ltd)
Task: {D60DDC54-AA84-4C38-AF33-0503BE59DDDA} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2017-04-16] (AVAST Software)
Task: {FAEB389A-702C-4765-BBE7-B0CD41C1AEC4} - System32\Tasks\Avast Emergency Update => C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe [2017-05-10] (AVAST Software)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2017-05-10 16:12 - 2017-05-10 16:12 - 00170216 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2017-05-10 16:12 - 2017-05-10 16:12 - 00176992 _____ () C:\Program Files\AVAST Software\Avast\event_routing_rpc.dll
2017-05-10 16:12 - 2017-05-10 16:12 - 00223224 _____ () C:\Program Files\AVAST Software\Avast\tasks_core.dll
2017-05-14 12:00 - 2017-05-14 12:00 - 05978624 _____ () C:\Program Files\AVAST Software\Avast\defs\17051402\algo.dll
2017-05-10 16:12 - 2017-05-10 16:12 - 00684656 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2017-05-16 19:08 - 2017-05-16 19:08 - 06084088 _____ () C:\Program Files\AVAST Software\Avast\defs\17051602\algo.dll
2016-11-16 22:00 - 2016-10-18 15:48 - 00121792 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax.dll
2017-05-10 16:13 - 2017-05-10 16:13 - 00997896 _____ () C:\Program Files\AVAST Software\Avast\AvChrome.dll
2017-05-10 16:13 - 2017-05-10 16:13 - 67717632 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2017-05-10 16:12 - 2017-05-10 16:12 - 00291824 _____ () C:\Program Files\AVAST Software\Avast\gaming_mode_ui.dll
2017-04-11 00:57 - 2017-04-11 00:57 - 00065536 _____ () C:\Program Files\CCleaner\lang\lang-1029.dll
2017-05-10 16:12 - 2017-05-10 16:12 - 00134920 _____ () c:\Program Files\AVAST Software\Avast\vaarclient.dll
2017-05-10 16:12 - 2017-05-10 16:12 - 00230632 _____ () c:\Program Files\AVAST Software\Avast\StreamBack.dll
2016-03-05 12:42 - 2015-10-11 03:33 - 07731219 _____ () D:\Programy\Double Commander\doublecmd.exe

==================== Alternate Data Streams (Whitelisted) =========

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)


==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 _____ C:\Windows\system32\Drivers\etc\hosts


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2280049570-3098916696-629672514-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Robin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 217.31.204.130 - 193.29.206.206
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 2) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{BA3A3260-253F-47AD-937F-652453053866}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{8E0570A2-B085-43E8-8227-CC0E0CAE6062}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [{7CA772C9-46C4-4C69-A354-2CA9DB332B40}] => (Allow) C:\Program Files\Steam\Steam.exe
FirewallRules: [{C27E1565-BB55-405A-A62B-7F31C123593B}] => (Allow) C:\Program Files\Steam\Steam.exe
FirewallRules: [{F9E2EF1B-3C7D-4919-937B-C93F6E1D7E0C}] => (Allow) C:\Program Files\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{43D6A19D-81EF-40A9-A1E4-68F778329586}] => (Allow) C:\Program Files\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [TCP Query User{44B11899-31C5-4E38-AE8F-5D5F12030906}G:\farming.simulator.17.v1.2.0.0\farming.simulator.17.v1.2.0.0\x86\farmingsimulator2017game.exe] => (Allow) G:\farming.simulator.17.v1.2.0.0\farming.simulator.17.v1.2.0.0\x86\farmingsimulator2017game.exe
FirewallRules: [UDP Query User{8D73E64E-945C-42E7-9D19-58B43AA3C6E2}G:\farming.simulator.17.v1.2.0.0\farming.simulator.17.v1.2.0.0\x86\farmingsimulator2017game.exe] => (Allow) G:\farming.simulator.17.v1.2.0.0\farming.simulator.17.v1.2.0.0\x86\farmingsimulator2017game.exe
FirewallRules: [TCP Query User{C89DA579-77EF-46E4-905C-2C5F9FEA9A18}D:\profily\robin\plocha\farming.simulator.17.v1.2.0.0\farming.simulator.17.v1.2.0.0\x86\farmingsimulator2017game.exe] => (Block) D:\profily\robin\plocha\farming.simulator.17.v1.2.0.0\farming.simulator.17.v1.2.0.0\x86\farmingsimulator2017game.exe
FirewallRules: [UDP Query User{6BE80F2E-53B1-47A4-A50B-2E6C3CF88AFE}D:\profily\robin\plocha\farming.simulator.17.v1.2.0.0\farming.simulator.17.v1.2.0.0\x86\farmingsimulator2017game.exe] => (Block) D:\profily\robin\plocha\farming.simulator.17.v1.2.0.0\farming.simulator.17.v1.2.0.0\x86\farmingsimulator2017game.exe
FirewallRules: [{55B1F34F-A1B9-48C3-9243-646127912F96}] => (Allow) C:\Program Files\GameforgeLive\gfl_client.exe
FirewallRules: [TCP Query User{B77ED99A-9D12-4A01-A47C-149B0B4CA9F2}C:\program files\mozilla firefox\plugin-container.exe] => (Block) C:\program files\mozilla firefox\plugin-container.exe
FirewallRules: [UDP Query User{077B1DD5-2ED7-423A-BAEC-F5945D3FC575}C:\program files\mozilla firefox\plugin-container.exe] => (Block) C:\program files\mozilla firefox\plugin-container.exe

==================== Restore Points =========================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

==================== Memory info ===========================

Processor: AMD Athlon(tm) II X2 250 Processor
Percentage of memory in use: 46%
Total physical RAM: 2046.49 MB
Available physical RAM: 1088.25 MB
Total Virtual: 4092.98 MB
Available Virtual: 3014.27 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:256 GB) (Free:236.17 GB) NTFS ==>[drive with boot components (obtained from BCD)]
Drive d: (Data) (Fixed) (Total:675.51 GB) (Free:658.99 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 03070306)
Partition 1: (Active) - (Size=256 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=675.5 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

[JaRon]

ahoj,
log vypada OK

[JerryK_736]

Ahoj,
Díky za dobré zprávy a Tvůj čas.
Jestli můžeš, zamkni vlákno.

Ještě jednou díky a hezký den.

[JaRon]

aj Tebe pekny den
Lock