Úplnou náhodou jsem si všiml, že jsou v mém HOSTS úplně cizí záznamy, např.:
127.0.0.1 down.baidu2016.com
a hromada jiných.
Proto bych chtěl poprosit o pomoc a radu, jak virus odstranit (klasické "naivní" metody nefungují). Přikládám i RSIT log:
Logfile of random's system information tool 1.10 (written by random/random)
Run by NG at 2017-01-26 10:14:06
Microsoft Windows 10 Home
System drive C: has 6 GB (5%) free of 118 GB
Total RAM: 8107 MB (43% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:14:07, on 26. 1. 2017
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.14393.0000)
Boot mode: Normal
Running processes:
C:\ProgramData\Samsung\ShutdownEvent.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
C:\Users\NG\AppData\Local\Microsoft\OneDrive\OneDrive.exe
C:\Users\NG\AppData\Local\FluxSoftware\Flux\flux.exe
C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe
C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\CCXProcess.exe
C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\libs\node.exe
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe
D:\Apps\cmder\vendor\conemu-maximus5\ConEmu.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Program Files\trend micro\NG.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://samsung13.msn.com/?pc=smjb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkID= ... 837A28B43B
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=
O1 - Hosts: 130.195.2.40 stage.victoria.ac.nz
O1 - Hosts: 130.195.2.40 cms.victoria.ac.nz
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_51\bin\ssv.dll
O2 - BHO: Evernote extension - {92EF2EAD-A7CE-4424-B0DB-499CF856608E} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll
O2 - BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\PROGRA~2\MICROS~3\Office15\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_51\bin\jp2ssv.dll
O4 - HKLM\..\Run: [MMReminderService] d:\Apps\MindjetManager\MMReminderService.exe
O4 - HKLM\..\Run: [AdobeCEPServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Creative Cloud] "C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe" --showwindow=false --onOSstartup=true
O4 - HKCU\..\Run: [Dropbox Update] "C:\Users\NG\AppData\Local\Dropbox\Update\DropboxUpdate.exe" /c
O4 - HKCU\..\Run: [OneDrive] "C:\Users\NG\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
O4 - HKCU\..\Run: [f.lux] "C:\Users\NG\AppData\Local\FluxSoftware\Flux\flux.exe" /noshow
O4 - HKUS\S-1-5-19\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [Application Restart #2] C:\ProgramData\Samsung\SamsungSystemConfiguration\SamsungConfigurationMonitor.exe /RestartByRestartManager:2FB77B91-7884-430b-B25F-1189F371C7C4 (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Application Restart #0] C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe /Crashed (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [Application Restart #2] C:\ProgramData\Samsung\SamsungSystemConfiguration\SamsungConfigurationMonitor.exe /RestartByRestartManager:2FB77B91-7884-430b-B25F-1189F371C7C4 (User 'Default user')
O4 - Startup: EvernoteClipper.lnk = C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
O4 - Startup: no_zoom_chrome.exe.lnk
O4 - Global Startup: iBTAudioMon.lnk = C:\Program Files (x86)\Intel\HPWA\iBTAudioMon.exe
O8 - Extra context menu item: Clip bookmark - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=0
O8 - Extra context menu item: Clip image - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=4
O8 - Extra context menu item: Clip selection - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=3
O8 - Extra context menu item: Clip this page - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=1
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\Apps\MSOffice\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: New note - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\NewNote.html
O8 - Extra context menu item: Send Image To Mindjet - res://d:\Apps\MindjetManager\Mm8InternetExplorer.dll/201
O8 - Extra context menu item: Send Link To Mindjet - res://d:\Apps\MindjetManager\Mm8InternetExplorer.dll/203
O8 - Extra context menu item: Send Page To Mindjet - res://d:\Apps\MindjetManager\Mm8InternetExplorer.dll/204
O8 - Extra context menu item: Send Text To Mindjet - res://d:\Apps\MindjetManager\Mm8InternetExplorer.dll/202
O9 - Extra button: @C:\Program Files (x86)\Evernote\Evernote\OLIEResource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\AddNote.html
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Evernote\Evernote\OLIEResource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\AddNote.html
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {538793D5-659C-4639-A56C-A179AD87ED44} (Cisco AnyConnect Secure Mobility Client Web Control) - https://vpn.vuw.ac.nz/CACHE/stc/2/binaries/vpnweb.cab
O18 - Protocol: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files (x86)\Microsoft Office\Office15\MSOSB.DLL
O18 - Protocol: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Protocol: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter hijack: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: AdobeUpdateService - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe
O23 - Service: Adobe Genuine Software Integrity Service (AGSService) - Adobe Systems, Incorporated - C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\WINDOWS\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @%SystemRoot%\system32\DiagSvcs\DiagnosticsHub.StandardCollector.ServiceRes.dll,-1000 (diagnosticshub.standardcollector.service) - Unknown owner - C:\WINDOWS\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: Elan Service (ETDService) - ELAN Microelectronics Corp. - C:\Program Files\Elantech\ETDService.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\WINDOWS\system32\fxssvc.exe (file missing)
O23 - Service: GoPro Device Detection Service (GoProDeviceDetectionService) - Unknown owner - D:\Apps\QuikGoPro\GoPro Desktop App\GoProDeviceDetection.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Intel(R) Wireless Bluetooth(R) Audio Service (iBTAudioSrv) - Intel Corporation - C:\Program Files (x86)\Intel\HPWA\iBTAudioSrv.exe
O23 - Service: @oem2.inf,%SERVICE_NAME%;Intel Bluetooth Service (ibtsiva) - Unknown owner - C:\WINDOWS\system32\ibtsiva (file missing)
O23 - Service: Intel(R) HD Graphics Control Panel Service (igfxCUIService2.0.0.0) - Unknown owner - C:\WINDOWS\system32\igfxCUIService.exe (file missing)
O23 - Service: Intel(R) Capability Licensing Service TCP IP Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
O23 - Service: Intel(R) Update Manager (iumsvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe
O23 - Service: Intel(R) Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: postgresql-x64-9.3 - PostgreSQL Server 9.3 (postgresql-x64-9.3) - PostgreSQL Global Development Group - D:\Apps\Postgres\bin\pg_ctl.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: SamsungSystemConfiguration - Samsung Electronics CO., LTD. - C:\ProgramData\Samsung\SamsungSystemConfiguration\SamsungSystemConfiguration.exe
O23 - Service: @%SystemRoot%\system32\SensorDataService.exe,-101 (SensorDataService) - Unknown owner - C:\WINDOWS\System32\SensorDataService.exe (file missing)
O23 - Service: Settings Launcher - Samsung Electronics CO., LTD. - C:\Program Files (x86)\Samsung\Settings\CmdServer\SettingsLauncher.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - D:\Apps\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\WINDOWS\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\WINDOWS\system32\sppsvc.exe (file missing)
O23 - Service: SW Update Service (SWUpdateService) - Samsung Electronics Co., Ltd. - C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe
O23 - Service: @%SystemRoot%\system32\TieringEngineService.exe,-702 (TieringEngineService) - Unknown owner - C:\WINDOWS\system32\TieringEngineService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\WINDOWS\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\WINDOWS\system32\vssvc.exe (file missing)
O23 - Service: wampapache64 - Apache Software Foundation - D:\Apps\Wamp\bin\apache\apache2.4.9\bin\httpd.exe
O23 - Service: wampmysqld64 - Unknown owner - D:\Apps\Wamp\bin\mysql\mysql5.6.17\bin\mysqld.exe
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\WINDOWS\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
--
End of file - 13755 bytes
======Listing Processes======
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k RPCSS
C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted
C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\System32\svchost.exe -k NetworkService
C:\WINDOWS\system32\igfxCUIService.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-64c3c4cf-a86e-4478-9e3a-6d8e360903b5 -SystemEventPortName:HostProcess-ea4aeb19-30d6-44d9-a5c9-7cdcdd544c69 -IoCancelEventPortName:HostProcess-f7ef327d-5249-4781-b66c-b37fc89693c6 -NonStateChangingEventPortName:HostProcess-e46af3ae-d8c5-41d6-8f0e-f03016ab0da8 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:40cb585f-0e38-439d-9999-1de1f07e761c -DeviceGroupId:WudfDefaultDevicePool
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\WINDOWS\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted
C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted
C:\WINDOWS\System32\spoolsv.exe
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe"
"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe"
C:\WINDOWS\System32\svchost.exe -k utcsvc
"C:\Program Files\Elantech\ETDService.exe"
"C:\Program Files (x86)\Intel\HPWA\iBTAudioSrv.exe"
C:\WINDOWS\system32\ibtsiva
C:\WINDOWS\system32\PnkBstrA.exe
"D:\Apps\Postgres\bin\pg_ctl.exe" runservice -N "postgresql-x64-9.3" -D "D:/Apps/Postgres/data" -w
"C:\Program Files (x86)\Samsung\Settings\CmdServer\SettingsLauncher.exe"
"C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe" /SERVICE
C:\WINDOWS\system32\svchost.exe -k appmodel
C:\WINDOWS\system32\svchost.exe -k imgsvc
dashost.exe {cfd8d96f-a452-49ca-b8eae5cfe344bb21}
"D:\Apps\Postgres\bin\postgres.exe" -D "D:/Apps/Postgres/data"
\??\C:\WINDOWS\system32\conhost.exe 0x4
"D:/Apps/Postgres/bin/postgres.exe" "--forklog" "5124" "5128"
"D:/Apps/Postgres/bin/postgres.exe" "--forkboot" "4964" "-x4"
"D:/Apps/Postgres/bin/postgres.exe" "--forkboot" "4980" "-x3"
"D:/Apps/Postgres/bin/postgres.exe" "--forkboot" "4952" "-x5"
"D:/Apps/Postgres/bin/postgres.exe" "--forkavlauncher" "4944"
"D:/Apps/Postgres/bin/postgres.exe" "--forkcol" "4936"
C:\WINDOWS\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\WINDOWS\system32\SearchIndexer.exe /Embedding
"D:\Apps\QuikGoPro\GoPro Desktop App\GoProDeviceDetection.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe"
C:\ProgramData\Samsung\SamsungSystemConfiguration\SamsungSystemConfiguration.exe
C:\WINDOWS\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\WinLogon.exe -SpecialSession
"dwm.exe"
"C:\Program Files\Elantech\ETDCtrl.exe"
C:\ProgramData\Samsung\SamsungSystemConfiguration\SamsungConfigurationMonitor.exe
sihost.exe
C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /c
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
C:\ProgramData\Samsung\ShutdownEvent.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
"C:\Program Files\Elantech\ETDTouch.exe"
igfxEM.exe
igfxHK.exe
C:\WINDOWS\Explorer.EXE
igfxTray.exe
"C:\Program Files\Elantech\ETDCtrlHelper.exe"
"C:\Program Files (x86)\Samsung\Settings\CmdServer\SettingsCmdServer.exe"
"C:\Program Files (x86)\Samsung\Settings\CmdServer\SettingsEventHandler.exe"
"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
/QuitInfo:0000000000001664;0000000000001F60;
/loadhooks /Parent:0000000000002670
"C:\WINDOWS\system32\igfxext.exe" -Embedding
C:\Windows\System32\SystemSettingsBroker.exe -Embedding
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files\Windows Defender\MSASCuiL.exe"
"D:\Apps\QuikGoPro\GoPro Desktop App\GoProDesktopSystemTray.exe"
"C:\Users\NG\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
"C:\Users\NG\AppData\Local\FluxSoftware\Flux\flux.exe" /noshow
"C:\Program Files (x86)\Intel\HPWA\iBTAudioMon.exe"
"C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe" --showwindow=false --onOSstartup=true
"C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe" "-launchedbyvulcan"
"fontdrvhost.exe"
"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe" --onOSstartup=true --showwindow=false --waitForRegistration=true
"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe" --type=renderer --disable-3d-apis --disable-pinch --no-sandbox --enable-deferred-image-decoding --lang=en-US --lang=en-US --locales-dir-path="C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\CEF\locales" --log-file="C:\Users\NG\AppData\Local\Temp\CreativeCloud\ACC\CEF.log" --log-severity=warning --user-agent="Mozilla/5.0 (Windows NT 10.0.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/537.36 CreativeCloud/3.9.0.327" --device-scale-factor=1 --enable-delegated-renderer --enable-impl-side-painting --num-raster-threads=1 --disable-gpu-compositing --channel="1440.0.124743528\1431715766" /prefetch:673131151
"C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe"
"C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\CCXProcess.exe"
"C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\libs\node.exe" "C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\js\main.js"
\??\C:\WINDOWS\system32\conhost.exe 0x4
"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe" --type=renderer --disable-3d-apis --disable-pinch --no-sandbox --enable-deferred-image-decoding --lang=en-US --lang=en-US --locales-dir-path="C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\CEF\locales" --log-file="C:\Users\NG\AppData\Local\Temp\CreativeCloud\ACC\CEF.log" --log-severity=warning --user-agent="Mozilla/5.0 (Windows NT 10.0.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/537.36 CreativeCloud/3.9.0.327" --device-scale-factor=1 --enable-delegated-renderer --enable-impl-side-painting --num-raster-threads=1 --disable-gpu-compositing --channel="1440.1.2080127442\1670664537" /prefetch:673131151
"C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" /SRSSA
"C:\Program Files\Samsung\S Agent\CommonAgent.exe"
C:\WINDOWS\system32\SettingSyncHost.exe -Embedding
"C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE15\CSISYN~1.EXE" -Embedding
C:\WINDOWS\system32\DllHost.exe /Processid:{49F6E667-6658-4BD1-9DE9-6AF87F9FAF85}
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler /prefetch:7 "--database=C:\Users\NG\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\NG\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel=beta --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=56.0.2924.67 --initial-client-data=0x1c0,0x1c4,0x1c8,0x1bc,0x1cc,0x7fff559c1110,0x7fff559c1148,0x7fff559c1120
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=6428 --on-initialized-event-handle=588 --parent-handle=596 /prefetch:6
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --enable-features=*AutofillCreditCardSigninPromo<AutofillCreditCardSigninPromo,BlockSmallPluginContent<PluginPowerSaverTiny,EnableSyncClientToServerCompression<EnableSyncClientToServerCompression,ExpectCTReporting<ExpectCTReporting,*ExpensiveBackgroundTimerThrottling<ExpensiveBackgroundTimerThrottling,*ExperimentalSwReporterEngine<SRTExperimentalEngineTrial,MaterialDesignUserManager<MaterialDesignUserManager,MediaFoundationH264Encoding<MediaFoundationH264Encoding,MetricsReporting<MetricsAndCrashSampling,NegotiateTLS13<TLS13Negotiation,PersistentHistograms<PersistentHistograms,SecurityChip<SecurityChip,SecurityWarningIconUpdate<SecurityWarningIconUpdate,SubresourceFilter<SubresourceFilter,SwReporterExtendedSafeBrowsingFeature<SwReporterExtendedSafeBrowsingFeature,*TimerThrottlingForHiddenFrames<TimerThrottlingForHiddenFrames,*TranslateUI2016Q2<TranslateUI2016Q2 --disable-features=AutofillProfileCleanup<AutofillProfileCleanup,DefaultEnableGpuRasterization<DefaultEnableGpuRasterization,DisableFirstRunAutoImport<DisableFirstRunAutoImport,DocumentWriteEvaluator<DisallowFetchForDocWrittenScriptsInMainFrame,NewAudioRenderingMixingStrategy<NewAudioRenderingMixingStrategy,ParseHTMLOnMainThread<ParseHTMLOnMainThread,PreferHtmlOverPlugins<Html5ByDefault,PrintScaling<PrintScaling,UpdateRendererPriorityOnStartup<UpdateRendererPriorityOnStartup --force-fieldtrials=AppBannerTriggering/site-engagement-eager/AutofillCreditCardSigninPromo/Default/AutofillProfileCleanup/Control/CSSExternalScanner/Enabled_ScanOnly/CaptivePortalInterstitial/Enabled/*ChromeChannelBeta/Enabled/*ChromeSuggestionsTuning/MergeByRedirectsBeta_Control/ClientSideDetectionModel/Model1/DataReductionProxyUseQuic/Control9/DefaultBrowserPromptStyle/ColoredIconOnWhiteInfoBar3/DefaultEnableGpuRasterization/Control/DisableFirstRunAutoImport/Control/DisallowFetchForDocWrittenScriptsInMainFrame/Control/EnableAppContainer/Control/EnableSyncClientToServerCompression/Enabled/ExpectCTReporting/ExpectCTReportingEnabled/ExpensiveBackgroundTimerThrottling/Default/ExtensionDeveloperModeWarning/Enabled/Html5ByDefault/Control/InstanceID/Enabled/MarkNonSecureAs/Control/MaterialDesignUserManager/Enabled/MediaFoundationH264Encoding/Enabled/MetricsAndCrashSampling/InReportingSample/*NetworkQualityEstimator/Enabled/OfferUploadCreditCards/Enabled/OmniboxBundledExperimentV1/ChromeDesktopPSuggestOnTopExperimentBeta/ParseHTMLOnMainThread/Default/*PasswordGeneration/Enabled/PasswordManagerSettingsMigration/Enable/*PersistentHistograms/EnabledInMemory/PluginPowerSaverTiny/Enabled/PrintScaling/Default/*QUIC/EnabledServerMigrationTake2/ReportCertificateErrors/ShowAndPossiblySend/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/SRTExperimentalEngineTrial/Default/*SRTPromptFieldTrial/On/SSLCommonNameMismatchHandling/Enabled/SafeBrowsingIncidentReportingService/Enabled/SafeBrowsingUnverifiedDownloads/DisableByParameterMostSbTypes2/SaveAsMenuText/control/SecurityChip/Enabled/SecurityWarningIconUpdate/Enabled/SignInPasswordPromo/Enable3/SiteEngagement/Default/*SiteIsolationExtensions/Enabled/SubresourceFilter/EnabledForPhishingSites/*SwReporterExtendedSafeBrowsingFeature/Enabled/*TLS13Negotiation/Enabled/TimerThrottlingForHiddenFrames/Default/TranslateServerStudy/Default/TriggeredResetFieldTrial/On/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-1-Percent/group_47/*UMA-Uniformity-Trial-10-Percent/group_05/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/group_01/*UMA-Uniformity-Trial-5-Percent/group_18/*UMA-Uniformity-Trial-50-Percent/default/WebFontsInterventionV2/Default/ --supports-dual-gpus=false --gpu-driver-bug-workarounds=7,19,23,40,59,71 --gpu-vendor-id=0x8086 --gpu-device-id=0x0a16 --gpu-driver-vendor="Intel Corporation" --gpu-driver-version=20.19.15.4483 --gpu-driver-date=7-1-2016 --service-request-channel-token=5F9B2A5BCAD437A90DCC35B2A97DBAF9 --mojo-platform-channel-handle=1284 --ignored=" --type=renderer " /prefetch:2
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-features=*AutofillCreditCardSigninPromo<AutofillCreditCardSigninPromo,BlockSmallPluginContent<PluginPowerSaverTiny,EnableSyncClientToServerCompression<EnableSyncClientToServerCompression,ExpectCTReporting<ExpectCTReporting,*ExpensiveBackgroundTimerThrottling<ExpensiveBackgroundTimerThrottling,*ExperimentalSwReporterEngine<SRTExperimentalEngineTrial,MaterialDesignUserManager<MaterialDesignUserManager,MediaFoundationH264Encoding<MediaFoundationH264Encoding,MetricsReporting<MetricsAndCrashSampling,NegotiateTLS13<TLS13Negotiation,PersistentHistograms<PersistentHistograms,SecurityChip<SecurityChip,SecurityWarningIconUpdate<SecurityWarningIconUpdate,SubresourceFilter<SubresourceFilter,SwReporterExtendedSafeBrowsingFeature<SwReporterExtendedSafeBrowsingFeature,*TimerThrottlingForHiddenFrames<TimerThrottlingForHiddenFrames,*TranslateUI2016Q2<TranslateUI2016Q2 --disable-features=AutofillProfileCleanup<AutofillProfileCleanup,DefaultEnableGpuRasterization<DefaultEnableGpuRasterization,DisableFirstRunAutoImport<DisableFirstRunAutoImport,DocumentWriteEvaluator<DisallowFetchForDocWrittenScriptsInMainFrame,NewAudioRenderingMixingStrategy<NewAudioRenderingMixingStrategy,ParseHTMLOnMainThread<ParseHTMLOnMainThread,PreferHtmlOverPlugins<Html5ByDefault,PrintScaling<PrintScaling,UpdateRendererPriorityOnStartup<UpdateRendererPriorityOnStartup --force-fieldtrials=*AppBannerTriggering/site-engagement-eager/AutofillCreditCardSigninPromo/Default/*AutofillProfileCleanup/Control/*CSSExternalScanner/Enabled_ScanOnly/CaptivePortalInterstitial/Enabled/*ChromeChannelBeta/Enabled/*ChromeSuggestionsTuning/MergeByRedirectsBeta_Control/*ClientSideDetectionModel/Model1/DataReductionProxyUseQuic/Control9/DefaultBrowserPromptStyle/ColoredIconOnWhiteInfoBar3/DefaultEnableGpuRasterization/Control/DisableFirstRunAutoImport/Control/*DisallowFetchForDocWrittenScriptsInMainFrame/Control/*EnableAppContainer/Control/EnableSyncClientToServerCompression/Enabled/ExpectCTReporting/ExpectCTReportingEnabled/*ExpensiveBackgroundTimerThrottling/Default/ExtensionDeveloperModeWarning/Enabled/Html5ByDefault/Control/*InstanceID/Enabled/MarkNonSecureAs/Control/MaterialDesignUserManager/Enabled/MediaFoundationH264Encoding/Enabled/MetricsAndCrashSampling/InReportingSample/*NetworkQualityEstimator/Enabled/OfferUploadCreditCards/Enabled/*OmniboxBundledExperimentV1/ChromeDesktopPSuggestOnTopExperimentBeta/*ParseHTMLOnMainThread/Default/*PasswordGeneration/Enabled/*PasswordManagerSettingsMigration/Enable/*PersistentHistograms/EnabledInMemory/PluginPowerSaverTiny/Enabled/PrintScaling/Default/*QUIC/EnabledServerMigrationTake2/ReportCertificateErrors/ShowAndPossiblySend/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/SRTExperimentalEngineTrial/Default/*SRTPromptFieldTrial/On/SSLCommonNameMismatchHandling/Enabled/*SafeBrowsingIncidentReportingService/Enabled/SafeBrowsingUnverifiedDownloads/DisableByParameterMostSbTypes2/SaveAsMenuText/control/*SecurityChip/Enabled/SecurityWarningIconUpdate/Enabled/SignInPasswordPromo/Enable3/*SiteEngagement/Default/*SiteIsolationExtensions/Enabled/*SubresourceFilter/EnabledForPhishingSites/*SwReporterExtendedSafeBrowsingFeature/Enabled/*TLS13Negotiation/Enabled/TimerThrottlingForHiddenFrames/Default/TranslateServerStudy/Default/*TriggeredResetFieldTrial/On/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-1-Percent/group_47/*UMA-Uniformity-Trial-10-Percent/group_05/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/group_01/*UMA-Uniformity-Trial-5-Percent/group_18/*UMA-Uniformity-Trial-50-Percent/default/WebFontsInterventionV2/Default/ --primordial-pipe-token=E81E5C1F3769BB34AE3E86A26ECF4FE4 --lang=cs --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=false,cssExternalScannerNoPreload=true,cssExternalScannerPreload=false --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=E81E5C1F3769BB34AE3E86A26ECF4FE4 --renderer-client-id=4 --mojo-platform-channel-handle=3008 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-features=*AutofillCreditCardSigninPromo<AutofillCreditCardSigninPromo,BlockSmallPluginContent<PluginPowerSaverTiny,EnableSyncClientToServerCompression<EnableSyncClientToServerCompression,ExpectCTReporting<ExpectCTReporting,*ExpensiveBackgroundTimerThrottling<ExpensiveBackgroundTimerThrottling,*ExperimentalSwReporterEngine<SRTExperimentalEngineTrial,MaterialDesignUserManager<MaterialDesignUserManager,MediaFoundationH264Encoding<MediaFoundationH264Encoding,MetricsReporting<MetricsAndCrashSampling,NegotiateTLS13<TLS13Negotiation,PersistentHistograms<PersistentHistograms,SecurityChip<SecurityChip,SecurityWarningIconUpdate<SecurityWarningIconUpdate,SubresourceFilter<SubresourceFilter,SwReporterExtendedSafeBrowsingFeature<SwReporterExtendedSafeBrowsingFeature,*TimerThrottlingForHiddenFrames<TimerThrottlingForHiddenFrames,*TranslateUI2016Q2<TranslateUI2016Q2 --disable-features=AutofillProfileCleanup<AutofillProfileCleanup,DefaultEnableGpuRasterization<DefaultEnableGpuRasterization,DisableFirstRunAutoImport<DisableFirstRunAutoImport,DocumentWriteEvaluator<DisallowFetchForDocWrittenScriptsInMainFrame,NewAudioRenderingMixingStrategy<NewAudioRenderingMixingStrategy,ParseHTMLOnMainThread<ParseHTMLOnMainThread,PreferHtmlOverPlugins<Html5ByDefault,PrintScaling<PrintScaling,UpdateRendererPriorityOnStartup<UpdateRendererPriorityOnStartup --force-fieldtrials=*AppBannerTriggering/site-engagement-eager/AutofillCreditCardSigninPromo/Default/*AutofillProfileCleanup/Control/*CSSExternalScanner/Enabled_ScanOnly/CaptivePortalInterstitial/Enabled/*ChromeChannelBeta/Enabled/*ChromeSuggestionsTuning/MergeByRedirectsBeta_Control/*ClientSideDetectionModel/Model1/DataReductionProxyUseQuic/Control9/DefaultBrowserPromptStyle/ColoredIconOnWhiteInfoBar3/DefaultEnableGpuRasterization/Control/DisableFirstRunAutoImport/Control/*DisallowFetchForDocWrittenScriptsInMainFrame/Control/*EnableAppContainer/Control/EnableSyncClientToServerCompression/Enabled/ExpectCTReporting/ExpectCTReportingEnabled/*ExpensiveBackgroundTimerThrottling/Default/ExtensionDeveloperModeWarning/Enabled/Html5ByDefault/Control/*InstanceID/Enabled/MarkNonSecureAs/Control/MaterialDesignUserManager/Enabled/MediaFoundationH264Encoding/Enabled/MetricsAndCrashSampling/InReportingSample/*NetworkQualityEstimator/Enabled/OfferUploadCreditCards/Enabled/*OmniboxBundledExperimentV1/ChromeDesktopPSuggestOnTopExperimentBeta/*ParseHTMLOnMainThread/Default/*PasswordGeneration/Enabled/*PasswordManagerSettingsMigration/Enable/*PersistentHistograms/EnabledInMemory/PluginPowerSaverTiny/Enabled/PrintScaling/Default/*QUIC/EnabledServerMigrationTake2/ReportCertificateErrors/ShowAndPossiblySend/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/SRTExperimentalEngineTrial/Default/*SRTPromptFieldTrial/On/SSLCommonNameMismatchHandling/Enabled/*SafeBrowsingIncidentReportingService/Enabled/SafeBrowsingUnverifiedDownloads/DisableByParameterMostSbTypes2/SaveAsMenuText/control/*SecurityChip/Enabled/SecurityWarningIconUpdate/Enabled/SignInPasswordPromo/Enable3/*SiteEngagement/Default/*SiteIsolationExtensions/Enabled/*SubresourceFilter/EnabledForPhishingSites/*SwReporterExtendedSafeBrowsingFeature/Enabled/*TLS13Negotiation/Enabled/TimerThrottlingForHiddenFrames/Default/TranslateServerStudy/Default/*TriggeredResetFieldTrial/On/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-1-Percent/group_47/*UMA-Uniformity-Trial-10-Percent/group_05/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/group_01/*UMA-Uniformity-Trial-5-Percent/group_18/*UMA-Uniformity-Trial-50-Percent/default/WebFontsInterventionV2/Default/ --primordial-pipe-token=BACF4C1D3C416444D8FA06CBB0D35153 --lang=cs --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=false,cssExternalScannerNoPreload=true,cssExternalScannerPreload=false --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=BACF4C1D3C416444D8FA06CBB0D35153 --renderer-client-id=5 --mojo-platform-channel-handle=2916 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-features=*AutofillCreditCardSigninPromo<AutofillCreditCardSigninPromo,BlockSmallPluginContent<PluginPowerSaverTiny,EnableSyncClientToServerCompression<EnableSyncClientToServerCompression,ExpectCTReporting<ExpectCTReporting,*ExpensiveBackgroundTimerThrottling<ExpensiveBackgroundTimerThrottling,*ExperimentalSwReporterEngine<SRTExperimentalEngineTrial,MaterialDesignUserManager<MaterialDesignUserManager,MediaFoundationH264Encoding<MediaFoundationH264Encoding,MetricsReporting<MetricsAndCrashSampling,NegotiateTLS13<TLS13Negotiation,PersistentHistograms<PersistentHistograms,SecurityChip<SecurityChip,SecurityWarningIconUpdate<SecurityWarningIconUpdate,SubresourceFilter<SubresourceFilter,SwReporterExtendedSafeBrowsingFeature<SwReporterExtendedSafeBrowsingFeature,*TimerThrottlingForHiddenFrames<TimerThrottlingForHiddenFrames,*TranslateUI2016Q2<TranslateUI2016Q2 --disable-features=AutofillProfileCleanup<AutofillProfileCleanup,DefaultEnableGpuRasterization<DefaultEnableGpuRasterization,DisableFirstRunAutoImport<DisableFirstRunAutoImport,DocumentWriteEvaluator<DisallowFetchForDocWrittenScriptsInMainFrame,NewAudioRenderingMixingStrategy<NewAudioRenderingMixingStrategy,ParseHTMLOnMainThread<ParseHTMLOnMainThread,PreferHtmlOverPlugins<Html5ByDefault,PrintScaling<PrintScaling,UpdateRendererPriorityOnStartup<UpdateRendererPriorityOnStartup --force-fieldtrials=*AppBannerTriggering/site-engagement-eager/AutofillCreditCardSigninPromo/Default/*AutofillProfileCleanup/Control/*CSSExternalScanner/Enabled_ScanOnly/CaptivePortalInterstitial/Enabled/*ChromeChannelBeta/Enabled/*ChromeSuggestionsTuning/MergeByRedirectsBeta_Control/*ClientSideDetectionModel/Model1/DataReductionProxyUseQuic/Control9/DefaultBrowserPromptStyle/ColoredIconOnWhiteInfoBar3/DefaultEnableGpuRasterization/Control/DisableFirstRunAutoImport/Control/*DisallowFetchForDocWrittenScriptsInMainFrame/Control/*EnableAppContainer/Control/EnableSyncClientToServerCompression/Enabled/ExpectCTReporting/ExpectCTReportingEnabled/*ExpensiveBackgroundTimerThrottling/Default/ExtensionDeveloperModeWarning/Enabled/Html5ByDefault/Control/*InstanceID/Enabled/MarkNonSecureAs/Control/MaterialDesignUserManager/Enabled/MediaFoundationH264Encoding/Enabled/MetricsAndCrashSampling/InReportingSample/*NetworkQualityEstimator/Enabled/OfferUploadCreditCards/Enabled/*OmniboxBundledExperimentV1/ChromeDesktopPSuggestOnTopExperimentBeta/*ParseHTMLOnMainThread/Default/*PasswordGeneration/Enabled/*PasswordManagerSettingsMigration/Enable/*PersistentHistograms/EnabledInMemory/PluginPowerSaverTiny/Enabled/PrintScaling/Default/*QUIC/EnabledServerMigrationTake2/ReportCertificateErrors/ShowAndPossiblySend/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/SRTExperimentalEngineTrial/Default/*SRTPromptFieldTrial/On/SSLCommonNameMismatchHandling/Enabled/*SafeBrowsingIncidentReportingService/Enabled/SafeBrowsingUnverifiedDownloads/DisableByParameterMostSbTypes2/SaveAsMenuText/control/*SecurityChip/Enabled/SecurityWarningIconUpdate/Enabled/SignInPasswordPromo/Enable3/*SiteEngagement/Default/*SiteIsolationExtensions/Enabled/*SubresourceFilter/EnabledForPhishingSites/*SwReporterExtendedSafeBrowsingFeature/Enabled/*TLS13Negotiation/Enabled/TimerThrottlingForHiddenFrames/Default/TranslateServerStudy/Default/*TriggeredResetFieldTrial/On/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-1-Percent/group_47/*UMA-Uniformity-Trial-10-Percent/group_05/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/group_01/*UMA-Uniformity-Trial-5-Percent/group_18/*UMA-Uniformity-Trial-50-Percent/default/WebFontsInterventionV2/Default/ --primordial-pipe-token=35ACD66A37296A866A012C0BD664F62D --lang=cs --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=false,cssExternalScannerNoPreload=true,cssExternalScannerPreload=false --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=35ACD66A37296A866A012C0BD664F62D --renderer-client-id=6 --mojo-platform-channel-handle=3156 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-features=*AutofillCreditCardSigninPromo<AutofillCreditCardSigninPromo,BlockSmallPluginContent<PluginPowerSaverTiny,EnableSyncClientToServerCompression<EnableSyncClientToServerCompression,ExpectCTReporting<ExpectCTReporting,*ExpensiveBackgroundTimerThrottling<ExpensiveBackgroundTimerThrottling,*ExperimentalSwReporterEngine<SRTExperimentalEngineTrial,MaterialDesignUserManager<MaterialDesignUserManager,MediaFoundationH264Encoding<MediaFoundationH264Encoding,MetricsReporting<MetricsAndCrashSampling,NegotiateTLS13<TLS13Negotiation,PersistentHistograms<PersistentHistograms,SecurityChip<SecurityChip,SecurityWarningIconUpdate<SecurityWarningIconUpdate,SubresourceFilter<SubresourceFilter,SwReporterExtendedSafeBrowsingFeature<SwReporterExtendedSafeBrowsingFeature,*TimerThrottlingForHiddenFrames<TimerThrottlingForHiddenFrames,*TranslateUI2016Q2<TranslateUI2016Q2 --disable-features=AutofillProfileCleanup<AutofillProfileCleanup,DefaultEnableGpuRasterization<DefaultEnableGpuRasterization,DisableFirstRunAutoImport<DisableFirstRunAutoImport,DocumentWriteEvaluator<DisallowFetchForDocWrittenScriptsInMainFrame,NewAudioRenderingMixingStrategy<NewAudioRenderingMixingStrategy,ParseHTMLOnMainThread<ParseHTMLOnMainThread,PreferHtmlOverPlugins<Html5ByDefault,PrintScaling<PrintScaling,UpdateRendererPriorityOnStartup<UpdateRendererPriorityOnStartup --force-fieldtrials=*AppBannerTriggering/site-engagement-eager/AutofillCreditCardSigninPromo/Default/*AutofillProfileCleanup/Control/*CSSExternalScanner/Enabled_ScanOnly/CaptivePortalInterstitial/Enabled/*ChromeChannelBeta/Enabled/*ChromeSuggestionsTuning/MergeByRedirectsBeta_Control/*ClientSideDetectionModel/Model1/DataReductionProxyUseQuic/Control9/DefaultBrowserPromptStyle/ColoredIconOnWhiteInfoBar3/DefaultEnableGpuRasterization/Control/DisableFirstRunAutoImport/Control/*DisallowFetchForDocWrittenScriptsInMainFrame/Control/*EnableAppContainer/Control/EnableSyncClientToServerCompression/Enabled/ExpectCTReporting/ExpectCTReportingEnabled/*ExpensiveBackgroundTimerThrottling/Default/ExtensionDeveloperModeWarning/Enabled/Html5ByDefault/Control/*InstanceID/Enabled/MarkNonSecureAs/Control/MaterialDesignUserManager/Enabled/MediaFoundationH264Encoding/Enabled/MetricsAndCrashSampling/InReportingSample/*NetworkQualityEstimator/Enabled/OfferUploadCreditCards/Enabled/*OmniboxBundledExperimentV1/ChromeDesktopPSuggestOnTopExperimentBeta/*ParseHTMLOnMainThread/Default/*PasswordGeneration/Enabled/*PasswordManagerSettingsMigration/Enable/*PersistentHistograms/EnabledInMemory/PluginPowerSaverTiny/Enabled/PrintScaling/Default/*QUIC/EnabledServerMigrationTake2/ReportCertificateErrors/ShowAndPossiblySend/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/SRTExperimentalEngineTrial/Default/*SRTPromptFieldTrial/On/SSLCommonNameMismatchHandling/Enabled/*SafeBrowsingIncidentReportingService/Enabled/SafeBrowsingUnverifiedDownloads/DisableByParameterMostSbTypes2/SaveAsMenuText/control/*SecurityChip/Enabled/SecurityWarningIconUpdate/Enabled/SignInPasswordPromo/Enable3/*SiteEngagement/Default/*SiteIsolationExtensions/Enabled/*SubresourceFilter/EnabledForPhishingSites/*SwReporterExtendedSafeBrowsingFeature/Enabled/*TLS13Negotiation/Enabled/TimerThrottlingForHiddenFrames/Default/TranslateServerStudy/Default/*TriggeredResetFieldTrial/On/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-1-Percent/group_47/*UMA-Uniformity-Trial-10-Percent/group_05/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/group_01/*UMA-Uniformity-Trial-5-Percent/group_18/*UMA-Uniformity-Trial-50-Percent/default/WebFontsInterventionV2/Default/ --primordial-pipe-token=2DF64E8A827A190DC63195FB110D642E --lang=cs --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=false,cssExternalScannerNoPreload=true,cssExternalScannerPreload=false --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=2DF64E8A827A190DC63195FB110D642E --renderer-client-id=7 --mojo-platform-channel-handle=3164 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-features=*AutofillCreditCardSigninPromo<AutofillCreditCardSigninPromo,BlockSmallPluginContent<PluginPowerSaverTiny,EnableSyncClientToServerCompression<EnableSyncClientToServerCompression,ExpectCTReporting<ExpectCTReporting,*ExpensiveBackgroundTimerThrottling<ExpensiveBackgroundTimerThrottling,*ExperimentalSwReporterEngine<SRTExperimentalEngineTrial,MaterialDesignUserManager<MaterialDesignUserManager,MediaFoundationH264Encoding<MediaFoundationH264Encoding,MetricsReporting<MetricsAndCrashSampling,NegotiateTLS13<TLS13Negotiation,PersistentHistograms<PersistentHistograms,SecurityChip<SecurityChip,SecurityWarningIconUpdate<SecurityWarningIconUpdate,SubresourceFilter<SubresourceFilter,SwReporterExtendedSafeBrowsingFeature<SwReporterExtendedSafeBrowsingFeature,*TimerThrottlingForHiddenFrames<TimerThrottlingForHiddenFrames,*TranslateUI2016Q2<TranslateUI2016Q2 --disable-features=AutofillProfileCleanup<AutofillProfileCleanup,DefaultEnableGpuRasterization<DefaultEnableGpuRasterization,DisableFirstRunAutoImport<DisableFirstRunAutoImport,DocumentWriteEvaluator<DisallowFetchForDocWrittenScriptsInMainFrame,NewAudioRenderingMixingStrategy<NewAudioRenderingMixingStrategy,ParseHTMLOnMainThread<ParseHTMLOnMainThread,PreferHtmlOverPlugins<Html5ByDefault,PrintScaling<PrintScaling,UpdateRendererPriorityOnStartup<UpdateRendererPriorityOnStartup --force-fieldtrials=*AppBannerTriggering/site-engagement-eager/AutofillCreditCardSigninPromo/Default/*AutofillProfileCleanup/Control/*CSSExternalScanner/Enabled_ScanOnly/CaptivePortalInterstitial/Enabled/*ChromeChannelBeta/Enabled/*ChromeSuggestionsTuning/MergeByRedirectsBeta_Control/*ClientSideDetectionModel/Model1/DataReductionProxyUseQuic/Control9/DefaultBrowserPromptStyle/ColoredIconOnWhiteInfoBar3/DefaultEnableGpuRasterization/Control/DisableFirstRunAutoImport/Control/*DisallowFetchForDocWrittenScriptsInMainFrame/Control/*EnableAppContainer/Control/EnableSyncClientToServerCompression/Enabled/ExpectCTReporting/ExpectCTReportingEnabled/*ExpensiveBackgroundTimerThrottling/Default/ExtensionDeveloperModeWarning/Enabled/Html5ByDefault/Control/*InstanceID/Enabled/MarkNonSecureAs/Control/MaterialDesignUserManager/Enabled/MediaFoundationH264Encoding/Enabled/MetricsAndCrashSampling/InReportingSample/*NetworkQualityEstimator/Enabled/OfferUploadCreditCards/Enabled/*OmniboxBundledExperimentV1/ChromeDesktopPSuggestOnTopExperimentBeta/*ParseHTMLOnMainThread/Default/*PasswordGeneration/Enabled/*PasswordManagerSettingsMigration/Enable/*PersistentHistograms/EnabledInMemory/PluginPowerSaverTiny/Enabled/PrintScaling/Default/*QUIC/EnabledServerMigrationTake2/ReportCertificateErrors/ShowAndPossiblySend/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/SRTExperimentalEngineTrial/Default/*SRTPromptFieldTrial/On/SSLCommonNameMismatchHandling/Enabled/*SafeBrowsingIncidentReportingService/Enabled/SafeBrowsingUnverifiedDownloads/DisableByParameterMostSbTypes2/SaveAsMenuText/control/*SecurityChip/Enabled/SecurityWarningIconUpdate/Enabled/SignInPasswordPromo/Enable3/*SiteEngagement/Default/*SiteIsolationExtensions/Enabled/*SubresourceFilter/EnabledForPhishingSites/*SwReporterExtendedSafeBrowsingFeature/Enabled/*TLS13Negotiation/Enabled/TimerThrottlingForHiddenFrames/Default/TranslateServerStudy/Default/*TriggeredResetFieldTrial/On/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-1-Percent/group_47/*UMA-Uniformity-Trial-10-Percent/group_05/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/group_01/*UMA-Uniformity-Trial-5-Percent/group_18/*UMA-Uniformity-Trial-50-Percent/default/WebFontsInterventionV2/Default/ --primordial-pipe-token=C0E87368DD04A2934345AADA5898E00D --lang=cs --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=false,cssExternalScannerNoPreload=true,cssExternalScannerPreload=false --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=C0E87368DD04A2934345AADA5898E00D --renderer-client-id=8 --mojo-platform-channel-handle=3168 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-features=*AutofillCreditCardSigninPromo<AutofillCreditCardSigninPromo,BlockSmallPluginContent<PluginPowerSaverTiny,EnableSyncClientToServerCompression<EnableSyncClientToServerCompression,ExpectCTReporting<ExpectCTReporting,*ExpensiveBackgroundTimerThrottling<ExpensiveBackgroundTimerThrottling,*ExperimentalSwReporterEngine<SRTExperimentalEngineTrial,MaterialDesignUserManager<MaterialDesignUserManager,MediaFoundationH264Encoding<MediaFoundationH264Encoding,MetricsReporting<MetricsAndCrashSampling,NegotiateTLS13<TLS13Negotiation,PersistentHistograms<PersistentHistograms,SecurityChip<SecurityChip,SecurityWarningIconUpdate<SecurityWarningIconUpdate,SubresourceFilter<SubresourceFilter,SwReporterExtendedSafeBrowsingFeature<SwReporterExtendedSafeBrowsingFeature,*TimerThrottlingForHiddenFrames<TimerThrottlingForHiddenFrames,*TranslateUI2016Q2<TranslateUI2016Q2 --disable-features=AutofillProfileCleanup<AutofillProfileCleanup,DefaultEnableGpuRasterization<DefaultEnableGpuRasterization,DisableFirstRunAutoImport<DisableFirstRunAutoImport,DocumentWriteEvaluator<DisallowFetchForDocWrittenScriptsInMainFrame,NewAudioRenderingMixingStrategy<NewAudioRenderingMixingStrategy,ParseHTMLOnMainThread<ParseHTMLOnMainThread,PreferHtmlOverPlugins<Html5ByDefault,PrintScaling<PrintScaling,UpdateRendererPriorityOnStartup<UpdateRendererPriorityOnStartup --force-fieldtrials=*AppBannerTriggering/site-engagement-eager/AutofillCreditCardSigninPromo/Default/*AutofillProfileCleanup/Control/*CSSExternalScanner/Enabled_ScanOnly/CaptivePortalInterstitial/Enabled/*ChromeChannelBeta/Enabled/*ChromeSuggestionsTuning/MergeByRedirectsBeta_Control/*ClientSideDetectionModel/Model1/DataReductionProxyUseQuic/Control9/DefaultBrowserPromptStyle/ColoredIconOnWhiteInfoBar3/DefaultEnableGpuRasterization/Control/DisableFirstRunAutoImport/Control/*DisallowFetchForDocWrittenScriptsInMainFrame/Control/*EnableAppContainer/Control/EnableSyncClientToServerCompression/Enabled/ExpectCTReporting/ExpectCTReportingEnabled/*ExpensiveBackgroundTimerThrottling/Default/ExtensionDeveloperModeWarning/Enabled/Html5ByDefault/Control/*InstanceID/Enabled/MarkNonSecureAs/Control/MaterialDesignUserManager/Enabled/MediaFoundationH264Encoding/Enabled/MetricsAndCrashSampling/InReportingSample/*NetworkQualityEstimator/Enabled/OfferUploadCreditCards/Enabled/*OmniboxBundledExperimentV1/ChromeDesktopPSuggestOnTopExperimentBeta/*ParseHTMLOnMainThread/Default/*PasswordGeneration/Enabled/*PasswordManagerSettingsMigration/Enable/*PersistentHistograms/EnabledInMemory/PluginPowerSaverTiny/Enabled/PrintScaling/Default/*QUIC/EnabledServerMigrationTake2/ReportCertificateErrors/ShowAndPossiblySend/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/SRTExperimentalEngineTrial/Default/*SRTPromptFieldTrial/On/SSLCommonNameMismatchHandling/Enabled/*SafeBrowsingIncidentReportingService/Enabled/SafeBrowsingUnverifiedDownloads/DisableByParameterMostSbTypes2/SaveAsMenuText/control/*SecurityChip/Enabled/SecurityWarningIconUpdate/Enabled/SignInPasswordPromo/Enable3/*SiteEngagement/Default/*SiteIsolationExtensions/Enabled/*SubresourceFilter/EnabledForPhishingSites/*SwReporterExtendedSafeBrowsingFeature/Enabled/*TLS13Negotiation/Enabled/TimerThrottlingForHiddenFrames/Default/TranslateServerStudy/Default/*TriggeredResetFieldTrial/On/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-1-Percent/group_47/*UMA-Uniformity-Trial-10-Percent/group_05/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/group_01/*UMA-Uniformity-Trial-5-Percent/group_18/*UMA-Uniformity-Trial-50-Percent/default/WebFontsInterventionV2/Default/ --primordial-pipe-token=EC5082999D8B774B26A0822DAFEB5AD5 --lang=cs --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=false,cssExternalScannerNoPreload=true,cssExternalScannerPreload=false --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=EC5082999D8B774B26A0822DAFEB5AD5 --renderer-client-id=9 --mojo-platform-channel-handle=3296 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-features=*AutofillCreditCardSigninPromo<AutofillCreditCardSigninPromo,BlockSmallPluginContent<PluginPowerSaverTiny,EnableSyncClientToServerCompression<EnableSyncClientToServerCompression,ExpectCTReporting<ExpectCTReporting,*ExpensiveBackgroundTimerThrottling<ExpensiveBackgroundTimerThrottling,*ExperimentalSwReporterEngine<SRTExperimentalEngineTrial,MaterialDesignUserManager<MaterialDesignUserManager,MediaFoundationH264Encoding<MediaFoundationH264Encoding,MetricsReporting<MetricsAndCrashSampling,NegotiateTLS13<TLS13Negotiation,PersistentHistograms<PersistentHistograms,SecurityChip<SecurityChip,SecurityWarningIconUpdate<SecurityWarningIconUpdate,SubresourceFilter<SubresourceFilter,SwReporterExtendedSafeBrowsingFeature<SwReporterExtendedSafeBrowsingFeature,*TimerThrottlingForHiddenFrames<TimerThrottlingForHiddenFrames,*TranslateUI2016Q2<TranslateUI2016Q2 --disable-features=AutofillProfileCleanup<AutofillProfileCleanup,DefaultEnableGpuRasterization<DefaultEnableGpuRasterization,DisableFirstRunAutoImport<DisableFirstRunAutoImport,DocumentWriteEvaluator<DisallowFetchForDocWrittenScriptsInMainFrame,NewAudioRenderingMixingStrategy<NewAudioRenderingMixingStrategy,ParseHTMLOnMainThread<ParseHTMLOnMainThread,PreferHtmlOverPlugins<Html5ByDefault,PrintScaling<PrintScaling,UpdateRendererPriorityOnStartup<UpdateRendererPriorityOnStartup --force-fieldtrials=*AppBannerTriggering/site-engagement-eager/AutofillCreditCardSigninPromo/Default/*AutofillProfileCleanup/Control/*CSSExternalScanner/Enabled_ScanOnly/CaptivePortalInterstitial/Enabled/*ChromeChannelBeta/Enabled/*ChromeSuggestionsTuning/MergeByRedirectsBeta_Control/*ClientSideDetectionModel/Model1/DataReductionProxyUseQuic/Control9/DefaultBrowserPromptStyle/ColoredIconOnWhiteInfoBar3/DefaultEnableGpuRasterization/Control/DisableFirstRunAutoImport/Control/*DisallowFetchForDocWrittenScriptsInMainFrame/Control/*EnableAppContainer/Control/EnableSyncClientToServerCompression/Enabled/ExpectCTReporting/ExpectCTReportingEnabled/*ExpensiveBackgroundTimerThrottling/Default/ExtensionDeveloperModeWarning/Enabled/Html5ByDefault/Control/*InstanceID/Enabled/MarkNonSecureAs/Control/MaterialDesignUserManager/Enabled/MediaFoundationH264Encoding/Enabled/MetricsAndCrashSampling/InReportingSample/*NetworkQualityEstimator/Enabled/OfferUploadCreditCards/Enabled/*OmniboxBundledExperimentV1/ChromeDesktopPSuggestOnTopExperimentBeta/*ParseHTMLOnMainThread/Default/*PasswordGeneration/Enabled/*PasswordManagerSettingsMigration/Enable/*PersistentHistograms/EnabledInMemory/PluginPowerSaverTiny/Enabled/PrintScaling/Default/*QUIC/EnabledServerMigrationTake2/ReportCertificateErrors/ShowAndPossiblySend/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/SRTExperimentalEngineTrial/Default/*SRTPromptFieldTrial/On/SSLCommonNameMismatchHandling/Enabled/*SafeBrowsingIncidentReportingService/Enabled/SafeBrowsingUnverifiedDownloads/DisableByParameterMostSbTypes2/SaveAsMenuText/control/*SecurityChip/Enabled/SecurityWarningIconUpdate/Enabled/SignInPasswordPromo/Enable3/*SiteEngagement/Default/*SiteIsolationExtensions/Enabled/*SubresourceFilter/EnabledForPhishingSites/*SwReporterExtendedSafeBrowsingFeature/Enabled/*TLS13Negotiation/Enabled/TimerThrottlingForHiddenFrames/Default/TranslateServerStudy/Default/*TriggeredResetFieldTrial/On/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-1-Percent/group_47/*UMA-Uniformity-Trial-10-Percent/group_05/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/group_01/*UMA-Uniformity-Trial-5-Percent/group_18/*UMA-Uniformity-Trial-50-Percent/default/WebFontsInterventionV2/Default/ --primordial-pipe-token=B1C43A7DAF48EC3E3BCFFC5975D1C387 --lang=cs --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=false,cssExternalScannerNoPreload=true,cssExternalScannerPreload=false --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=B1C43A7DAF48EC3E3BCFFC5975D1C387 --renderer-client-id=10 --mojo-platform-channel-handle=3308 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-features=*AutofillCreditCardSigninPromo<AutofillCreditCardSigninPromo,BlockSmallPluginContent<PluginPowerSaverTiny,EnableSyncClientToServerCompression<EnableSyncClientToServerCompression,ExpectCTReporting<ExpectCTReporting,*ExpensiveBackgroundTimerThrottling<ExpensiveBackgroundTimerThrottling,*ExperimentalSwReporterEngine<SRTExperimentalEngineTrial,MaterialDesignUserManager<MaterialDesignUserManager,MediaFoundationH264Encoding<MediaFoundationH264Encoding,MetricsReporting<MetricsAndCrashSampling,NegotiateTLS13<TLS13Negotiation,PersistentHistograms<PersistentHistograms,SecurityChip<SecurityChip,SecurityWarningIconUpdate<SecurityWarningIconUpdate,SubresourceFilter<SubresourceFilter,SwReporterExtendedSafeBrowsingFeature<SwReporterExtendedSafeBrowsingFeature,*TimerThrottlingForHiddenFrames<TimerThrottlingForHiddenFrames,*TranslateUI2016Q2<TranslateUI2016Q2 --disable-features=AutofillProfileCleanup<AutofillProfileCleanup,DefaultEnableGpuRasterization<DefaultEnableGpuRasterization,DisableFirstRunAutoImport<DisableFirstRunAutoImport,DocumentWriteEvaluator<DisallowFetchForDocWrittenScriptsInMainFrame,NewAudioRenderingMixingStrategy<NewAudioRenderingMixingStrategy,ParseHTMLOnMainThread<ParseHTMLOnMainThread,PreferHtmlOverPlugins<Html5ByDefault,PrintScaling<PrintScaling,UpdateRendererPriorityOnStartup<UpdateRendererPriorityOnStartup --force-fieldtrials=*AppBannerTriggering/site-engagement-eager/AutofillCreditCardSigninPromo/Default/*AutofillProfileCleanup/Control/*CSSExternalScanner/Enabled_ScanOnly/CaptivePortalInterstitial/Enabled/*ChromeChannelBeta/Enabled/*ChromeSuggestionsTuning/MergeByRedirectsBeta_Control/*ClientSideDetectionModel/Model1/DataReductionProxyUseQuic/Control9/DefaultBrowserPromptStyle/ColoredIconOnWhiteInfoBar3/DefaultEnableGpuRasterization/Control/DisableFirstRunAutoImport/Control/*DisallowFetchForDocWrittenScriptsInMainFrame/Control/*EnableAppContainer/Control/EnableSyncClientToServerCompression/Enabled/ExpectCTReporting/ExpectCTReportingEnabled/*ExpensiveBackgroundTimerThrottling/Default/ExtensionDeveloperModeWarning/Enabled/Html5ByDefault/Control/*InstanceID/Enabled/MarkNonSecureAs/Control/MaterialDesignUserManager/Enabled/MediaFoundationH264Encoding/Enabled/MetricsAndCrashSampling/InReportingSample/*NetworkQualityEstimator/Enabled/OfferUploadCreditCards/Enabled/*OmniboxBundledExperimentV1/ChromeDesktopPSuggestOnTopExperimentBeta/*ParseHTMLOnMainThread/Default/*PasswordGeneration/Enabled/*PasswordManagerSettingsMigration/Enable/*PersistentHistograms/EnabledInMemory/PluginPowerSaverTiny/Enabled/PrintScaling/Default/*QUIC/EnabledServerMigrationTake2/ReportCertificateErrors/ShowAndPossiblySend/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/SRTExperimentalEngineTrial/Default/*SRTPromptFieldTrial/On/SSLCommonNameMismatchHandling/Enabled/*SafeBrowsingIncidentReportingService/Enabled/SafeBrowsingUnverifiedDownloads/DisableByParameterMostSbTypes2/SaveAsMenuText/control/*SecurityChip/Enabled/SecurityWarningIconUpdate/Enabled/SignInPasswordPromo/Enable3/*SiteEngagement/Default/*SiteIsolationExtensions/Enabled/*SubresourceFilter/EnabledForPhishingSites/*SwReporterExtendedSafeBrowsingFeature/Enabled/*TLS13Negotiation/Enabled/TimerThrottlingForHiddenFrames/Default/TranslateServerStudy/Default/*TriggeredResetFieldTrial/On/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-1-Percent/group_47/*UMA-Uniformity-Trial-10-Percent/group_05/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/group_01/*UMA-Uniformity-Trial-5-Percent/group_18/*UMA-Uniformity-Trial-50-Percent/default/WebFontsInterventionV2/Default/ --primordial-pipe-token=8388644C32C889A1188F22C39F7C5799 --lang=cs --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=false,cssExternalScannerNoPreload=true,cssExternalScannerPreload=false --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=8388644C32C889A1188F22C39F7C5799 --renderer-client-id=11 --mojo-platform-channel-handle=2916 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-features=*AutofillCreditCardSigninPromo<AutofillCreditCardSigninPromo,BlockSmallPluginContent<PluginPowerSaverTiny,EnableSyncClientToServerCompression<EnableSyncClientToServerCompression,ExpectCTReporting<ExpectCTReporting,*ExpensiveBackgroundTimerThrottling<ExpensiveBackgroundTimerThrottling,*ExperimentalSwReporterEngine<SRTExperimentalEngineTrial,MaterialDesignUserManager<MaterialDesignUserManager,MediaFoundationH264Encoding<MediaFoundationH264Encoding,MetricsReporting<MetricsAndCrashSampling,NegotiateTLS13<TLS13Negotiation,PersistentHistograms<PersistentHistograms,SecurityChip<SecurityChip,SecurityWarningIconUpdate<SecurityWarningIconUpdate,SubresourceFilter<SubresourceFilter,SwReporterExtendedSafeBrowsingFeature<SwReporterExtendedSafeBrowsingFeature,*TimerThrottlingForHiddenFrames<TimerThrottlingForHiddenFrames,*TranslateUI2016Q2<TranslateUI2016Q2 --disable-features=AutofillProfileCleanup<AutofillProfileCleanup,DefaultEnableGpuRasterization<DefaultEnableGpuRasterization,DisableFirstRunAutoImport<DisableFirstRunAutoImport,DocumentWriteEvaluator<DisallowFetchForDocWrittenScriptsInMainFrame,NewAudioRenderingMixingStrategy<NewAudioRenderingMixingStrategy,ParseHTMLOnMainThread<ParseHTMLOnMainThread,PreferHtmlOverPlugins<Html5ByDefault,PrintScaling<PrintScaling,UpdateRendererPriorityOnStartup<UpdateRendererPriorityOnStartup --force-fieldtrials=*AppBannerTriggering/site-engagement-eager/AutofillCreditCardSigninPromo/Default/*AutofillProfileCleanup/Control/*CSSExternalScanner/Enabled_ScanOnly/CaptivePortalInterstitial/Enabled/*ChromeChannelBeta/Enabled/*ChromeSuggestionsTuning/MergeByRedirectsBeta_Control/*ClientSideDetectionModel/Model1/DataReductionProxyUseQuic/Control9/DefaultBrowserPromptStyle/ColoredIconOnWhiteInfoBar3/DefaultEnableGpuRasterization/Control/DisableFirstRunAutoImport/Control/*DisallowFetchForDocWrittenScriptsInMainFrame/Control/*EnableAppContainer/Control/EnableSyncClientToServerCompression/Enabled/ExpectCTReporting/ExpectCTReportingEnabled/*ExpensiveBackgroundTimerThrottling/Default/ExtensionDeveloperModeWarning/Enabled/Html5ByDefault/Control/*InstanceID/Enabled/MarkNonSecureAs/Control/MaterialDesignUserManager/Enabled/MediaFoundationH264Encoding/Enabled/MetricsAndCrashSampling/InReportingSample/*NetworkQualityEstimator/Enabled/OfferUploadCreditCards/Enabled/*OmniboxBundledExperimentV1/ChromeDesktopPSuggestOnTopExperimentBeta/*ParseHTMLOnMainThread/Default/*PasswordGeneration/Enabled/*PasswordManagerSettingsMigration/Enable/*PersistentHistograms/EnabledInMemory/PluginPowerSaverTiny/Enabled/PrintScaling/Default/*QUIC/EnabledServerMigrationTake2/ReportCertificateErrors/ShowAndPossiblySend/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/SRTExperimentalEngineTrial/Default/*SRTPromptFieldTrial/On/SSLCommonNameMismatchHandling/Enabled/*SafeBrowsingIncidentReportingService/Enabled/SafeBrowsingUnverifiedDownloads/DisableByParameterMostSbTypes2/SaveAsMenuText/control/*SecurityChip/Enabled/SecurityWarningIconUpdate/Enabled/SignInPasswordPromo/Enable3/*SiteEngagement/Default/*SiteIsolationExtensions/Enabled/*SubresourceFilter/EnabledForPhishingSites/*SwReporterExtendedSafeBrowsingFeature/Enabled/*TLS13Negotiation/Enabled/TimerThrottlingForHiddenFrames/Default/TranslateServerStudy/Default/*TriggeredResetFieldTrial/On/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-1-Percent/group_47/*UMA-Uniformity-Trial-10-Percent/group_05/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/group_01/*UMA-Uniformity-Trial-5-Percent/group_18/*UMA-Uniformity-Trial-50-Percent/default/WebFontsInterventionV2/Default/ --primordial-pipe-token=4C111E77A50DB408C63E6815E3200447 --lang=cs --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=false,cssExternalScannerNoPreload=true,cssExternalScannerPreload=false --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=4C111E77A50DB408C63E6815E3200447 --renderer-client-id=12 --mojo-platform-channel-handle=3448 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-features=*AutofillCreditCardSigninPromo<AutofillCreditCardSigninPromo,BlockSmallPluginContent<PluginPowerSaverTiny,EnableSyncClientToServerCompression<EnableSyncClientToServerCompression,ExpectCTReporting<ExpectCTReporting,*ExpensiveBackgroundTimerThrottling<ExpensiveBackgroundTimerThrottling,*ExperimentalSwReporterEngine<SRTExperimentalEngineTrial,MaterialDesignUserManager<MaterialDesignUserManager,MediaFoundationH264Encoding<MediaFoundationH264Encoding,MetricsReporting<MetricsAndCrashSampling,NegotiateTLS13<TLS13Negotiation,PersistentHistograms<PersistentHistograms,SecurityChip<SecurityChip,SecurityWarningIconUpdate<SecurityWarningIconUpdate,SubresourceFilter<SubresourceFilter,SwReporterExtendedSafeBrowsingFeature<SwReporterExtendedSafeBrowsingFeature,*TimerThrottlingForHiddenFrames<TimerThrottlingForHiddenFrames,*TranslateUI2016Q2<TranslateUI2016Q2 --disable-features=AutofillProfileCleanup<AutofillProfileCleanup,DefaultEnableGpuRasterization<DefaultEnableGpuRasterization,DisableFirstRunAutoImport<DisableFirstRunAutoImport,DocumentWriteEvaluator<DisallowFetchForDocWrittenScriptsInMainFrame,NewAudioRenderingMixingStrategy<NewAudioRenderingMixingStrategy,ParseHTMLOnMainThread<ParseHTMLOnMainThread,PreferHtmlOverPlugins<Html5ByDefault,PrintScaling<PrintScaling,UpdateRendererPriorityOnStartup<UpdateRendererPriorityOnStartup --force-fieldtrials=*AppBannerTriggering/site-engagement-eager/AutofillCreditCardSigninPromo/Default/*AutofillProfileCleanup/Control/*CSSExternalScanner/Enabled_ScanOnly/CaptivePortalInterstitial/Enabled/*ChromeChannelBeta/Enabled/*ChromeSuggestionsTuning/MergeByRedirectsBeta_Control/*ClientSideDetectionModel/Model1/DataReductionProxyUseQuic/Control9/DefaultBrowserPromptStyle/ColoredIconOnWhiteInfoBar3/DefaultEnableGpuRasterization/Control/DisableFirstRunAutoImport/Control/*DisallowFetchForDocWrittenScriptsInMainFrame/Control/*EnableAppContainer/Control/EnableSyncClientToServerCompression/Enabled/ExpectCTReporting/ExpectCTReportingEnabled/*ExpensiveBackgroundTimerThrottling/Default/ExtensionDeveloperModeWarning/Enabled/Html5ByDefault/Control/*InstanceID/Enabled/MarkNonSecureAs/Control/MaterialDesignUserManager/Enabled/MediaFoundationH264Encoding/Enabled/MetricsAndCrashSampling/InReportingSample/*NetworkQualityEstimator/Enabled/OfferUploadCreditCards/Enabled/*OmniboxBundledExperimentV1/ChromeDesktopPSuggestOnTopExperimentBeta/*ParseHTMLOnMainThread/Default/*PasswordGeneration/Enabled/*PasswordManagerSettingsMigration/Enable/*PersistentHistograms/EnabledInMemory/PluginPowerSaverTiny/Enabled/PrintScaling/Default/*QUIC/EnabledServerMigrationTake2/ReportCertificateErrors/ShowAndPossiblySend/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/SRTExperimentalEngineTrial/Default/*SRTPromptFieldTrial/On/SSLCommonNameMismatchHandling/Enabled/*SafeBrowsingIncidentReportingService/Enabled/SafeBrowsingUnverifiedDownloads/DisableByParameterMostSbTypes2/SaveAsMenuText/control/*SecurityChip/Enabled/SecurityWarningIconUpdate/Enabled/SignInPasswordPromo/Enable3/*SiteEngagement/Default/*SiteIsolationExtensions/Enabled/*SubresourceFilter/EnabledForPhishingSites/*SwReporterExtendedSafeBrowsingFeature/Enabled/*TLS13Negotiation/Enabled/TimerThrottlingForHiddenFrames/Default/TranslateServerStudy/Default/*TriggeredResetFieldTrial/On/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-1-Percent/group_47/*UMA-Uniformity-Trial-10-Percent/group_05/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/group_01/*UMA-Uniformity-Trial-5-Percent/group_18/*UMA-Uniformity-Trial-50-Percent/default/WebFontsInterventionV2/Default/ --primordial-pipe-token=35D48E4BC0BF0A6749B81BA3D2F10381 --lang=cs --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=false,cssExternalScannerNoPreload=true,cssExternalScannerPreload=false --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=35D48E4BC0BF0A6749B81BA3D2F10381 --renderer-client-id=13 --mojo-platform-channel-handle=3452 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=nacl-loader --mojo-channel-token=BA0BCD2CB31E91BC0779E80723CDA25D --service-request-channel-token=0516E7B73A1486AE75382597CE74A9A1 --mojo-platform-channel-handle=8696 --ignored=" --type=renderer " /prefetch:8
"D:\Apps\cmder\vendor\conemu-maximus5\ConEmu.exe" /Icon "D:\Apps\cmder\icons\cmder.ico" /Title Cmder /LoadCfgFile "D:\Apps\cmder\config\ConEmu.xml"
"D:\Apps\cmder\vendor\conemu-maximus5\ConEmu\ConEmuC64.exe" /CINMODE=200020 /AID=4288 /GID=5684 /GHWND=00080486 /BW=111 /BH=26 /BZ=1000 "/FN=Lucida Console" /FW=3 /FH=5 /TA=10100007 /HIDE /ROOT PowerShell -NoLogo -NoProfile -NoExit -Command "Invoke-Expression '. ''%ConEmuDir%\..\profile.ps1'''"
\??\C:\WINDOWS\system32\conhost.exe 0x4
"C:\WINDOWS\System32\WindowsPowerShell\v1.0\PowerShell.exe" -NoLogo -NoProfile -NoExit -Command "Invoke-Expression '. ''D:\Apps\cmder\vendor\conemu-maximus5\..\profile.ps1'''"
"D:\Apps\cmder\vendor\conemu-maximus5\ConEmu\ConEmuC64.exe" /OMITHOOKSWARN /CINMODE=200020 /AID=7588 /GID=5684 /GHWND=00080486 /BW=111 /BH=26 /BZ=1000 "/FN=Lucida Console" /FW=3 /FH=5 /TA=10100007 /HIDE /ROOT cmd /c "D:\Apps\Git\bin\bash --login -i"
\??\C:\WINDOWS\system32\conhost.exe 0x4
"C:\WINDOWS\SYSTEM32\cmd.exe" /c "D:\Apps\Git\bin\bash --login -i"
D:\Apps\Git\bin\bash --login -i
"D:\Apps\Git\bin\..\usr\bin\bash.exe" --login -i
"D:\Apps\Git\usr\bin\ssh-agent.exe"
C:\WINDOWS\system32\ApplicationFrameHost.exe -Embedding
"C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.10221.0_x64__8wekyb3d8bbwe\Video.UI.exe" -ServerName:Microsoft.ZuneVideo.AppX758ya5sqdjd98rx6z7g95nw6jy7bqx9y.mca
"C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.1118.10000.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe" -ServerName:App.AppXzst44mncqdg84v7sv6p7yznqwssy6f7f.mca
"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1701.10102.0_x64__8wekyb3d8bbwe\Calculator.exe" -ServerName:App.AppXsm3pg4n7er43kdh1qp4e79f1j7am68r8.mca
"C:\WINDOWS\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel
C:\WINDOWS\system32\AUDIODG.EXE 0x5a8
C:\Windows\System32\smartscreen.exe -Embedding
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-features=*AutofillCreditCardSigninPromo<AutofillCreditCardSigninPromo,BlockSmallPluginContent<PluginPowerSaverTiny,EnableSyncClientToServerCompression<EnableSyncClientToServerCompression,ExpectCTReporting<ExpectCTReporting,*ExpensiveBackgroundTimerThrottling<ExpensiveBackgroundTimerThrottling,*ExperimentalSwReporterEngine<SRTExperimentalEngineTrial,MaterialDesignUserManager<MaterialDesignUserManager,MediaFoundationH264Encoding<MediaFoundationH264Encoding,MetricsReporting<MetricsAndCrashSampling,NegotiateTLS13<TLS13Negotiation,PersistentHistograms<PersistentHistograms,SecurityChip<SecurityChip,SecurityWarningIconUpdate<SecurityWarningIconUpdate,SubresourceFilter<SubresourceFilter,SwReporterExtendedSafeBrowsingFeature<SwReporterExtendedSafeBrowsingFeature,*TimerThrottlingForHiddenFrames<TimerThrottlingForHiddenFrames,*TranslateUI2016Q2<TranslateUI2016Q2 --disable-features=AutofillProfileCleanup<AutofillProfileCleanup,DefaultEnableGpuRasterization<DefaultEnableGpuRasterization,DisableFirstRunAutoImport<DisableFirstRunAutoImport,DocumentWriteEvaluator<DisallowFetchForDocWrittenScriptsInMainFrame,NewAudioRenderingMixingStrategy<NewAudioRenderingMixingStrategy,ParseHTMLOnMainThread<ParseHTMLOnMainThread,PreferHtmlOverPlugins<Html5ByDefault,PrintScaling<PrintScaling,UpdateRendererPriorityOnStartup<UpdateRendererPriorityOnStartup --force-fieldtrials=*AppBannerTriggering/site-engagement-eager/AutofillCreditCardSigninPromo/Default/*AutofillProfileCleanup/Control/*CSSExternalScanner/Enabled_ScanOnly/CaptivePortalInterstitial/Enabled/*ChromeChannelBeta/Enabled/*ChromeSuggestionsTuning/MergeByRedirectsBeta_Control/*ClientSideDetectionModel/Model1/*DataReductionProxyUseQuic/Control9/DefaultBrowserPromptStyle/ColoredIconOnWhiteInfoBar3/DefaultEnableGpuRasterization/Control/DisableFirstRunAutoImport/Control/*DisallowFetchForDocWrittenScriptsInMainFrame/Control/*EnableAppContainer/Control/*EnableSyncClientToServerCompression/Enabled/ExpectCTReporting/ExpectCTReportingEnabled/*ExpensiveBackgroundTimerThrottling/Default/ExtensionDeveloperModeWarning/Enabled/*Html5ByDefault/Control/*InstanceID/Enabled/MarkNonSecureAs/Control/MaterialDesignUserManager/Enabled/*MediaFoundationH264Encoding/Enabled/MetricsAndCrashSampling/InReportingSample/*NetworkQualityEstimator/Enabled/OfferUploadCreditCards/Enabled/*OmniboxBundledExperimentV1/ChromeDesktopPSuggestOnTopExperimentBeta/*ParseHTMLOnMainThread/Default/*PasswordGeneration/Enabled/*PasswordManagerSettingsMigration/Enable/*PersistentHistograms/EnabledInMemory/*PluginPowerSaverTiny/Enabled/PrintScaling/Default/*QUIC/EnabledServerMigrationTake2/ReportCertificateErrors/ShowAndPossiblySend/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/SRTExperimentalEngineTrial/Default/*SRTPromptFieldTrial/On/SSLCommonNameMismatchHandling/Enabled/*SafeBrowsingIncidentReportingService/Enabled/SafeBrowsingUnverifiedDownloads/DisableByParameterMostSbTypes2/SaveAsMenuText/control/*SecurityChip/Enabled/SecurityWarningIconUpdate/Enabled/SignInPasswordPromo/Enable3/*SiteEngagement/Default/*SiteIsolationExtensions/Enabled/*SubresourceFilter/EnabledForPhishingSites/*SwReporterExtendedSafeBrowsingFeature/Enabled/*TLS13Negotiation/Enabled/*TimerThrottlingForHiddenFrames/Default/TranslateServerStudy/Default/*TriggeredResetFieldTrial/On/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-1-Percent/group_47/*UMA-Uniformity-Trial-10-Percent/group_05/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/group_01/*UMA-Uniformity-Trial-5-Percent/group_18/*UMA-Uniformity-Trial-50-Percent/default/*WebFontsInterventionV2/Default/ --primordial-pipe-token=B763DA4CF9D697708BD0CED9D935AAF2 --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=false,cssExternalScannerNoPreload=true,cssExternalScannerPreload=false --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=B763DA4CF9D697708BD0CED9D935AAF2 --renderer-client-id=24 --mojo-platform-channel-handle=6688 /prefetch:1
"D:\Apps\Git\usr\bin\sh.exe"
"D:\Apps\Git\usr\bin\sh.exe"
D:\Dropbox\Codevels\DevTools\node.js\node.exe D:/Dropbox/Codevels/DevTools/node.js/node_modules/grunt-cli/bin/grunt serve
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-features=*AutofillCreditCardSigninPromo<AutofillCreditCardSigninPromo,BlockSmallPluginContent<PluginPowerSaverTiny,EnableSyncClientToServerCompression<EnableSyncClientToServerCompression,ExpectCTReporting<ExpectCTReporting,*ExpensiveBackgroundTimerThrottling<ExpensiveBackgroundTimerThrottling,*ExperimentalSwReporterEngine<SRTExperimentalEngineTrial,MaterialDesignUserManager<MaterialDesignUserManager,MediaFoundationH264Encoding<MediaFoundationH264Encoding,MetricsReporting<MetricsAndCrashSampling,NegotiateTLS13<TLS13Negotiation,PersistentHistograms<PersistentHistograms,SecurityChip<SecurityChip,SecurityWarningIconUpdate<SecurityWarningIconUpdate,SubresourceFilter<SubresourceFilter,SwReporterExtendedSafeBrowsingFeature<SwReporterExtendedSafeBrowsingFeature,*TimerThrottlingForHiddenFrames<TimerThrottlingForHiddenFrames,*TranslateUI2016Q2<TranslateUI2016Q2 --disable-features=AutofillProfileCleanup<AutofillProfileCleanup,DefaultEnableGpuRasterization<DefaultEnableGpuRasterization,DisableFirstRunAutoImport<DisableFirstRunAutoImport,DocumentWriteEvaluator<DisallowFetchForDocWrittenScriptsInMainFrame,NewAudioRenderingMixingStrategy<NewAudioRenderingMixingStrategy,ParseHTMLOnMainThread<ParseHTMLOnMainThread,PreferHtmlOverPlugins<Html5ByDefault,PrintScaling<PrintScaling,UpdateRendererPriorityOnStartup<UpdateRendererPriorityOnStartup --force-fieldtrials=*AppBannerTriggering/site-engagement-eager/AutofillCreditCardSigninPromo/Default/*AutofillProfileCleanup/Control/*CSSExternalScanner/Enabled_ScanOnly/CaptivePortalInterstitial/Enabled/*ChromeChannelBeta/Enabled/*ChromeSuggestionsTuning/MergeByRedirectsBeta_Control/*ClientSideDetectionModel/Model1/*DataReductionProxyUseQuic/Control9/DefaultBrowserPromptStyle/ColoredIconOnWhiteInfoBar3/DefaultEnableGpuRasterization/Control/DisableFirstRunAutoImport/Control/*DisallowFetchForDocWrittenScriptsInMainFrame/Control/*EnableAppContainer/Control/*EnableSyncClientToServerCompression/Enabled/ExpectCTReporting/ExpectCTReportingEnabled/*ExpensiveBackgroundTimerThrottling/Default/ExtensionDeveloperModeWarning/Enabled/*Html5ByDefault/Control/*InstanceID/Enabled/*MarkNonSecureAs/Control/MaterialDesignUserManager/Enabled/*MediaFoundationH264Encoding/Enabled/MetricsAndCrashSampling/InReportingSample/*NetworkQualityEstimator/Enabled/OfferUploadCreditCards/Enabled/*OmniboxBundledExperimentV1/ChromeDesktopPSuggestOnTopExperimentBeta/*ParseHTMLOnMainThread/Default/*PasswordGeneration/Enabled/*PasswordManagerSettingsMigration/Enable/*PersistentHistograms/EnabledInMemory/*PluginPowerSaverTiny/Enabled/PrintScaling/Default/*QUIC/EnabledServerMigrationTake2/ReportCertificateErrors/ShowAndPossiblySend/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/SRTExperimentalEngineTrial/Default/*SRTPromptFieldTrial/On/SSLCommonNameMismatchHandling/Enabled/*SafeBrowsingIncidentReportingService/Enabled/SafeBrowsingUnverifiedDownloads/DisableByParameterMostSbTypes2/SaveAsMenuText/control/*SecurityChip/Enabled/SecurityWarningIconUpdate/Enabled/SignInPasswordPromo/Enable3/*SiteEngagement/Default/*SiteIsolationExtensions/Enabled/*SubresourceFilter/EnabledForPhishingSites/*SwReporterExtendedSafeBrowsingFeature/Enabled/*TLS13Negotiation/Enabled/*TimerThrottlingForHiddenFrames/Default/TranslateServerStudy/Default/*TriggeredResetFieldTrial/On/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-1-Percent/group_47/*UMA-Uniformity-Trial-10-Percent/group_05/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/group_01/*UMA-Uniformity-Trial-5-Percent/group_18/*UMA-Uniformity-Trial-50-Percent/default/*WebFontsInterventionV2/Default/ --primordial-pipe-token=540F46569F95F4E064E32C195B2739B4 --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=false,cssExternalScannerNoPreload=true,cssExternalScannerPreload=false --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=540F46569F95F4E064E32C195B2739B4 --renderer-client-id=31 --mojo-platform-channel-handle=10332 /prefetch:1
"C:\Program Files\Internet Explorer\iexplore.exe"
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:17409 /prefetch:2
"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2112 CREDAT:82959 /prefetch:2
C:\WINDOWS\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\WINDOWS\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
C:\WINDOWS\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
"C:\Users\NG\Downloads\RSITx64.exe"
C:\WINDOWS\system32\wbem\wmiprvse.exe
======Scheduled tasks folder======
C:\WINDOWS\tasks\CreateExplorerShellUnelevatedTask.job - C:\WINDOWS\explorer.exe
Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz
HOSTS soubor s cizími adresami (AdClick virus?)
Moderátor: Moderátoři
Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
-
Rudy
- Site Admin
- Příspěvky: 119671
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: HOSTS soubor s cizími adresami (AdClick virus?)
Zdravím!
Log není kompletní.
Log není kompletní.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Re: HOSTS soubor s cizími adresami (AdClick virus?)
C:\WINDOWS\tasks\DropboxUpdateTaskUserS-1-5-21-1341208516-2984071467-593012157-1001Core1d2370248faa6d7.job -
C:\Users\NG\AppData\Local\Dropbox\Update\DropboxUpdate.exe
C:\WINDOWS\tasks\DropboxUpdateTaskUserS-1-5-21-1341208516-2984071467-593012157-1001UA1d23702490d345b.job -
C:\Users\NG\AppData\Local\Dropbox\Update\DropboxUpdate.exe
=========Mozilla firefox=========
ProfilePath - C:\Users\NG\AppData\Roaming\Mozilla\Firefox\Profiles\w8gci29x.default
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 19.0.0.226 Plugin
"Path"=C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_226.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5]
"Description"=Intel IPT WebApi plugin
"Path"=C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.68]
"Description"=Intel IPT WebApi plugin
"Path"=C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater]
"Description"=This plugin updates Intel WebAPI component
"Path"=C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=11.51.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files (x86)\Java\jre1.8.0_51\bin\dtplugin\npDeployJava1.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=11.51.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre1.8.0_51\bin\plugin2\npjp2.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/Lync,version=15.0]
"Description"=Microsoft Lync Plug-in for Firefox
"Path"=C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~2\MICROS~3\Office15\NPSPWRAP.DLL
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3528.0331]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\adobe.com/AdobeAAMDetect]
"Description"=
"Path"=C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 19.0.0.226 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF64_19_0_0_226.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=11.51.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files\Java\jre1.8.0_51\bin\dtplugin\npDeployJava1.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=11.51.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre1.8.0_51\bin\plugin2\npjp2.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=D:\Apps\MSOffice2013\Office15\NPSPWRAP.DLL
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\adobe.com/AdobeAAMDetect]
"Description"=
"Path"=C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Skype for Business Browser Helper - D:\Apps\MSOffice2013\Office15\OCHelper.dll [2016-12-13 229064]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre1.8.0_51\bin\ssv.dll [2015-08-15 551520]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre1.8.0_51\bin\jp2ssv.dll [2015-08-15 212576]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_51\bin\ssv.dll [2015-08-15 460384]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{92EF2EAD-A7CE-4424-B0DB-499CF856608E}]
Evernote extension - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2015-12-01 629456]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft SkyDrive Pro Browser Helper - C:\PROGRA~2\MICROS~3\Office15\GROOVEEX.DLL [2016-11-15 1743664]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_51\bin\jp2ssv.dll [2015-08-15 172640]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2015-09-23 14040296]
"ETDCtrl"=C:\Program Files\Elantech\ETDCtrl.exe [2016-11-11 3242200]
"AdobeAAMUpdater-1.0"=C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2016-07-01 508128]
"Launch LCore"=C:\Program Files\Logitech Gaming Software\LCore.exe [2015-10-15 15009400]
"WindowsDefender"=C:\Program Files\Windows Defender\MSASCuiL.exe [2016-10-24 631808]
"GoPro Tray App"=D:\Apps\QuikGoPro\GoPro Desktop App\GoProDesktopSystemTray.exe [2016-12-02 866224]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Dropbox Update"=C:\Users\NG\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2016-11-05 143144]
"OneDrive"=C:\Users\NG\AppData\Local\Microsoft\OneDrive\OneDrive.exe [2017-01-19 1517280]
"f.lux"=C:\Users\NG\AppData\Local\FluxSoftware\Flux\flux.exe [2013-10-24 1017224]
[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"MMReminderService"=d:\Apps\MindjetManager\MMReminderService.exe [2013-09-07 42312]
"AdobeCEPServiceManager"=C:\Program Files (x86)\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe [2013-05-16 1039240]
"VirtualCloneDrive"=C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [2013-03-11 88984]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2015-06-08 334896]
"Adobe Creative Cloud"=C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2016-10-12 2383040]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
iBTAudioMon.lnk - C:\Program Files (x86)\Intel\HPWA\iBTAudioMon.exe
C:\Users\NG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
EvernoteClipper.lnk - C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
no_zooｍ_ｃhroｍe.exe.lnk - C:\ProgramData\no_zooｍ_ｃhroｍe.exe.lnk.bat
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\Program Files"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
igfxdev.dll []
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ahcache.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CoreMessagingRegistrar]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\iai2c.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SpbCx.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\StateRepository]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TileDataModelSvc]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\uefi.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\UserManager]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{F2E7DD72-6468-4E36-B6F1-6488F42C1B52}]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Ahcache.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\CoreMessagingRegistrar]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SpbCx.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\StateRepository]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TileDataModelSvc]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\uefi.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UserManager]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{F2E7DD72-6468-4E36-B6F1-6488F42C1B52}]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DSCAutomationHostEnabled"=2
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"vidc.i420"=iyuv_32.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"msacm.ac3filter"=ac3filter.acm
"VIDC.CFHD"=CFHD.dll
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
======List of files/folders created in the last 3 months======
2017-01-26 10:12:08 ----D---- C:\rsit
2017-01-25 18:00:20 ----A---- C:\WINDOWS\SYSWOW64\poqexec.exe
2017-01-25 18:00:20 ----A---- C:\WINDOWS\system32\poqexec.exe
2017-01-13 21:21:03 ----D---- C:\WINDOWS\Panther
2017-01-13 21:20:42 ----ASH---- C:\pagefile.sys
2017-01-12 20:27:12 ----A---- C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll
2017-01-12 20:27:11 ----A---- C:\WINDOWS\system32\Windows.UI.Xaml.dll
2017-01-12 20:27:07 ----A---- C:\WINDOWS\system32\Windows.Media.dll
2017-01-12 20:27:06 ----A---- C:\WINDOWS\system32\mfcore.dll
2017-01-12 20:27:05 ----A---- C:\WINDOWS\SYSWOW64\Windows.UI.Logon.dll
2017-01-12 20:27:05 ----A---- C:\WINDOWS\system32\mfmp4srcsnk.dll
2017-01-12 20:27:04 ----A---- C:\WINDOWS\SYSWOW64\StoreAgent.dll
2017-01-12 20:27:04 ----A---- C:\WINDOWS\SYSWOW64\InstallAgentUserBroker.exe
2017-01-12 20:27:04 ----A---- C:\WINDOWS\SYSWOW64\InstallAgent.exe
2017-01-12 20:27:04 ----A---- C:\WINDOWS\system32\d2d1.dll
2017-01-12 20:27:03 ----A---- C:\WINDOWS\SYSWOW64\Windows.Storage.ApplicationData.dll
2017-01-12 20:27:03 ----A---- C:\WINDOWS\system32\mfnetsrc.dll
2017-01-12 20:27:03 ----A---- C:\WINDOWS\system32\mfmpeg2srcsnk.dll
2017-01-12 20:27:02 ----A---- C:\WINDOWS\system32\rdpcore.dll
2017-01-12 20:27:02 ----A---- C:\WINDOWS\system32\mfasfsrcsnk.dll
2017-01-12 20:27:02 ----A---- C:\WINDOWS\system32\D3DCompiler_47.dll
2017-01-12 20:27:02 ----A---- C:\WINDOWS\system32\aeinv.dll
2017-01-12 20:27:01 ----A---- C:\WINDOWS\system32\mstscax.dll
2017-01-12 20:27:01 ----A---- C:\WINDOWS\system32\mfnetcore.dll
2017-01-12 20:27:00 ----A---- C:\WINDOWS\system32\rdpencom.dll
2017-01-12 20:27:00 ----A---- C:\WINDOWS\system32\MCRecvSrc.dll
2017-01-12 20:26:59 ----A---- C:\WINDOWS\SYSWOW64\Windows.UI.CredDialogController.dll
2017-01-12 20:26:59 ----A---- C:\WINDOWS\SYSWOW64\Windows.UI.Cred.dll
2017-01-12 20:26:59 ----A---- C:\WINDOWS\SYSWOW64\Windows.UI.BlockedShutdown.dll
2017-01-12 20:26:59 ----A---- C:\WINDOWS\SYSWOW64\Windows.UI.BioFeedback.dll
2017-01-12 20:26:59 ----A---- C:\WINDOWS\system32\wuuhext.dll
2017-01-12 20:26:59 ----A---- C:\WINDOWS\system32\winlogon.exe
2017-01-12 20:26:59 ----A---- C:\WINDOWS\system32\D3D12.dll
2017-01-12 20:26:58 ----A---- C:\WINDOWS\SYSWOW64\offlinesam.dll
2017-01-12 20:26:58 ----A---- C:\WINDOWS\system32\wuaueng.dll
2017-01-12 20:26:58 ----A---- C:\WINDOWS\system32\sppobjs.dll
2017-01-12 20:26:58 ----A---- C:\WINDOWS\system32\samsrv.dll
2017-01-12 20:26:57 ----A---- C:\WINDOWS\SYSWOW64\msmpeg2vdec.dll
2017-01-12 20:26:57 ----A---- C:\WINDOWS\system32\offlinesam.dll
2017-01-12 20:26:57 ----A---- C:\WINDOWS\system32\lsasrv.dll
2017-01-12 20:26:56 ----A---- C:\WINDOWS\SYSWOW64\aclui.dll
2017-01-12 20:26:55 ----A---- C:\WINDOWS\system32\shell32.dll
2017-01-12 20:26:53 ----A---- C:\WINDOWS\SYSWOW64\shell32.dll
2017-01-12 20:26:51 ----A---- C:\WINDOWS\system32\drivers\cng.sys
2017-01-12 20:26:50 ----A---- C:\WINDOWS\SYSWOW64\updatepolicy.dll
2017-01-12 20:26:50 ----A---- C:\WINDOWS\SYSWOW64\MSVP9DEC.dll
2017-01-12 20:26:50 ----A---- C:\WINDOWS\SYSWOW64\kerberos.dll
2017-01-12 20:26:50 ----A---- C:\WINDOWS\system32\wuapi.dll
2017-01-12 20:26:50 ----A---- C:\WINDOWS\system32\updatepolicy.dll
2017-01-12 20:26:50 ----A---- C:\WINDOWS\system32\msv1_0.dll
2017-01-12 20:26:50 ----A---- C:\WINDOWS\system32\kerberos.dll
2017-01-12 20:26:50 ----A---- C:\WINDOWS\system32\ImplatSetup.dll
2017-01-12 20:26:49 ----A---- C:\WINDOWS\SYSWOW64\WinSCard.dll
2017-01-12 20:26:49 ----A---- C:\WINDOWS\SYSWOW64\cryptui.dll
2017-01-12 20:26:49 ----A---- C:\WINDOWS\system32\wow64.dll
2017-01-12 20:26:49 ----A---- C:\WINDOWS\system32\WinSCard.dll
2017-01-12 20:26:49 ----A---- C:\WINDOWS\system32\ScDeviceEnum.dll
2017-01-12 20:26:49 ----A---- C:\WINDOWS\system32\cryptui.dll
2017-01-12 20:26:49 ----A---- C:\WINDOWS\system32\certprop.dll
2017-01-12 20:26:48 ----A---- C:\WINDOWS\SYSWOW64\indexeddbserver.dll
2017-01-12 20:26:48 ----A---- C:\WINDOWS\SYSWOW64\AUDIOKSE.dll
2017-01-12 20:26:47 ----A---- C:\WINDOWS\SYSWOW64\Windows.UI.Xaml.Resources.dll
2017-01-12 20:26:47 ----A---- C:\WINDOWS\SYSWOW64\AudioSes.dll
2017-01-12 20:26:46 ----A---- C:\WINDOWS\SYSWOW64\mshtml.dll
2017-01-12 20:26:46 ----A---- C:\WINDOWS\SYSWOW64\Chakradiag.dll
2017-01-12 20:26:41 ----A---- C:\WINDOWS\SYSWOW64\Windows.UI.Xaml.dll
2017-01-12 20:26:39 ----A---- C:\WINDOWS\SYSWOW64\Chakra.dll
2017-01-12 20:26:39 ----A---- C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll
2017-01-12 20:26:38 ----A---- C:\WINDOWS\SYSWOW64\AzureSettingSyncProvider.dll
2017-01-12 20:26:37 ----A---- C:\WINDOWS\SYSWOW64\edgehtml.dll
2017-01-12 20:26:35 ----A---- C:\WINDOWS\system32\AzureSettingSyncProvider.dll
2017-01-12 20:26:34 ----A---- C:\WINDOWS\SYSWOW64\mspaint.exe
2017-01-12 20:26:34 ----A---- C:\WINDOWS\system32\Chakra.dll
2017-01-12 20:26:33 ----A---- C:\WINDOWS\system32\win32kbase.sys
2017-01-12 20:26:32 ----A---- C:\WINDOWS\SYSWOW64\twinui.dll
2017-01-12 20:26:31 ----A---- C:\WINDOWS\system32\SettingsHandlers_nt.dll
2017-01-12 20:26:30 ----A---- C:\WINDOWS\system32\mspaint.exe
2017-01-12 20:26:29 ----A---- C:\WINDOWS\SYSWOW64\winmde.dll
2017-01-12 20:26:29 ----A---- C:\WINDOWS\system32\msmpeg2vdec.dll
2017-01-12 20:26:28 ----A---- C:\WINDOWS\system32\mshtml.dll
2017-01-12 20:26:28 ----A---- C:\WINDOWS\system32\indexeddbserver.dll
2017-01-12 20:26:26 ----A---- C:\WINDOWS\system32\twinui.dll
2017-01-12 20:26:25 ----A---- C:\WINDOWS\system32\winmde.dll
2017-01-12 20:26:24 ----A---- C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll
2017-01-12 20:26:24 ----A---- C:\WINDOWS\system32\aadcloudap.dll
2017-01-12 20:26:23 ----A---- C:\WINDOWS\system32\edgehtml.dll
2017-01-12 20:26:18 ----A---- C:\WINDOWS\system32\aadtb.dll
2017-01-12 20:26:15 ----A---- C:\WINDOWS\SYSWOW64\Windows.ApplicationModel.LockScreen.dll
2017-01-12 20:26:14 ----A---- C:\WINDOWS\system32\usocore.dll
2017-01-12 20:26:14 ----A---- C:\WINDOWS\system32\rdpcorets.dll
2017-01-12 20:26:13 ----A---- C:\WINDOWS\SYSWOW64\rdpcore.dll
2017-01-12 20:26:13 ----A---- C:\WINDOWS\system32\Windows.Internal.UI.Logon.ProxyStub.dll
2017-01-12 20:26:13 ----A---- C:\WINDOWS\system32\updatehandlers.dll
2017-01-12 20:26:13 ----A---- C:\WINDOWS\system32\LaunchWinApp.exe
2017-01-12 20:26:12 ----A---- C:\WINDOWS\SYSWOW64\remoteaudioendpoint.dll
2017-01-12 20:26:12 ----A---- C:\WINDOWS\SYSWOW64\LaunchWinApp.exe
2017-01-12 20:26:12 ----A---- C:\WINDOWS\system32\rdpudd.dll
2017-01-12 20:26:12 ----A---- C:\WINDOWS\system32\MSVP9DEC.dll
2017-01-12 20:26:12 ----A---- C:\WINDOWS\system32\DeveloperOptionsSettingsHandlers.dll
2017-01-12 20:26:11 ----A---- C:\WINDOWS\SYSWOW64\SyncSettings.dll
2017-01-12 20:26:11 ----A---- C:\WINDOWS\SYSWOW64\rdpencom.dll
2017-01-12 20:26:11 ----A---- C:\WINDOWS\SYSWOW64\mstscax.dll
2017-01-12 20:26:10 ----A---- C:\WINDOWS\SYSWOW64\MSVPXENC.dll
2017-01-12 20:26:10 ----A---- C:\WINDOWS\SYSWOW64\CloudBackupSettings.dll
2017-01-12 20:26:10 ----A---- C:\WINDOWS\system32\Windows.UI.Shell.dll
2017-01-12 20:26:10 ----A---- C:\WINDOWS\system32\win32kfull.sys
2017-01-12 20:26:10 ----A---- C:\WINDOWS\system32\win32k.sys
2017-01-12 20:26:10 ----A---- C:\WINDOWS\system32\OneBackupHandler.dll
2017-01-12 20:26:09 ----A---- C:\WINDOWS\SYSWOW64\Windows.Media.dll
2017-01-12 20:26:09 ----A---- C:\WINDOWS\SYSWOW64\LogonController.dll
2017-01-12 20:26:08 ----A---- C:\WINDOWS\SYSWOW64\mfcore.dll
2017-01-12 20:26:08 ----A---- C:\WINDOWS\system32\SRHInproc.dll
2017-01-12 20:26:08 ----A---- C:\WINDOWS\system32\SRH.dll
2017-01-12 20:26:07 ----A---- C:\WINDOWS\SYSWOW64\mfmp4srcsnk.dll
2017-01-12 20:26:07 ----A---- C:\WINDOWS\system32\Windows.UI.Logon.dll
2017-01-12 20:26:07 ----A---- C:\WINDOWS\system32\aclui.dll
2017-01-12 20:26:06 ----A---- C:\WINDOWS\system32\dosvc.dll
2017-01-12 20:26:06 ----A---- C:\WINDOWS\system32\domgmt.dll
2017-01-12 20:26:06 ----A---- C:\WINDOWS\system32\AudioSes.dll
2017-01-12 20:26:06 ----A---- C:\WINDOWS\system32\AUDIOKSE.dll
2017-01-12 20:26:06 ----A---- C:\WINDOWS\system32\AudioEng.dll
2017-01-12 20:26:06 ----A---- C:\WINDOWS\system32\AudioEndpointBuilder.dll
2017-01-12 20:26:05 ----A---- C:\WINDOWS\system32\StoreAgent.dll
2017-01-12 20:26:05 ----A---- C:\WINDOWS\system32\SettingSyncHost.exe
2017-01-12 20:26:05 ----A---- C:\WINDOWS\system32\SettingSyncCore.dll
2017-01-12 20:26:05 ----A---- C:\WINDOWS\system32\InstallAgentUserBroker.exe
2017-01-12 20:26:05 ----A---- C:\WINDOWS\system32\InstallAgent.exe
2017-01-12 20:26:05 ----A---- C:\WINDOWS\system32\ClipUp.exe
2017-01-12 20:26:05 ----A---- C:\WINDOWS\system32\audiosrv.dll
2017-01-12 20:26:04 ----A---- C:\WINDOWS\SYSWOW64\mfnetsrc.dll
2017-01-12 20:26:04 ----A---- C:\WINDOWS\system32\ie4uinit.exe
2017-01-12 20:26:03 ----A---- C:\WINDOWS\SYSWOW64\mfasfsrcsnk.dll
2017-01-12 20:26:03 ----A---- C:\WINDOWS\system32\Windows.UI.CredDialogController.dll
2017-01-12 20:26:03 ----A---- C:\WINDOWS\system32\wbiosrvc.dll
2017-01-12 20:26:03 ----A---- C:\WINDOWS\system32\drivers\vhdmp.sys
2017-01-12 20:26:02 ----A---- C:\WINDOWS\SYSWOW64\wuapi.dll
2017-01-12 20:26:02 ----A---- C:\WINDOWS\SYSWOW64\mfnetcore.dll
2017-01-12 20:26:02 ----A---- C:\WINDOWS\system32\remoteaudioendpoint.dll
2017-01-12 20:26:02 ----A---- C:\WINDOWS\system32\cloudAP.dll
2017-01-12 20:26:01 ----A---- C:\WINDOWS\SYSWOW64\mfmpeg2srcsnk.dll
2017-01-12 20:26:01 ----A---- C:\WINDOWS\SYSWOW64\MCRecvSrc.dll
2017-01-12 20:26:01 ----A---- C:\WINDOWS\system32\winsrv.dll
2017-01-12 20:26:01 ----A---- C:\WINDOWS\system32\Windows.UI.BlockedShutdown.dll
2017-01-12 20:26:01 ----A---- C:\WINDOWS\system32\Windows.UI.BioFeedback.dll
2017-01-12 20:26:01 ----A---- C:\WINDOWS\system32\SyncSettings.dll
2017-01-12 20:26:01 ----A---- C:\WINDOWS\system32\fhsettingsprovider.dll
2017-01-12 20:26:01 ----A---- C:\WINDOWS\system32\fhcfg.dll
2017-01-12 20:26:01 ----A---- C:\WINDOWS\system32\CloudBackupSettings.dll
2017-01-12 20:26:00 ----A---- C:\WINDOWS\system32\securekernel.exe
2017-01-12 20:26:00 ----A---- C:\WINDOWS\system32\ntoskrnl.exe
2017-01-12 20:26:00 ----A---- C:\WINDOWS\system32\drivers\pci.sys
2017-01-12 20:25:46 ----A---- C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2017-01-12 20:25:45 ----A---- C:\WINDOWS\system32\AppXDeploymentServer.dll
2017-01-12 20:25:43 ----A---- C:\WINDOWS\SYSWOW64\win32kfull.sys
2017-01-12 20:25:42 ----A---- C:\WINDOWS\SYSWOW64\SettingSyncHost.exe
2017-01-12 20:25:42 ----A---- C:\WINDOWS\SYSWOW64\SettingSyncCore.dll
2017-01-12 20:25:42 ----A---- C:\WINDOWS\SYSWOW64\aadtb.dll
2017-01-12 20:25:41 ----A---- C:\WINDOWS\SYSWOW64\d2d1.dll
2017-01-12 20:25:41 ----A---- C:\WINDOWS\system32\LogonController.dll
2017-01-12 20:25:39 ----A---- C:\WINDOWS\system32\ConsoleLogon.dll
2017-01-12 20:25:39 ----A---- C:\WINDOWS\system32\CloudExperienceHost.dll
2017-01-12 20:25:38 ----A---- C:\WINDOWS\SYSWOW64\win32k.sys
2017-01-12 20:25:38 ----A---- C:\WINDOWS\SYSWOW64\D3DCompiler_47.dll
2017-01-12 20:25:38 ----A---- C:\WINDOWS\system32\MSVPXENC.dll
2017-01-12 20:25:37 ----A---- C:\WINDOWS\SYSWOW64\Windows.Internal.UI.Logon.ProxyStub.dll
2017-01-12 20:25:37 ----A---- C:\WINDOWS\SYSWOW64\msv1_0.dll
2017-01-12 20:25:37 ----A---- C:\WINDOWS\system32\provengine.dll
2017-01-12 20:25:36 ----A---- C:\WINDOWS\system32\ProvPluginEng.dll
2017-01-12 20:25:36 ----A---- C:\WINDOWS\system32\KnobsCsp.dll
2017-01-12 20:25:36 ----A---- C:\WINDOWS\system32\KnobsCore.dll
2017-01-12 20:25:35 ----A---- C:\WINDOWS\SYSWOW64\D3D12.dll
2016-12-23 00:34:33 ----D---- C:\Users\NG\AppData\Roaming\DarkSoulsII
2016-12-23 00:34:32 ----D---- C:\ProgramData\Steam
2016-12-20 17:51:54 ----D---- C:\Users\NG\AppData\Roaming\GoPro
2016-12-20 17:50:54 ----D---- C:\Program Files (x86)\OpenAL
2016-12-20 17:50:54 ----A---- C:\WINDOWS\SYSWOW64\wrap_oal.dll
2016-12-20 17:50:54 ----A---- C:\WINDOWS\SYSWOW64\OpenAL32.dll
2016-12-20 17:50:54 ----A---- C:\WINDOWS\system32\wrap_oal.dll
2016-12-20 17:50:54 ----A---- C:\WINDOWS\system32\OpenAL32.dll
2016-12-15 00:13:14 ----A---- C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2016-12-15 00:13:13 ----A---- C:\WINDOWS\SYSWOW64\MFMediaEngine.dll
2016-12-15 00:13:13 ----A---- C:\WINDOWS\SYSWOW64\AppXDeploymentClient.dll
2016-12-15 00:13:13 ----A---- C:\WINDOWS\system32\ole32.dll
2016-12-15 00:13:13 ----A---- C:\WINDOWS\system32\msdtctm.dll
2016-12-15 00:13:12 ----A---- C:\WINDOWS\SYSWOW64\InputService.dll
2016-12-15 00:13:12 ----A---- C:\WINDOWS\SYSWOW64\d3d10warp.dll
2016-12-15 00:13:12 ----A---- C:\WINDOWS\system32\msi.dll
2016-12-15 00:13:12 ----A---- C:\WINDOWS\system32\hvix64.exe
2016-12-15 00:13:12 ----A---- C:\WINDOWS\system32\hvax64.exe
2016-12-15 00:13:12 ----A---- C:\WINDOWS\system32\AppXDeploymentClient.dll
2016-12-15 00:13:11 ----A---- C:\WINDOWS\SYSWOW64\TextInputFramework.dll
2016-12-15 00:13:11 ----A---- C:\WINDOWS\system32\hvloader.exe
2016-12-15 00:13:10 ----A---- C:\WINDOWS\SYSWOW64\WordBreakers.dll
2016-12-15 00:13:10 ----A---- C:\WINDOWS\SYSWOW64\Windows.UI.Core.TextInput.dll
2016-12-15 00:13:10 ----A---- C:\WINDOWS\SYSWOW64\InputLocaleManager.dll
2016-12-15 00:13:10 ----A---- C:\WINDOWS\SYSWOW64\EditBufferTestHook.dll
2016-12-15 00:13:10 ----A---- C:\WINDOWS\system32\MFMediaEngine.dll
2016-12-15 00:13:10 ----A---- C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2016-12-15 00:13:09 ----A---- C:\WINDOWS\system32\Windows.Security.Authentication.OnlineId.dll
2016-12-15 00:13:09 ----A---- C:\WINDOWS\system32\LicenseManager.dll
2016-12-15 00:13:09 ----A---- C:\WINDOWS\system32\facecredentialprovider.dll
2016-12-15 00:13:09 ----A---- C:\WINDOWS\system32\CoreUIComponents.dll
2016-12-15 00:13:06 ----A---- C:\WINDOWS\SYSWOW64\WindowsCodecs.dll
2016-12-15 00:13:06 ----A---- C:\WINDOWS\SYSWOW64\user32.dll
2016-12-15 00:13:06 ----A---- C:\WINDOWS\system32\InputService.dll
2016-12-15 00:13:05 ----A---- C:\WINDOWS\SYSWOW64\sspicli.dll
2016-12-15 00:13:05 ----A---- C:\WINDOWS\system32\WordBreakers.dll
2016-12-15 00:13:05 ----A---- C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll
2016-12-15 00:13:05 ----A---- C:\WINDOWS\system32\TextInputFramework.dll
2016-12-15 00:13:05 ----A---- C:\WINDOWS\system32\ShareHost.dll
2016-12-15 00:13:05 ----A---- C:\WINDOWS\system32\InputLocaleManager.dll
2016-12-15 00:13:05 ----A---- C:\WINDOWS\system32\EditBufferTestHook.dll
2016-12-15 00:13:04 ----A---- C:\WINDOWS\system32\user32.dll
2016-12-15 00:13:04 ----A---- C:\WINDOWS\system32\ieframe.dll
2016-12-15 00:13:03 ----A---- C:\WINDOWS\SYSWOW64\ieframe.dll
2016-12-15 00:13:03 ----A---- C:\WINDOWS\system32\cdp.dll
2016-12-15 00:13:01 ----A---- C:\WINDOWS\SYSWOW64\msi.dll
2016-12-15 00:13:01 ----A---- C:\WINDOWS\SYSWOW64\gdi32full.dll
2016-12-15 00:13:01 ----A---- C:\WINDOWS\system32\gdi32full.dll
2016-12-15 00:13:01 ----A---- C:\WINDOWS\system32\CoreMessaging.dll
2016-12-15 00:13:00 ----A---- C:\WINDOWS\system32\winresume.exe
2016-12-15 00:12:59 ----A---- C:\WINDOWS\SYSWOW64\Windows.Media.Protection.PlayReady.dll
2016-12-15 00:12:59 ----A---- C:\WINDOWS\system32\winload.exe
2016-12-15 00:12:58 ----A---- C:\WINDOWS\SYSWOW64\WinTypes.dll
2016-12-15 00:12:58 ----A---- C:\WINDOWS\system32\WinTypes.dll
2016-12-15 00:12:57 ----A---- C:\WINDOWS\SYSWOW64\wincorlib.dll
2016-12-15 00:12:57 ----A---- C:\WINDOWS\SYSWOW64\LicenseManager.dll
2016-12-15 00:12:57 ----A---- C:\WINDOWS\SYSWOW64\CoreMessaging.dll
2016-12-15 00:12:57 ----A---- C:\WINDOWS\SYSWOW64\combase.dll
2016-12-15 00:12:57 ----A---- C:\WINDOWS\SYSWOW64\cdp.dll
2016-12-15 00:12:57 ----A---- C:\WINDOWS\system32\enterprisecsps.dll
2016-12-15 00:12:57 ----A---- C:\WINDOWS\system32\DeviceEnroller.exe
2016-12-15 00:12:57 ----A---- C:\WINDOWS\system32\combase.dll
2016-12-15 00:12:57 ----A---- C:\WINDOWS\system32\appraiser.dll
2016-12-15 00:12:57 ----A---- C:\WINDOWS\system32\acmigration.dll
2016-12-15 00:12:56 ----A---- C:\WINDOWS\SYSWOW64\Windows.Security.Authentication.OnlineId.dll
2016-12-15 00:12:56 ----A---- C:\WINDOWS\SYSWOW64\ShareHost.dll
2016-12-15 00:12:56 ----A---- C:\WINDOWS\SYSWOW64\mdmregistration.dll
2016-12-15 00:12:56 ----A---- C:\WINDOWS\SYSWOW64\bcrypt.dll
2016-12-15 00:12:56 ----A---- C:\WINDOWS\system32\wincorlib.dll
2016-12-15 00:12:56 ----A---- C:\WINDOWS\system32\mdmregistration.dll
2016-12-15 00:12:56 ----A---- C:\WINDOWS\system32\drivers\clfs.sys
2016-12-15 00:12:56 ----A---- C:\WINDOWS\system32\bcrypt.dll
2016-12-15 00:12:55 ----A---- C:\WINDOWS\SYSWOW64\jscript9diag.dll
2016-12-15 00:12:55 ----A---- C:\WINDOWS\SYSWOW64\jscript9.dll
2016-12-15 00:12:55 ----A---- C:\WINDOWS\system32\jscript9.dll
2016-12-15 00:12:55 ----A---- C:\WINDOWS\system32\fveapibase.dll
2016-12-15 00:12:54 ----A---- C:\WINDOWS\system32\fveapi.dll
2016-12-15 00:12:54 ----A---- C:\WINDOWS\system32\drivers\dxgmms1.sys
2016-12-15 00:12:53 ----A---- C:\WINDOWS\system32\WindowsCodecs.dll
2016-12-15 00:12:53 ----A---- C:\WINDOWS\system32\drivers\dxgmms2.sys
2016-12-15 00:12:53 ----A---- C:\WINDOWS\system32\drivers\dxgkrnl.sys
2016-12-15 00:12:53 ----A---- C:\WINDOWS\system32\cdd.dll
2016-12-15 00:12:51 ----A---- C:\WINDOWS\SYSWOW64\CoreUIComponents.dll
2016-12-15 00:12:50 ----A---- C:\WINDOWS\SYSWOW64\ole32.dll
2016-12-15 00:12:47 ----A---- C:\WINDOWS\system32\sspicli.dll
2016-12-15 00:12:47 ----A---- C:\WINDOWS\system32\d3d10warp.dll
2016-12-15 00:12:47 ----A---- C:\WINDOWS\system32\CryptoWinRT.dll
2016-12-11 14:26:57 ----AD---- C:\Program Files\Adobe
2016-12-10 03:52:07 ----A---- C:\WINDOWS\SYSWOW64\netshell.dll
2016-12-10 03:52:07 ----A---- C:\WINDOWS\system32\wpnprv.dll
2016-12-10 03:52:07 ----A---- C:\WINDOWS\system32\Windows.Internal.Management.dll
2016-12-10 03:52:07 ----A---- C:\WINDOWS\system32\RDXService.dll
2016-12-10 03:52:07 ----A---- C:\WINDOWS\system32\rascustom.dll
2016-12-10 03:52:07 ----A---- C:\WINDOWS\system32\PlayToManager.dll
2016-12-10 03:52:07 ----A---- C:\WINDOWS\system32\drivers\bthport.sys
2016-12-10 03:52:07 ----A---- C:\WINDOWS\system32\ContentDeliveryManager.Utilities.dll
2016-12-10 03:52:07 ----A---- C:\WINDOWS\system32\browserbroker.dll
2016-12-10 03:52:06 ----A---- C:\WINDOWS\system32\ntshrui.dll
2016-12-10 03:52:06 ----A---- C:\WINDOWS\system32\ntdll.dll
2016-12-10 03:52:06 ----A---- C:\WINDOWS\system32\netshell.dll
2016-12-10 03:52:05 ----A---- C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll
2016-12-10 03:52:04 ----A---- C:\WINDOWS\SYSWOW64\mfsvr.dll
2016-12-10 03:52:03 ----A---- C:\WINDOWS\SYSWOW64\WSManHTTPConfig.exe
2016-12-10 03:52:03 ----A---- C:\WINDOWS\SYSWOW64\Windows.StateRepositoryClient.dll
2016-12-10 03:52:03 ----A---- C:\WINDOWS\SYSWOW64\Windows.StateRepository.dll
2016-12-10 03:52:03 ----A---- C:\WINDOWS\SYSWOW64\NMAA.dll
2016-12-10 03:52:03 ----A---- C:\WINDOWS\SYSWOW64\mfplat.dll
2016-12-10 03:52:03 ----A---- C:\WINDOWS\SYSWOW64\MapControlCore.dll
2016-12-10 03:52:03 ----A---- C:\WINDOWS\SYSWOW64\d3d11.dll
2016-12-10 03:52:03 ----A---- C:\WINDOWS\SYSWOW64\apprepsync.dll
2016-12-10 03:52:03 ----A---- C:\WINDOWS\SYSWOW64\apprepapi.dll
2016-12-10 03:52:03 ----A---- C:\WINDOWS\system32\apprepsync.dll
2016-12-10 03:52:03 ----A---- C:\WINDOWS\system32\apprepapi.dll
2016-12-10 03:52:02 ----A---- C:\WINDOWS\SYSWOW64\WsmSvc.dll
2016-12-10 03:52:02 ----A---- C:\WINDOWS\SYSWOW64\UIAutomationCore.dll
2016-12-10 03:52:02 ----A---- C:\WINDOWS\SYSWOW64\mos.dll
2016-12-10 03:52:02 ----A---- C:\WINDOWS\SYSWOW64\dwmcore.dll
2016-12-10 03:52:01 ----A---- C:\WINDOWS\SYSWOW64\zipfldr.dll
2016-12-10 03:52:01 ----A---- C:\WINDOWS\SYSWOW64\JpMapControl.dll
2016-12-10 03:52:01 ----A---- C:\WINDOWS\SYSWOW64\ExplorerFrame.dll
2016-12-10 03:52:01 ----A---- C:\WINDOWS\SYSWOW64\DisplayManager.dll
2016-12-10 03:52:01 ----A---- C:\WINDOWS\SYSWOW64\comdlg32.dll
2016-12-10 03:52:01 ----A---- C:\WINDOWS\SYSWOW64\BingMaps.dll
2016-12-10 03:52:00 ----A---- C:\WINDOWS\SYSWOW64\MapGeocoder.dll
2016-12-10 03:52:00 ----A---- C:\WINDOWS\system32\drivers\partmgr.sys
2016-12-10 03:51:59 ----A---- C:\WINDOWS\SYSWOW64\MosStorage.dll
2016-12-10 03:51:59 ----A---- C:\WINDOWS\SYSWOW64\mfmkvsrcsnk.dll
2016-12-10 03:51:59 ----A---- C:\WINDOWS\SYSWOW64\mfaudiocnv.dll
2016-12-10 03:51:59 ----A---- C:\WINDOWS\SYSWOW64\MapsBtSvc.dll
2016-12-10 03:51:59 ----A---- C:\WINDOWS\SYSWOW64\MapRouter.dll
2016-12-10 03:51:59 ----A---- C:\WINDOWS\SYSWOW64\MapConfiguration.dll
2016-12-10 03:51:59 ----A---- C:\WINDOWS\SYSWOW64\dxgi.dll
2016-12-10 03:51:59 ----A---- C:\WINDOWS\SYSWOW64\DeviceFlows.DataModel.dll
2016-12-10 03:51:59 ----A---- C:\WINDOWS\SYSWOW64\CloudStorageWizard.exe
2016-12-10 03:51:59 ----A---- C:\WINDOWS\system32\RTWorkQ.dll
2016-12-10 03:51:59 ----A---- C:\WINDOWS\system32\policymanager.dll
2016-12-10 03:51:59 ----A---- C:\WINDOWS\system32\MrmCoreR.dll
2016-12-10 03:51:59 ----A---- C:\WINDOWS\system32\MFPlay.dll
2016-12-10 03:51:59 ----A---- C:\WINDOWS\system32\HttpsDataSource.dll
2016-12-10 03:51:59 ----A---- C:\WINDOWS\system32\drivers\fastfat.sys
2016-12-10 03:51:59 ----A---- C:\WINDOWS\system32\dmenrollengine.dll
2016-12-10 03:51:59 ----A---- C:\WINDOWS\system32\dmcertinst.exe
2016-12-10 03:51:58 ----A---- C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2016-12-10 03:51:58 ----A---- C:\WINDOWS\system32\SearchFolder.dll
2016-12-10 03:51:57 ----A---- C:\WINDOWS\system32\wlidsvc.dll
2016-12-10 03:51:57 ----A---- C:\WINDOWS\system32\Windows.Networking.BackgroundTransfer.BackgroundManagerPolicy.dll
2016-12-10 03:51:57 ----A---- C:\WINDOWS\system32\SettingsHandlers_StorageSense.dll
2016-12-10 03:51:57 ----A---- C:\WINDOWS\system32\ReportingCSP.dll
2016-12-10 03:51:57 ----A---- C:\WINDOWS\system32\msdtcuiu.dll
2016-12-10 03:51:57 ----A---- C:\WINDOWS\system32\EnterpriseModernAppMgmtCSP.dll
2016-12-10 03:51:57 ----A---- C:\WINDOWS\system32\EnterpriseAppMgmtSvc.dll
2016-12-10 03:51:57 ----A---- C:\WINDOWS\system32\EDPCleanup.exe
2016-12-10 03:51:57 ----A---- C:\WINDOWS\system32\EAMProgressHandler.dll
2016-12-10 03:51:57 ----A---- C:\WINDOWS\system32\d3d11.dll
2016-12-10 03:51:57 ----A---- C:\WINDOWS\system32\ActivationManager.dll
2016-12-10 03:51:56 ----A---- C:\WINDOWS\SYSWOW64\usercpl.dll
2016-12-10 03:51:56 ----A---- C:\WINDOWS\SYSWOW64\msctf.dll
2016-12-10 03:51:56 ----A---- C:\WINDOWS\system32\Windows.StateRepositoryClient.dll
2016-12-10 03:51:56 ----A---- C:\WINDOWS\system32\Windows.StateRepositoryBroker.dll
2016-12-10 03:51:56 ----A---- C:\WINDOWS\system32\Windows.StateRepository.dll
2016-12-10 03:51:56 ----A---- C:\WINDOWS\system32\usercpl.dll
2016-12-10 03:51:56 ----A---- C:\WINDOWS\system32\hevcdecoder.dll
2016-12-10 03:51:55 ----A---- C:\WINDOWS\SYSWOW64\PlayToManager.dll
2016-12-10 03:51:55 ----A---- C:\WINDOWS\SYSWOW64\efswrt.dll
2016-12-10 03:51:55 ----A---- C:\WINDOWS\SYSWOW64\BcastDVRHelper.dll
2016-12-10 03:51:55 ----A---- C:\WINDOWS\SYSWOW64\bcastdvr.exe
2016-12-10 03:51:55 ----A---- C:\WINDOWS\SYSWOW64\AppCapture.dll
2016-12-10 03:51:55 ----A---- C:\WINDOWS\system32\Windows.UI.Search.dll
2016-12-10 03:51:55 ----A---- C:\WINDOWS\system32\RDXTaskFactory.dll
2016-12-10 03:51:55 ----A---- C:\WINDOWS\system32\NgcCtnr.dll
2016-12-10 03:51:55 ----A---- C:\WINDOWS\system32\ngccredprov.dll
2016-12-10 03:51:55 ----A---- C:\WINDOWS\system32\drivers\xboxgip.sys
2016-12-10 03:51:55 ----A---- C:\WINDOWS\system32\AppReadiness.dll
2016-12-10 03:51:54 ----A---- C:\WINDOWS\system32\wscsvc.dll
2016-12-10 03:51:54 ----A---- C:\WINDOWS\system32\Windows.Shell.Search.UriHandler.dll
2016-12-10 03:51:54 ----A---- C:\WINDOWS\system32\SystemSettingsThresholdAdminFlowUI.dll
2016-12-10 03:51:54 ----A---- C:\WINDOWS\system32\NetworkMobileSettings.dll
2016-12-10 03:51:54 ----A---- C:\WINDOWS\system32\netplwiz.dll
2016-12-10 03:51:54 ----A---- C:\WINDOWS\system32\dxgi.dll
2016-12-10 03:51:54 ----A---- C:\WINDOWS\system32\DeviceFlows.DataModel.dll
2016-12-10 03:51:53 ----A---- C:\WINDOWS\system32\SystemSettingsAdminFlows.exe
2016-12-10 03:51:53 ----A---- C:\WINDOWS\system32\actxprxy.dll
2016-12-10 03:51:52 ----A---- C:\WINDOWS\SYSWOW64\wsecedit.dll
2016-12-10 03:51:52 ----A---- C:\WINDOWS\SYSWOW64\RTWorkQ.dll
2016-12-10 03:51:52 ----A---- C:\WINDOWS\SYSWOW64\ActivationManager.dll
2016-12-10 03:51:52 ----A---- C:\WINDOWS\system32\wscapi.dll
2016-12-10 03:51:52 ----A---- C:\WINDOWS\system32\services.exe
2016-12-10 03:51:52 ----A---- C:\WINDOWS\system32\cryptngc.dll
2016-12-10 03:51:51 ----A---- C:\WINDOWS\SYSWOW64\wininet.dll
2016-12-10 03:51:51 ----A---- C:\WINDOWS\SYSWOW64\urlmon.dll
2016-12-10 03:51:51 ----A---- C:\WINDOWS\system32\wscinterop.dll
2016-12-10 03:51:51 ----A---- C:\WINDOWS\system32\VEStoreEventHandlers.dll
2016-12-10 03:51:50 ----A---- C:\WINDOWS\SYSWOW64\ntdll.dll
2016-12-10 03:51:50 ----A---- C:\WINDOWS\system32\msctf.dll
2016-12-10 03:51:50 ----A---- C:\WINDOWS\system32\comdlg32.dll
2016-12-10 03:51:49 ----A---- C:\WINDOWS\system32\Windows.UI.Immersive.dll
2016-12-10 03:51:49 ----A---- C:\WINDOWS\system32\modernexecserver.dll
2016-12-10 03:51:49 ----A---- C:\WINDOWS\system32\drivers\tpm.sys
2016-12-10 03:51:48 ----A---- C:\WINDOWS\SYSWOW64\Windows.UI.Search.dll
2016-12-10 03:51:48 ----A---- C:\WINDOWS\SYSWOW64\Windows.UI.Immersive.dll
2016-12-10 03:51:48 ----A---- C:\WINDOWS\SYSWOW64\Windows.Shell.Search.UriHandler.dll
2016-12-10 03:51:48 ----A---- C:\WINDOWS\SYSWOW64\Windows.Internal.Management.dll
2016-12-10 03:51:48 ----A---- C:\WINDOWS\SYSWOW64\gameux.dll
2016-12-10 03:51:48 ----A---- C:\WINDOWS\SYSWOW64\DevicePairing.dll
2016-12-10 03:51:48 ----A---- C:\WINDOWS\system32\cdpsvc.dll
2016-12-10 03:51:47 ----A---- C:\WINDOWS\SYSWOW64\stobject.dll
2016-12-10 03:51:47 ----A---- C:\WINDOWS\SYSWOW64\explorer.exe
2016-12-10 03:51:47 ----A---- C:\WINDOWS\system32\wpncore.dll
2016-12-10 03:51:47 ----A---- C:\WINDOWS\system32\sppwinob.dll
2016-12-10 03:51:47 ----A---- C:\WINDOWS\system32\EditionUpgradeManagerObj.dll
2016-12-10 03:51:47 ----A---- C:\WINDOWS\system32\EditionUpgradeHelper.dll
2016-12-10 03:51:47 ----A---- C:\WINDOWS\system32\cdpusersvc.dll
2016-12-10 03:51:47 ----A---- C:\WINDOWS\system32\ACPBackgroundManagerPolicy.dll
2016-12-10 03:51:46 ----A---- C:\WINDOWS\SYSWOW64\msdtcprx.dll
2016-12-10 03:51:46 ----A---- C:\WINDOWS\SYSWOW64\MrmCoreR.dll
2016-12-10 03:51:46 ----A---- C:\WINDOWS\SYSWOW64\dmenrollengine.dll
2016-12-10 03:51:46 ----A---- C:\WINDOWS\system32\wsecedit.dll
2016-12-10 03:51:46 ----A---- C:\WINDOWS\system32\VPNv2CSP.dll
2016-12-10 03:51:45 ----A---- C:\WINDOWS\SYSWOW64\xolehlp.dll
2016-12-10 03:51:45 ----A---- C:\WINDOWS\SYSWOW64\Windows.Networking.BackgroundTransfer.BackgroundManagerPolicy.dll
2016-12-10 03:51:45 ----A---- C:\WINDOWS\SYSWOW64\sendmail.dll
2016-12-10 03:51:45 ----A---- C:\WINDOWS\SYSWOW64\SearchFolder.dll
2016-12-10 03:51:45 ----A---- C:\WINDOWS\SYSWOW64\rasapi32.dll
2016-12-10 03:51:45 ----A---- C:\WINDOWS\SYSWOW64\policymanager.dll
2016-12-10 03:51:45 ----A---- C:\WINDOWS\SYSWOW64\mtxclu.dll
2016-12-10 03:51:45 ----A---- C:\WINDOWS\SYSWOW64\actxprxy.dll
2016-12-10 03:51:45 ----A---- C:\WINDOWS\system32\StorSvc.dll
2016-12-10 03:51:45 ----A---- C:\WINDOWS\system32\lpremove.exe
2016-12-10 03:51:45 ----A---- C:\WINDOWS\system32\drivers\modem.sys
2016-12-10 03:51:45 ----A---- C:\WINDOWS\system32\DeviceReactivation.dll
2016-12-10 03:51:44 ----A---- C:\WINDOWS\SYSWOW64\ngccredprov.dll
2016-12-10 03:51:44 ----A---- C:\WINDOWS\SYSWOW64\KernelBase.dll
2016-12-10 03:51:44 ----A---- C:\WINDOWS\system32\wkssvc.dll
2016-12-10 03:51:44 ----A---- C:\WINDOWS\system32\mfsvr.dll
2016-12-10 03:51:44 ----A---- C:\WINDOWS\system32\mfplat.dll
2016-12-10 03:51:44 ----A---- C:\WINDOWS\system32\bcastdvr.exe
2016-12-10 03:51:43 ----A---- C:\WINDOWS\SYSWOW64\cryptngc.dll
2016-12-10 03:51:43 ----A---- C:\WINDOWS\system32\BcastDVRHelper.dll
2016-12-10 03:51:42 ----A---- C:\WINDOWS\system32\lsm.dll
2016-12-10 03:51:42 ----A---- C:\WINDOWS\system32\KernelBase.dll
2016-12-10 03:51:41 ----A---- C:\WINDOWS\SYSWOW64\windows.storage.dll
2016-12-10 03:51:41 ----A---- C:\WINDOWS\system32\windows.storage.dll
2016-12-10 03:51:41 ----A---- C:\WINDOWS\system32\AppCapture.dll
2016-12-10 03:51:40 ----A---- C:\WINDOWS\system32\dwmcore.dll
2016-12-10 03:51:40 ----A---- C:\WINDOWS\system32\DisplayManager.dll
2016-12-10 03:51:39 ----A---- C:\WINDOWS\system32\ExplorerFrame.dll
2016-12-10 03:51:39 ----A---- C:\WINDOWS\system32\drivers\srv2.sys
2016-12-10 03:51:37 ----A---- C:\WINDOWS\SYSWOW64\migisol.dll
2016-12-10 03:51:37 ----A---- C:\WINDOWS\SYSWOW64\MFPlay.dll
2016-12-10 03:51:37 ----A---- C:\WINDOWS\system32\msdtcprx.dll
2016-12-10 03:51:37 ----A---- C:\WINDOWS\system32\migisol.dll
2016-12-10 03:51:37 ----A---- C:\WINDOWS\system32\mfmkvsrcsnk.dll
2016-12-10 03:51:37 ----A---- C:\WINDOWS\system32\mfaudiocnv.dll
2016-12-10 03:51:37 ----A---- C:\WINDOWS\system32\dialserver.dll
2016-12-10 03:51:37 ----A---- C:\WINDOWS\system32\CloudStorageWizard.exe
2016-12-10 03:51:36 ----A---- C:\WINDOWS\SYSWOW64\msdtcuiu.dll
2016-12-10 03:51:36 ----A---- C:\WINDOWS\system32\sppnp.dll
2016-12-10 03:51:36 ----A---- C:\WINDOWS\system32\RjvMDMConfig.dll
2016-12-10 03:51:36 ----A---- C:\WINDOWS\system32\ReAgentc.exe
2016-12-10 03:51:36 ----A---- C:\WINDOWS\system32\ProvSysprep.dll
2016-12-10 03:51:36 ----A---- C:\WINDOWS\system32\drivers\mrxsmb10.sys
2016-12-10 03:51:36 ----A---- C:\WINDOWS\system32\dpapisrv.dll
2016-12-10 03:51:36 ----A---- C:\WINDOWS\system32\aitstatic.exe
2016-12-10 03:51:35 ----A---- C:\WINDOWS\SYSWOW64\Windows.ApplicationModel.Store.dll
2016-12-10 03:51:32 ----A---- C:\WINDOWS\SYSWOW64\ieproxy.dll
2016-12-10 03:51:31 ----A---- C:\WINDOWS\system32\stobject.dll
2016-12-10 03:51:31 ----A---- C:\WINDOWS\system32\ieproxy.dll
2016-12-10 03:51:31 ----A---- C:\WINDOWS\system32\drivers\mrxsmb20.sys
2016-12-10 03:51:31 ----A---- C:\WINDOWS\system32\DevicePairing.dll
2016-12-10 03:51:31 ----A---- C:\WINDOWS\system32\DataSenseHandlers.dll
2016-12-10 03:51:30 ----A---- C:\WINDOWS\system32\urlmon.dll
2016-12-10 03:51:30 ----A---- C:\WINDOWS\system32\gameux.dll
2016-12-10 03:51:30 ----A---- C:\WINDOWS\explorer.exe
2016-12-10 03:51:29 ----A---- C:\WINDOWS\system32\WSManHTTPConfig.exe
2016-12-10 03:51:29 ----A---- C:\WINDOWS\system32\NMAA.dll
2016-12-10 03:51:29 ----A---- C:\WINDOWS\system32\MapControlCore.dll
2016-12-10 03:51:29 ----A---- C:\WINDOWS\system32\drivers\rdbss.sys
2016-12-10 03:51:28 ----A---- C:\WINDOWS\system32\zipfldr.dll
2016-12-10 03:51:28 ----A---- C:\WINDOWS\system32\IdCtrls.dll
2016-12-10 03:51:28 ----A---- C:\WINDOWS\system32\efswrt.dll
2016-12-10 03:51:27 ----A---- C:\WINDOWS\system32\WsmSvc.dll
2016-12-10 03:51:27 ----A---- C:\WINDOWS\system32\wininet.dll
2016-12-10 03:51:27 ----A---- C:\WINDOWS\system32\mos.dll
2016-12-10 03:51:26 ----A---- C:\WINDOWS\system32\UIAutomationCore.dll
2016-12-10 03:51:25 ----A---- C:\WINDOWS\SYSWOW64\ntshrui.dll
2016-12-10 03:51:25 ----A---- C:\WINDOWS\system32\SyncCenter.dll
2016-12-10 03:51:24 ----A---- C:\WINDOWS\system32\JpMapControl.dll
2016-12-10 03:51:24 ----A---- C:\WINDOWS\system32\BingMaps.dll
2016-12-10 03:51:23 ----A---- C:\WINDOWS\SYSWOW64\hevcdecoder.dll
2016-12-10 03:51:23 ----A---- C:\WINDOWS\system32\rasmans.dll
2016-12-10 03:51:22 ----A---- C:\WINDOWS\SYSWOW64\setupugc.exe
2016-12-10 03:51:22 ----A---- C:\WINDOWS\system32\setupugc.exe
2016-12-10 03:51:22 ----A---- C:\WINDOWS\system32\moshostcore.dll
2016-12-10 03:51:22 ----A---- C:\WINDOWS\system32\MapsStore.dll
2016-12-10 03:51:22 ----A---- C:\WINDOWS\system32\MapRouter.dll
2016-12-10 03:51:22 ----A---- C:\WINDOWS\system32\MapGeocoder.dll
2016-12-10 03:51:21 ----A---- C:\WINDOWS\SYSWOW64\wscinterop.dll
2016-12-10 03:51:21 ----A---- C:\WINDOWS\SYSWOW64\wscapi.dll
2016-12-10 03:51:21 ----A---- C:\WINDOWS\SYSWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2016-12-10 03:51:21 ----A---- C:\WINDOWS\SYSWOW64\ReAgentc.exe
2016-12-10 03:51:21 ----A---- C:\WINDOWS\SYSWOW64\NetSetupShim.dll
2016-12-10 03:51:21 ----A---- C:\WINDOWS\SYSWOW64\NetCfgNotifyObjectHost.exe
2016-12-10 03:51:21 ----A---- C:\WINDOWS\system32\vpnike.dll
2016-12-10 03:51:21 ----A---- C:\WINDOWS\system32\umpoext.dll
2016-12-10 03:51:21 ----A---- C:\WINDOWS\system32\sendmail.dll
2016-12-10 03:51:21 ----A---- C:\WINDOWS\system32\rasapi32.dll
2016-12-10 03:51:21 ----A---- C:\WINDOWS\system32\NetSetupShim.dll
2016-12-10 03:51:21 ----A---- C:\WINDOWS\system32\NetCfgNotifyObjectHost.exe
2016-12-10 03:51:21 ----A---- C:\WINDOWS\system32\MosStorage.dll
2016-12-10 03:51:21 ----A---- C:\WINDOWS\system32\moshost.dll
2016-12-10 03:51:21 ----A---- C:\WINDOWS\system32\MapsBtSvc.dll
2016-12-10 03:51:21 ----A---- C:\WINDOWS\system32\MapConfiguration.dll
2016-12-10 03:51:21 ----A---- C:\WINDOWS\system32\CbtBackgroundManagerPolicy.dll
2016-12-08 01:38:40 ----D---- C:\Program Files (x86)\Mozilla Firefox
2016-12-02 01:54:46 ----A---- C:\WINDOWS\system32\CFHD.dll
2016-12-02 01:54:42 ----A---- C:\WINDOWS\SYSWOW64\CFHD.dll
2016-11-29 05:50:07 ----A---- C:\WINDOWS\system32\drivers\tap0901.sys
2016-11-29 05:43:58 ----AD---- C:\Program Files\Common Files\DESIGNER
2016-11-29 05:43:38 ----D---- C:\WINDOWS\PCHEALTH
2016-11-26 20:11:25 ----D---- C:\Program Files (x86)\Rockstar Games
2016-11-21 05:41:39 ----A---- C:\WINDOWS\system32\PnkBstrA.exe
2016-11-21 02:10:23 ----A---- C:\WINDOWS\SYSWOW64\PnkBstrB.exe
2016-11-21 02:10:22 ----A---- C:\WINDOWS\SYSWOW64\PnkBstrA.exe
2016-11-20 19:51:49 ----D---- C:\Users\NG\AppData\Roaming\Origin
2016-11-20 19:48:06 ----D---- C:\ProgramData\Origin
2016-11-19 22:18:42 ----D---- C:\Users\NG\AppData\Roaming\Code
2016-11-11 02:26:32 ----A---- C:\WINDOWS\system32\WdfCoInstaller01011.dll
2016-11-11 02:25:14 ----A---- C:\WINDOWS\system32\ETDCoInstaller15014.dll
2016-11-09 18:49:51 ----A---- C:\WINDOWS\system32\WpAXHolder.dll
2016-11-09 18:49:50 ----A---- C:\WINDOWS\SYSWOW64\inetcomm.dll
2016-11-09 18:49:50 ----A---- C:\WINDOWS\SYSWOW64\iertutil.dll
2016-11-09 18:49:50 ----A---- C:\WINDOWS\system32\oleaut32.dll
2016-11-09 18:49:50 ----A---- C:\WINDOWS\system32\ActionCenterCPL.dll
2016-11-09 18:49:49 ----A---- C:\WINDOWS\SYSWOW64\weretw.dll
2016-11-09 18:49:49 ----A---- C:\WINDOWS\SYSWOW64\wer.dll
2016-11-09 18:49:49 ----A---- C:\WINDOWS\SYSWOW64\chartv.dll
2016-11-09 18:49:49 ----A---- C:\WINDOWS\SYSWOW64\fontdrvhost.exe
2016-11-09 18:49:49 ----A---- C:\WINDOWS\system32\weretw.dll
2016-11-09 18:49:49 ----A---- C:\WINDOWS\system32\wer.dll
2016-11-09 18:49:48 ----A---- C:\WINDOWS\SYSWOW64\atmfd.dll
2016-11-09 18:49:48 ----A---- C:\WINDOWS\system32\WpcRefreshTask.dll
2016-11-09 18:49:48 ----A---- C:\WINDOWS\system32\Windows.UI.Cred.dll
2016-11-09 18:49:48 ----A---- C:\WINDOWS\system32\ubpm.dll
2016-11-09 18:49:48 ----A---- C:\WINDOWS\system32\NetworkBindingEngineMigPlugin.dll
2016-11-09 18:49:48 ----A---- C:\WINDOWS\system32\drivers\bowser.sys
2016-11-09 18:49:48 ----A---- C:\WINDOWS\system32\asycfilt.dll
2016-11-09 18:49:47 ----A---- C:\WINDOWS\SYSWOW64\wininetlui.dll
2016-11-09 18:49:47 ----A---- C:\WINDOWS\SYSWOW64\NPSM.dll
2016-11-09 18:49:47 ----A---- C:\WINDOWS\system32\WpcTok.exe
2016-11-09 18:49:47 ----A---- C:\WINDOWS\system32\TSpkg.dll
2016-11-09 18:49:47 ----A---- C:\WINDOWS\system32\ddraw.dll
2016-11-09 18:49:47 ----A---- C:\WINDOWS\system32\dab.dll
2016-11-09 18:49:47 ----A---- C:\WINDOWS\system32\ActionCenter.dll
2016-11-09 18:49:46 ----A---- C:\WINDOWS\SYSWOW64\atmlib.dll
2016-11-09 18:49:45 ----A---- C:\WINDOWS\system32\chartv.dll
2016-11-09 18:49:44 ----A---- C:\WINDOWS\system32\wmp.dll
2016-11-09 18:49:43 ----A---- C:\WINDOWS\SYSWOW64\wmp.dll
2016-11-09 18:49:42 ----A---- C:\WINDOWS\SYSWOW64\twinapi.dll
2016-11-09 18:49:42 ----A---- C:\WINDOWS\SYSWOW64\themecpl.dll
2016-11-09 18:49:42 ----A---- C:\WINDOWS\SYSWOW64\fontext.dll
2016-11-09 18:49:42 ----A---- C:\WINDOWS\system32\twinapi.dll
2016-11-09 18:49:42 ----A---- C:\WINDOWS\system32\authui.dll
2016-11-09 18:49:41 ----A---- C:\WINDOWS\SYSWOW64\sud.dll
2016-11-09 18:49:41 ----A---- C:\WINDOWS\SYSWOW64\hgcpl.dll
2016-11-09 18:49:39 ----A---- C:\WINDOWS\system32\ListSvc.dll
2016-11-09 18:49:39 ----A---- C:\WINDOWS\system32\efsext.dll
2016-11-09 18:49:38 ----A---- C:\WINDOWS\system32\wwansvc.dll
2016-11-09 18:49:37 ----A---- C:\WINDOWS\SYSWOW64\AuthExt.dll
2016-11-09 18:49:34 ----A---- C:\WINDOWS\system32\themecpl.dll
2016-11-09 18:49:34 ----A---- C:\WINDOWS\system32\sud.dll
2016-11-09 18:49:33 ----A---- C:\WINDOWS\SYSWOW64\mstsc.exe
2016-11-09 18:49:33 ----A---- C:\WINDOWS\system32\hgcpl.dll
2016-11-09 18:49:33 ----A---- C:\WINDOWS\system32\fontext.dll
2016-11-09 18:49:32 ----A---- C:\WINDOWS\system32\SystemSettings.UserAccountsHandlers.dll
2016-11-09 18:49:27 ----A---- C:\WINDOWS\system32\WlanMediaManager.dll
2016-11-09 18:49:27 ----A---- C:\WINDOWS\system32\NPSM.dll
2016-11-09 18:49:27 ----A---- C:\WINDOWS\system32\NetworkDesktopSettings.dll
2016-11-09 18:49:27 ----A---- C:\WINDOWS\system32\drivers\ntfs.sys
2016-11-09 18:49:26 ----A---- C:\WINDOWS\SYSWOW64\olepro32.dll
2016-11-09 18:49:26 ----A---- C:\WINDOWS\SYSWOW64\asycfilt.dll
2016-11-09 18:49:26 ----A---- C:\WINDOWS\system32\DeviceCenter.dll
2016-11-09 18:49:25 ----A---- C:\WINDOWS\SYSWOW64\oleaut32.dll
2016-11-09 18:49:25 ----A---- C:\WINDOWS\SYSWOW64\LockAppBroker.dll
2016-11-09 18:49:24 ----A---- C:\WINDOWS\SYSWOW64\mshtmled.dll
2016-11-09 18:49:23 ----A---- C:\WINDOWS\SYSWOW64\ActionCenterCPL.dll
2016-11-09 18:49:22 ----A---- C:\WINDOWS\system32\MSVidCtl.dll
2016-11-09 18:49:22 ----A---- C:\WINDOWS\system32\mfsensorgroup.dll
2016-11-09 18:49:22 ----A---- C:\WINDOWS\system32\LockAppBroker.dll
2016-11-09 18:49:17 ----A---- C:\WINDOWS\system32\shdocvw.dll
2016-11-09 18:49:17 ----A---- C:\WINDOWS\system32\iertutil.dll
2016-11-09 18:49:15 ----A---- C:\WINDOWS\SYSWOW64\ieapfltr.dll
2016-11-09 18:49:15 ----A---- C:\WINDOWS\SYSWOW64\d3d9.dll
2016-11-09 18:49:15 ----A---- C:\WINDOWS\system32\mshtmled.dll
2016-11-09 18:49:15 ----A---- C:\WINDOWS\system32\FSClient.dll
2016-11-09 18:49:13 ----A---- C:\WINDOWS\SYSWOW64\Windows.Globalization.dll
2016-11-09 18:49:13 ----A---- C:\WINDOWS\system32\PsmServiceExtHost.dll
2016-11-09 18:49:13 ----A---- C:\WINDOWS\system32\ieapfltr.dll
2016-11-09 18:49:13 ----A---- C:\WINDOWS\system32\FrameServer.dll
2016-11-09 18:49:09 ----A---- C:\WINDOWS\system32\Windows.Globalization.dll
2016-11-09 18:49:09 ----A---- C:\WINDOWS\system32\inetcomm.dll
2016-11-09 18:49:09 ----A---- C:\WINDOWS\system32\bisrv.dll
2016-11-09 18:49:03 ----A---- C:\WINDOWS\SYSWOW64\dxtrans.dll
2016-11-09 18:49:03 ----A---- C:\WINDOWS\system32\Windows.Devices.HumanInterfaceDevice.dll
2016-11-09 18:49:03 ----A---- C:\WINDOWS\system32\wifinetworkmanager.dll
2016-11-09 18:49:03 ----A---- C:\WINDOWS\system32\ErrorDetails.dll
2016-11-09 18:49:01 ----A---- C:\WINDOWS\SYSWOW64\NetSetupEngine.dll
2016-11-09 18:49:01 ----A---- C:\WINDOWS\system32\mstsc.exe
2016-11-09 18:49:00 ----A---- C:\WINDOWS\SYSWOW64\UIAnimation.dll
2016-11-09 18:49:00 ----A---- C:\WINDOWS\SYSWOW64\NetSetupApi.dll
2016-11-09 18:49:00 ----A---- C:\WINDOWS\SYSWOW64\input.dll
2016-11-09 18:49:00 ----A---- C:\WINDOWS\system32\wifitask.exe
2016-11-09 18:48:59 ----A---- C:\WINDOWS\SYSWOW64\TSpkg.dll
2016-11-09 18:48:59 ----A---- C:\WINDOWS\SYSWOW64\ErrorDetails.dll
2016-11-09 18:48:59 ----A---- C:\WINDOWS\system32\iepeers.dll
2016-11-09 18:48:59 ----A---- C:\WINDOWS\system32\ErrorDetailsUpdate.dll
2016-11-09 18:48:58 ----A---- C:\WINDOWS\SYSWOW64\iepeers.dll
2016-11-09 18:48:58 ----A---- C:\WINDOWS\SYSWOW64\GlobCollationHost.dll
2016-11-09 18:48:58 ----A---- C:\WINDOWS\SYSWOW64\ErrorDetailsUpdate.dll
2016-11-09 18:48:58 ----A---- C:\WINDOWS\system32\ipnathlp.dll
2016-11-09 18:48:58 ----A---- C:\WINDOWS\system32\GlobCollationHost.dll
2016-11-09 18:48:58 ----A---- C:\WINDOWS\system32\dxtrans.dll
2016-11-09 18:48:57 ----A---- C:\WINDOWS\SYSWOW64\mfsensorgroup.dll
2016-11-09 18:48:57 ----A---- C:\WINDOWS\system32\msinfo32.exe
2016-11-09 18:48:56 ----A---- C:\WINDOWS\SYSWOW64\MSVidCtl.dll
2016-11-09 18:48:56 ----A---- C:\WINDOWS\SYSWOW64\msinfo32.exe
2016-11-09 18:48:56 ----A---- C:\WINDOWS\SYSWOW64\FSClient.dll
2016-11-09 18:48:56 ----A---- C:\WINDOWS\SYSWOW64\authui.dll
2016-11-09 18:48:54 ----A---- C:\WINDOWS\system32\d3d9.dll
2016-11-09 18:48:53 ----A---- C:\WINDOWS\system32\fontdrvhost.exe
2016-11-09 18:48:53 ----A---- C:\WINDOWS\system32\FlightSettings.dll
2016-11-09 18:48:52 ----A---- C:\WINDOWS\SYSWOW64\Windows.Devices.HumanInterfaceDevice.dll
2016-11-09 18:48:52 ----A---- C:\WINDOWS\SYSWOW64\efsext.dll
2016-11-09 18:48:52 ----A---- C:\WINDOWS\system32\NetworkUXBroker.dll
2016-11-09 18:48:51 ----A---- C:\WINDOWS\system32\UIAnimation.dll
2016-11-09 18:48:51 ----A---- C:\WINDOWS\system32\NetSetupSvc.dll
2016-11-09 18:48:51 ----A---- C:\WINDOWS\system32\NetSetupEngine.dll
2016-11-09 18:48:51 ----A---- C:\WINDOWS\system32\microsoft-windows-system-events.dll
2016-11-09 18:48:51 ----A---- C:\WINDOWS\system32\drivers\iorate.sys
2016-11-09 18:48:51 ----A---- C:\WINDOWS\system32\atmfd.dll
2016-11-09 18:48:50 ----A---- C:\WINDOWS\SYSWOW64\ddraw.dll
2016-11-09 18:48:50 ----A---- C:\WINDOWS\SYSWOW64\d3d8.dll
2016-11-09 18:48:50 ----A---- C:\WINDOWS\SYSWOW64\comctl32.dll
2016-11-09 18:48:50 ----A---- C:\WINDOWS\system32\wininetlui.dll
2016-11-09 18:48:50 ----A---- C:\WINDOWS\system32\NetSetupApi.dll
2016-11-09 18:48:50 ----A---- C:\WINDOWS\system32\input.dll
2016-11-09 18:48:47 ----A---- C:\WINDOWS\system32\atmlib.dll
2016-11-04 11:27:08 ----A---- C:\WINDOWS\system32\WinUSBCoInstaller2.dll
2016-11-04 11:27:06 ----A---- C:\WINDOWS\system32\WdfCoInstaller01009.dll
2016-10-29 15:59:00 ----D---- C:\WINDOWS\SYSWOW64\directx
2016-10-28 18:53:06 ----A---- C:\WINDOWS\system32\DolbyDecMFT.dll
2016-10-28 18:52:59 ----A---- C:\WINDOWS\system32\mfps.dll
2016-10-28 18:52:38 ----A---- C:\WINDOWS\system32\SettingsHandlers_Bluetooth.dll
2016-10-28 18:52:34 ----A---- C:\WINDOWS\SYSWOW64\Windows.Media.Playback.MediaPlayer.dll
2016-10-28 18:52:34 ----A---- C:\WINDOWS\SYSWOW64\Windows.Media.Playback.BackgroundMediaPlayer.dll
2016-10-28 18:52:34 ----A---- C:\WINDOWS\SYSWOW64\Windows.Media.BackgroundMediaPlayback.dll
2016-10-28 18:52:33 ----A---- C:\WINDOWS\SYSWOW64\RemoteNaturalLanguage.dll
2016-10-28 18:52:32 ----A---- C:\WINDOWS\system32\energy.dll
2016-10-28 18:52:31 ----A---- C:\WINDOWS\SYSWOW64\BluetoothApis.dll
2016-10-28 18:52:31 ----A---- C:\WINDOWS\system32\msvproc.dll
2016-10-28 18:52:31 ----A---- C:\WINDOWS\system32\drivers\ahcache.sys
2016-10-28 18:52:30 ----A---- C:\WINDOWS\SYSWOW64\drvstore.dll
2016-10-28 18:52:30 ----A---- C:\WINDOWS\system32\MusNotification.exe
2016-10-28 18:52:30 ----A---- C:\WINDOWS\system32\MFCaptureEngine.dll
2016-10-28 18:52:29 ----A---- C:\WINDOWS\SYSWOW64\iscsiwmi.dll
2016-10-28 18:52:29 ----A---- C:\WINDOWS\system32\TpmTasks.dll
2016-10-28 18:52:27 ----A---- C:\WINDOWS\system32\Windows.Networking.dll
2016-10-28 18:52:22 ----A---- C:\WINDOWS\system32\Windows.Media.Speech.dll
2016-10-28 18:52:21 ----A---- C:\WINDOWS\system32\Windows.Networking.Connectivity.dll
2016-10-28 18:52:11 ----A---- C:\WINDOWS\SYSWOW64\wsp_health.dll
2016-10-28 18:52:11 ----A---- C:\WINDOWS\SYSWOW64\wsp_fs.dll
2016-10-28 18:52:10 ----A---- C:\WINDOWS\system32\SettingsHandlers_Flights.dll
2016-10-28 18:52:09 ----A---- C:\WINDOWS\system32\drivers\dam.sys
2016-10-28 18:52:08 ----A---- C:\WINDOWS\SYSWOW64\DolbyDecMFT.dll
2016-10-28 18:52:08 ----A---- C:\WINDOWS\SYSWOW64\cmifw.dll
2016-10-28 18:52:08 ----A---- C:\WINDOWS\system32\drivers\capimg.sys
2016-10-28 18:52:07 ----A---- C:\WINDOWS\system32\powercfg.exe
2016-10-28 18:52:07 ----A---- C:\WINDOWS\system32\fhcpl.dll
2016-10-28 18:52:07 ----A---- C:\WINDOWS\system32\Display.dll
2016-10-28 18:52:07 ----A---- C:\WINDOWS\system32\autoplay.dll
2016-10-28 18:52:06 ----A---- C:\WINDOWS\system32\taskbarcpl.dll
2016-10-28 18:52:06 ----A---- C:\WINDOWS\system32\OnDemandConnRouteHelper.dll
2016-10-28 18:52:06 ----A---- C:\WINDOWS\system32\DevicePairingFolder.dll
2016-10-28 18:52:05 ----A---- C:\WINDOWS\system32\qmgr.dll
2016-10-28 18:52:05 ----A---- C:\WINDOWS\system32\mfksproxy.dll
2016-10-28 18:52:02 ----A---- C:\WINDOWS\SYSWOW64\mfksproxy.dll
2016-10-28 18:52:00 ----A---- C:\WINDOWS\SYSWOW64\Geolocation.dll
2016-10-28 18:51:59 ----A---- C:\WINDOWS\SYSWOW64\Windows.Networking.Connectivity.dll
2016-10-28 18:51:54 ----A---- C:\WINDOWS\SYSWOW64\mispace.dll
2016-10-28 18:51:54 ----A---- C:\WINDOWS\system32\mispace.dll
2016-10-28 18:51:54 ----A---- C:\WINDOWS\system32\diagtrack.dll
2016-10-28 18:51:53 ----A---- C:\WINDOWS\system32\generaltel.dll
2016-10-28 18:51:53 ----A---- C:\WINDOWS\system32\devinv.dll
2016-10-28 18:51:53 ----A---- C:\WINDOWS\system32\CompatTelRunner.exe
2016-10-28 18:51:52 ----A---- C:\WINDOWS\system32\wsp_health.dll
2016-10-28 18:51:52 ----A---- C:\WINDOWS\system32\wsp_fs.dll
2016-10-28 18:51:52 ----A---- C:\WINDOWS\system32\spoolsv.exe
2016-10-28 18:51:52 ----A---- C:\WINDOWS\splwow64.exe
2016-10-28 18:51:51 ----A---- C:\WINDOWS\SYSWOW64\Windows.Networking.dll
2016-10-28 18:51:51 ----A---- C:\WINDOWS\SYSWOW64\esent.dll
2016-10-28 18:51:51 ----A---- C:\WINDOWS\system32\wintrust.dll
2016-10-28 18:51:50 ----A---- C:\WINDOWS\system32\esent.dll
2016-10-28 18:51:49 ----A---- C:\WINDOWS\system32\invagent.dll
2016-10-28 18:51:49 ----A---- C:\WINDOWS\system32\aepic.dll
2016-10-28 18:51:48 ----A---- C:\WINDOWS\system32\drivers\crashdmp.sys
2016-10-28 18:51:47 ----A---- C:\WINDOWS\SYSWOW64\wmpeffects.dll
2016-10-28 18:51:47 ----A---- C:\WINDOWS\system32\wmpeffects.dll
2016-10-28 18:51:47 ----A---- C:\WINDOWS\system32\pcasvc.dll
2016-10-28 18:51:47 ----A---- C:\WINDOWS\system32\drvstore.dll
2016-10-28 18:51:46 ----A---- C:\WINDOWS\SYSWOW64\wmpdxm.dll
2016-10-28 18:51:46 ----A---- C:\WINDOWS\system32\wmpshell.dll
2016-10-28 18:51:46 ----A---- C:\WINDOWS\system32\wmpdxm.dll
2016-10-28 18:51:46 ----A---- C:\WINDOWS\system32\iscsiwmi.dll
2016-10-28 18:51:46 ----A---- C:\WINDOWS\system32\drivers\storport.sys
2016-10-28 18:51:46 ----A---- C:\WINDOWS\system32\cmifw.dll
2016-10-28 18:51:44 ----A---- C:\WINDOWS\SYSWOW64\wmpshell.dll
2016-10-28 18:51:43 ----A---- C:\WINDOWS\SYSWOW64\esentutl.exe
2016-10-28 18:51:43 ----A---- C:\WINDOWS\system32\wups.dll
2016-10-28 18:51:43 ----A---- C:\WINDOWS\system32\esentutl.exe
2016-10-28 18:51:40 ----A---- C:\WINDOWS\system32\sppsvc.exe
2016-10-28 18:51:39 ----A---- C:\WINDOWS\system32\SndVolSSO.dll
2016-10-28 18:51:35 ----A---- C:\WINDOWS\SYSWOW64\Windows.Data.Pdf.dll
2016-10-28 18:51:34 ----A---- C:\WINDOWS\system32\FntCache.dll
2016-10-28 18:51:33 ----A---- C:\WINDOWS\system32\Windows.Data.Pdf.dll
2016-10-28 18:51:27 ----A---- C:\WINDOWS\system32\CPFilters.dll
2016-10-28 18:51:26 ----A---- C:\WINDOWS\system32\Windows.Media.Playback.MediaPlayer.dll
2016-10-28 18:51:26 ----A---- C:\WINDOWS\system32\Windows.Media.Playback.BackgroundMediaPlayer.dll
2016-10-28 18:51:26 ----A---- C:\WINDOWS\system32\Windows.Media.BackgroundMediaPlayback.dll
2016-10-28 18:51:26 ----A---- C:\WINDOWS\system32\wc_storage.dll
2016-10-28 18:51:26 ----A---- C:\WINDOWS\system32\daxexec.dll
2016-10-28 18:51:24 ----A---- C:\WINDOWS\system32\DeviceCensus.exe
2016-10-28 18:51:23 ----A---- C:\WINDOWS\SYSWOW64\Windows.Devices.WiFi.dll
2016-10-28 18:51:23 ----A---- C:\WINDOWS\system32\Windows.Devices.WiFi.dll
2016-10-28 18:51:23 ----A---- C:\WINDOWS\system32\crypt32.dll
2016-10-28 18:51:22 ----A---- C:\WINDOWS\system32\winhttp.dll
2016-10-28 18:51:22 ----A---- C:\WINDOWS\system32\BthRadioMedia.dll
2016-10-28 18:51:22 ----A---- C:\WINDOWS\system32\BluetoothApis.dll
2016-10-28 18:51:20 ----A---- C:\WINDOWS\system32\MDMAppInstaller.exe
2016-10-28 18:51:19 ----A---- C:\WINDOWS\SYSWOW64\dtdump.exe
2016-10-28 18:51:19 ----A---- C:\WINDOWS\system32\dafBth.dll
2016-10-28 18:51:16 ----A---- C:\WINDOWS\SYSWOW64\systemcpl.dll
2016-10-28 18:51:16 ----A---- C:\WINDOWS\SYSWOW64\autoplay.dll
2016-10-28 18:51:16 ----A---- C:\WINDOWS\system32\EncDec.dll
2016-10-28 18:51:16 ----A---- C:\WINDOWS\system32\dhcpcore6.dll
2016-10-28 18:51:12 ----A---- C:\WINDOWS\SYSWOW64\DWrite.dll
2016-10-28 18:51:11 ----A---- C:\WINDOWS\system32\drivers\tcpip.sys
2016-10-28 18:51:08 ----A---- C:\WINDOWS\system32\Geolocation.dll
2016-10-28 18:51:06 ----A---- C:\WINDOWS\system32\drivers\http.sys
2016-10-28 18:51:05 ----A---- C:\WINDOWS\system32\NotificationController.dll
2016-10-28 18:51:04 ----A---- C:\WINDOWS\system32\DWrite.dll
2016-10-28 18:51:03 ----A---- C:\WINDOWS\system32\drivers\spaceport.sys
2016-10-28 18:51:01 ----A---- C:\WINDOWS\SYSWOW64\CPFilters.dll
2016-10-28 18:51:00 ----A---- C:\WINDOWS\SYSWOW64\SndVolSSO.dll
2016-10-28 18:50:59 ----A---- C:\WINDOWS\SYSWOW64\daxexec.dll
2016-10-28 18:50:53 ----A---- C:\WINDOWS\SYSWOW64\Windows.Media.Speech.dll
2016-10-28 18:50:47 ----A---- C:\WINDOWS\SYSWOW64\wintrust.dll
2016-10-28 18:50:47 ----A---- C:\WINDOWS\system32\RemoteNaturalLanguage.dll
2016-10-28 18:50:47 ----A---- C:\WINDOWS\system32\LocationFramework.dll
2016-10-28 18:50:46 ----A---- C:\WINDOWS\SYSWOW64\crypt32.dll
2016-10-28 18:50:46 ----A---- C:\WINDOWS\system32\MusUpdateHandlers.dll
2016-10-28 18:50:46 ----A---- C:\WINDOWS\system32\CloudExperienceHostBroker.dll
2016-10-28 18:50:45 ----A---- C:\WINDOWS\system32\iphlpsvc.dll
2016-10-28 18:50:44 ----A---- C:\WINDOWS\SYSWOW64\winhttp.dll
2016-10-28 18:50:44 ----A---- C:\WINDOWS\SYSWOW64\msvproc.dll
2016-10-28 18:50:44 ----A---- C:\WINDOWS\system32\drivers\FWPKCLNT.SYS
2016-10-28 18:50:44 ----A---- C:\WINDOWS\system32\drivers\afd.sys
2016-10-28 18:50:43 ----A---- C:\WINDOWS\system32\twinui.pcshell.dll
2016-10-28 18:50:42 ----A---- C:\WINDOWS\system32\drivers\hidclass.sys
2016-10-28 18:50:42 ----A---- C:\WINDOWS\system32\AudioSrvPolicyManager.dll
2016-10-28 18:50:41 ----A---- C:\WINDOWS\SYSWOW64\powercfg.exe
2016-10-28 18:50:41 ----A---- C:\WINDOWS\SYSWOW64\dhcpcore6.dll
======List of files/folders modified in the last 3 months======
2017-01-26 10:31:21 ----D---- C:\Program Files\trend micro
2017-01-26 10:21:56 ----D---- C:\WINDOWS\Prefetch
2017-01-26 10:07:07 ----D---- C:\WINDOWS\Temp
2017-01-26 10:07:07 ----D---- C:\WINDOWS\system32\SleepStudy
2017-01-26 09:53:17 ----D---- C:\Users\NG\AppData\Roaming\npm-cache
2017-01-26 09:47:17 ----D---- C:\WINDOWS\system32\sru
2017-01-26 09:45:10 ----D---- C:\WINDOWS\System32
2017-01-26 09:45:10 ----A---- C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2017-01-25 21:22:59 ----D---- C:\WINDOWS\system32\config
2017-01-25 21:22:50 ----D---- C:\WINDOWS\CbsTemp
2017-01-25 21:22:49 ----D---- C:\WINDOWS\SysWOW64
2017-01-25 21:22:48 ----D---- C:\WINDOWS\WinSxS
2017-01-25 21:22:45 ----RD---- C:\WINDOWS\Microsoft.NET
2017-01-25 17:46:05 ----D---- C:\Users\NG\AppData\Roaming\Skype
2017-01-25 16:19:24 ----HD---- C:\Program Files\WindowsApps
2017-01-25 16:19:24 ----D---- C:\WINDOWS\AppReadiness
2017-01-23 09:53:42 ----D---- C:\WINDOWS\LiveKernelReports
2017-01-22 17:30:37 ----D---- C:\Users\NG\AppData\Roaming\uTorrent
2017-01-22 00:32:27 ----D---- C:\Users\NG\AppData\Roaming\Dropbox
2017-01-20 21:59:55 ----D---- C:\WINDOWS\system32\Tasks
2017-01-16 16:19:47 ----D---- C:\WINDOWS\system32\NDF
2017-01-14 12:51:27 ----D---- C:\WINDOWS\system32\catroot2
2017-01-13 22:01:01 ----D---- C:\WINDOWS\rescache
2017-01-13 21:54:48 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2017-01-13 21:21:15 ----D---- C:\WINDOWS\system32\DriverStore
2017-01-13 21:21:11 ----D---- C:\WINDOWS\INF
2017-01-13 21:21:03 ----D---- C:\WINDOWS\system32\LogFiles
2017-01-13 21:21:03 ----D---- C:\Windows
2017-01-13 21:20:35 ----SHD---- C:\Config.Msi
2017-01-13 21:20:06 ----RD---- C:\WINDOWS\ImmersiveControlPanel
2017-01-13 21:20:06 ----D---- C:\WINDOWS\system32\WinBioPlugIns
2017-01-13 21:20:06 ----D---- C:\WINDOWS\system32\wbem
2017-01-13 21:20:06 ----D---- C:\WINDOWS\system32\oobe
2017-01-13 21:20:06 ----D---- C:\WINDOWS\ShellExperiences
2017-01-13 21:20:06 ----D---- C:\WINDOWS\Provisioning
2017-01-13 21:20:06 ----D---- C:\Program Files\Internet Explorer
2017-01-13 21:20:06 ----D---- C:\Program Files (x86)\Internet Explorer
2017-01-13 21:20:05 ----D---- C:\WINDOWS\system32\drivers
2017-01-13 19:13:54 ----SHDC---- C:\WINDOWS\Installer
2017-01-12 21:29:58 ----RSD---- C:\WINDOWS\assembly
2017-01-12 21:27:05 ----D---- C:\ProgramData\Microsoft Help
2017-01-12 21:22:45 ----D---- C:\WINDOWS\system32\MRT
2017-01-12 21:13:06 ----AC---- C:\WINDOWS\system32\MRT.exe
2017-01-12 19:25:11 ----D---- C:\WINDOWS\Logs
2016-12-30 13:21:58 ----D---- C:\Users\NG\AppData\Roaming\Adobe
2016-12-30 13:12:21 ----D---- C:\ProgramData\regid.1986-12.com.adobe
2016-12-23 12:13:26 ----A---- C:\WINDOWS\SYSWOW64\FlashPlayerApp.exe
2016-12-23 00:34:32 ----HD---- C:\ProgramData
2016-12-20 17:51:41 ----D---- C:\ProgramData\Package Cache
2016-12-20 17:50:54 ----RD---- C:\Program Files (x86)
2016-12-17 13:09:20 ----D---- C:\WINDOWS\Tasks
2016-12-15 01:04:15 ----D---- C:\WINDOWS\SYSWOW64\en-US
2016-12-15 01:04:15 ----D---- C:\WINDOWS\system32\en-US
2016-12-15 01:04:15 ----D---- C:\WINDOWS\AppPatch
2016-12-15 01:04:14 ----D---- C:\WINDOWS\system32\Boot
2016-12-14 06:43:04 ----D---- C:\ProgramData\Adobe
2016-12-14 01:07:48 ----D---- C:\WINDOWS\SYSWOW64\oobe
2016-12-14 01:07:48 ----D---- C:\WINDOWS\SYSWOW64\Dism
2016-12-14 01:07:47 ----D---- C:\WINDOWS\system32\Sysprep
2016-12-14 01:07:47 ----D---- C:\WINDOWS\system32\sr-Latn-CS
2016-12-14 01:07:47 ----D---- C:\WINDOWS\system32\Dism
2016-12-14 01:07:47 ----D---- C:\WINDOWS\servicing
2016-12-14 01:07:46 ----D---- C:\WINDOWS\bcastdvr
2016-12-11 14:30:52 ----D---- C:\Program Files\Common Files\Adobe
2016-12-11 14:26:57 ----RD---- C:\Program Files
2016-12-11 14:21:45 ----AD---- C:\Program Files (x86)\Adobe
2016-12-10 03:36:48 ----A---- C:\WINDOWS\system32\enrollmentapi.dll
2016-12-08 02:09:28 ----D---- C:\Program Files\Elantech
2016-12-07 21:12:35 ----D---- C:\WINDOWS\system32\CatRoot
2016-12-06 19:36:02 ----AD---- C:\Program Files\Common Files\microsoft shared
2016-12-04 19:59:18 ----D---- C:\WINDOWS\system32\drivers\UMDF
2016-11-29 05:44:03 ----RSD---- C:\WINDOWS\Fonts
2016-11-29 05:43:58 ----D---- C:\Program Files\Common Files
2016-11-29 05:43:50 ----AD---- C:\ProgramData\regid.1991-06.com.microsoft
2016-11-29 05:43:38 ----D---- C:\Program Files (x86)\Microsoft.NET
2016-11-26 11:38:17 ----D---- C:\Program Files (x86)\Common Files
2016-11-22 22:47:36 ----D---- C:\Users\NG\AppData\Roaming\npm
2016-11-18 17:33:32 ----D---- C:\Games
2016-11-10 17:41:29 ----D---- C:\WINDOWS\SYSWOW64\migration
2016-11-10 17:41:24 ----D---- C:\WINDOWS\system32\migwiz
2016-11-10 17:41:24 ----D---- C:\WINDOWS\system32\migration
2016-11-03 20:51:06 ----D---- C:\Users\NG\AppData\Roaming\FileZilla
2016-10-29 17:59:47 ----HD---- C:\WINDOWS\msdownld.tmp
2016-10-29 16:13:06 ----D---- C:\WINDOWS\system32\WDI
2016-10-29 16:09:41 ----D---- C:\WINDOWS\system32\appraiser
2016-10-29 16:09:37 ----D---- C:\Program Files\Windows Media Player
2016-10-29 16:09:37 ----D---- C:\Program Files (x86)\Windows Media Player
2016-10-28 18:09:59 ----N---- C:\WINDOWS\system32\MpSigStub.exe
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 iaStorA;iaStorA; C:\WINDOWS\System32\drivers\iaStorA.sys [2014-04-02 633192]
R0 iorate;@%SystemRoot%\system32\drivers\iorate.sys,-100; C:\WINDOWS\system32\drivers\iorate.sys [2016-11-02 48992]
R1 ElbyCDIO;ElbyCDIO Driver; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [2013-03-05 40344]
R1 FileCrypt;@%systemroot%\system32\drivers\filecrypt.sys,-100; C:\WINDOWS\system32\drivers\filecrypt.sys [2016-07-17 88576]
R1 GpuEnergyDrv;@%SystemRoot%\system32\drivers\gpuenergydrv.sys,-100; C:\WINDOWS\System32\drivers\gpuenergydrv.sys [2016-07-17 8192]
R2 clreg;@%SystemRoot%\system32\drivers\registry.sys,-100; C:\WINDOWS\System32\drivers\registry.sys [2016-07-17 70144]
R2 MMCSS;@%systemroot%\system32\drivers\mmcss.sys,-100; C:\WINDOWS\system32\drivers\mmcss.sys [2016-07-17 48128]
R2 storqosflt;@%SystemRoot%\System32\drivers\storqosflt.sys,-101; C:\WINDOWS\system32\drivers\storqosflt.sys [2016-07-17 78336]
R3 acpials;@sensorsalsdriver.inf,%kbfiltr.SvcDesc%;ALS Sensor Filter; C:\WINDOWS\System32\drivers\acpials.sys [2016-07-17 11264]
R3 BthA2DP;@wdma_bt.inf,%BthA2DP.SvcDesc%;Bluetooth Stereo; C:\WINDOWS\system32\drivers\BthA2DP.sys [2016-10-24 168448]
R3 BthEnum;@bth.inf,%BthEnum.SVCDESC%;Bluetooth Enumerator Service; C:\WINDOWS\System32\drivers\BthEnum.sys [2016-10-24 114176]
R3 BthHFAud;@wdma_bt.inf,%DISPLAY_NAME%;Bluetooth Hands-Free; C:\WINDOWS\system32\DRIVERS\BthHfAud.sys [2016-07-17 37376]
R3 BthLEEnum;@BthLEEnum.inf,%BthLEEnum.SVCDESC%;Bluetooth Low Energy Driver; C:\WINDOWS\system32\DRIVERS\BthLEEnum.sys [2016-10-24 249856]
R3 BthPan;@bthpan.inf,%BthPan.DisplayName%;Bluetooth Device (Personal Area Network); C:\WINDOWS\System32\drivers\bthpan.sys [2016-10-24 128512]
R3 BTHUSB;@bth.inf,%BTHUSB.SvcDesc%;Bluetooth Radio USB Driver; C:\WINDOWS\System32\drivers\BTHUSB.sys [2016-10-24 84992]
R3 ETD;@oem24.inf,%PS2DeviceDesc%;ELAN PS/2 Port Input Device; C:\WINDOWS\system32\DRIVERS\ETD.sys [2016-11-11 589392]
R3 ETDSMBus;ETDSMBus; C:\WINDOWS\system32\DRIVERS\ETDSMBus.sys [2015-09-23 32328]
R3 ibtusb;@oem2.inf,%ibtusb.SVCDESC_IBT%;Intel(R) Wireless Bluetooth(R); C:\WINDOWS\system32\DRIVERS\ibtusb.sys [2016-05-26 345872]
R3 igfx;igfx; C:\WINDOWS\system32\DRIVERS\igdkmd64.sys [2016-07-20 7949952]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RTKVHD64.sys [2015-09-23 4519144]
R3 ISCT;@oem29.inf,%ISCT.DeviceDesc%;Intel(R) Smart Connect Technology Device Driver; C:\WINDOWS\System32\drivers\ISCTD64.sys [2013-07-31 47008]
R3 iwdbus;@oem59.inf,%iwdbus.SVCDESC%;IWD Bus Enumerator; C:\WINDOWS\System32\drivers\iwdbus.sys [2014-05-07 27032]
R3 MEIx64;@oem54.inf,%TEE_SvcDesc%;Intel(R) Management Engine Interface ; C:\WINDOWS\System32\drivers\TeeDriverW8x64.sys [2015-06-12 183584]
R3 NETwNb64;___ Intel(R) Wireless Adapter Driver for Windows 8.1 - 64 Bit; C:\WINDOWS\System32\drivers\Netwbw02.sys [2016-07-17 3485696]
R3 RadioHIDMini;@oem23.inf,%RadioHIDMini%;Radio HID Mini-driver; C:\WINDOWS\System32\drivers\RadioHIDMini.sys [2012-07-28 23408]
R3 RFCOMM;@tdibth.inf,%RFCOMM.DisplayName%;Bluetooth Device (RFCOMM Protocol TDI); C:\WINDOWS\System32\drivers\rfcomm.sys [2016-07-17 183808]
R3 rt640x64;@oem60.inf,%rt640.Service.DispName%;Realtek RT640 NT Driver; C:\WINDOWS\System32\drivers\rt640x64.sys [2015-06-23 895256]
R3 SensorsAlsDriver;@sensorsalsdriver.inf,%WudfSensorsAlsDriverDisplayName%;UMDF Reflector service for SensorsAlsDriver; C:\WINDOWS\System32\drivers\WUDFRd.sys [2016-07-17 216064]
S0 LSI_SAS2i;LSI_SAS2i; C:\WINDOWS\System32\drivers\lsi_sas2i.sys [2016-07-17 105824]
S0 LSI_SAS3i;LSI_SAS3i; C:\WINDOWS\System32\drivers\lsi_sas3i.sys [2016-07-17 101216]
S0 megasas2i;megasas2i; C:\WINDOWS\System32\drivers\MegaSas2i.sys [2016-10-24 64352]
S0 percsas2i;percsas2i; C:\WINDOWS\System32\drivers\percsas2i.sys [2016-07-17 58720]
S0 percsas3i;percsas3i; C:\WINDOWS\System32\drivers\percsas3i.sys [2016-07-17 61792]
S0 scmbus;@scmbus.inf,%scmbus.SvcDesc%;Microsoft Storage Class Memory Bus Driver; C:\WINDOWS\System32\drivers\scmbus.sys [2016-07-17 88416]
S0 storufs;@storufs.inf,%UfsServiceDesc%;Microsoft Universal Flash Storage (UFS) Driver; C:\WINDOWS\System32\drivers\storufs.sys [2016-07-17 32096]
S3 AcpiDev;@acpidev.inf,%AcpiDev.SvcDesc%;ACPI Devices driver; C:\WINDOWS\System32\drivers\AcpiDev.sys [2016-07-17 18432]
S3 acsock;acsock; C:\WINDOWS\system32\DRIVERS\acsock64.sys [2016-03-25 211808]
S3 AMPPAL;Intel(r) Centrino(r) Wireless Bluetooth(r) + High Speed Virtual Adapter; C:\WINDOWS\System32\drivers\AMPPAL.sys [2013-07-29 165344]
S3 applockerfltr;@%systemroot%\system32\srpapi.dll,-102; C:\WINDOWS\system32\drivers\applockerfltr.sys [2016-07-17 15360]
S3 bcmfn;@bcmfn.inf,%bcmfn.SVCDESC%;bcmfn Service; C:\WINDOWS\System32\drivers\bcmfn.sys [2016-07-17 9728]
S3 BTHPORT;@bth.inf,%BTHPORT.SvcDesc%;Bluetooth Port Driver; C:\WINDOWS\System32\drivers\BTHport.sys [2016-11-11 967168]
S3 buttonconverter;@buttonconverter.inf,%btnconv.SvcDesc%;Service for Portable Device Control devices; C:\WINDOWS\System32\drivers\buttonconverter.sys [2016-07-17 38912]
S3 CapImg;@capimg.inf,%CapImgHid_Service%;HID driver for CapImg touch screen; C:\WINDOWS\System32\drivers\capimg.sys [2016-09-11 118272]
S3 genericusbfn;@genericusbfn.inf,%genericusbfn.ServiceName%;Generic USB Function Class; C:\WINDOWS\System32\drivers\genericusbfn.sys [2016-07-17 20480]
S3 hidinterrupt;@hidinterrupt.inf,%HID_Interrupt.SvcDesc%;Common Driver for HID Buttons implemented with interrupts; C:\WINDOWS\System32\drivers\hidinterrupt.sys [2016-07-17 50016]
S3 hvservice;@%SystemRoot%\system32\drivers\hvservice.sys,-16; C:\WINDOWS\system32\drivers\hvservice.sys [2016-10-24 73568]
S3 cht4iscsi;cht4iscsi; C:\WINDOWS\System32\drivers\cht4sx64.sys [2016-07-17 346976]
S3 cht4vbd;@cht4vx64.inf,%cht4vbd.generic%;Chelsio Virtual Bus Driver; C:\WINDOWS\System32\drivers\cht4vx64.sys [2016-07-17 2104160]
S3 iagpio;@iagpio.inf,%iagpio.SVCDESC%;Intel Serial IO GPIO Controller Driver; C:\WINDOWS\System32\drivers\iagpio.sys [2016-07-17 33280]
S3 iai2c;@iai2c.inf,%iai2c.SVCDESC%;Intel(R) Serial IO I2C Host Controller; C:\WINDOWS\System32\drivers\iai2c.sys [2016-07-17 81408]
S3 iaLPSS2i_GPIO2;@iaLPSS2i_GPIO2_SKL.inf,%iaLPSS2i_GPIO2.SVCDESC%;Intel(R) Serial IO GPIO Driver v2; C:\WINDOWS\System32\drivers\iaLPSS2i_GPIO2.sys [2016-07-17 64512]
S3 iaLPSS2i_I2C;@iaLPSS2i_I2C_SKL.inf,%iaLPSS2i_I2C.SVCDESC%;Intel(R) Serial IO I2C Driver v2; C:\WINDOWS\System32\drivers\iaLPSS2i_I2C.sys [2016-07-17 176384]
S3 ibbus;@mlx4_bus.inf,%Ibbus.ServiceDesc%;Mellanox InfiniBand Bus/AL (Filter Driver); C:\WINDOWS\System32\drivers\ibbus.sys [2016-07-17 526176]
S3 IndirectKmd;@%SystemRoot%\system32\drivers\IndirectKmd.sys,-100; C:\WINDOWS\System32\drivers\IndirectKmd.sys [2016-07-17 35840]
S3 INETMON;INETMON; \??\C:\windows\System32\Drivers\INETMON.sys [2013-08-08 29088]
S3 intaud_WaveExtensible;Intel WiDi Audio Device; C:\WINDOWS\system32\drivers\intelaud.sys [2014-05-07 38296]
S3 IntcDAud;@oem66.inf,%IntcDAud.SvcDesc%;Intel(R) Display Audio; C:\WINDOWS\system32\DRIVERS\IntcDAud.sys [2016-07-15 481768]
S3 irda;IrDA; C:\WINDOWS\system32\drivers\irda.sys [2016-07-17 120320]
S3 mlx4_bus;@mlx4_bus.inf,%MLX4BUS.ServiceDesc%;Mellanox ConnectX Bus Enumerator; C:\WINDOWS\System32\drivers\mlx4_bus.sys [2016-07-17 842584]
S3 ndfltr;@mlx4_bus.inf,%ndfltr.ServiceDesc%;NetworkDirect Service; C:\WINDOWS\System32\drivers\ndfltr.sys [2016-07-17 108896]
S3 NetAdapterCx;Network Adapter Wdf Class Extension Library; C:\WINDOWS\system32\drivers\NetAdapterCx.sys [2016-07-17 90624]
S3 ReFSv1;ReFSv1; C:\WINDOWS\system32\drivers\ReFSv1.sys [2016-07-17 928608]
S3 scmdisk0101;@scmdisk0101.inf,%scmdisk0101.SvcDesc%;Microsoft NVDIMM-N disk driver; C:\WINDOWS\System32\drivers\scmdisk0101.sys [2016-07-17 123904]
S3 tap0901;@oem9.inf,%DeviceDescription%;TAP-Windows Adapter V9; C:\WINDOWS\System32\drivers\tap0901.sys [2013-08-23 40664]
S3 UcmCx0101;USB Connector Manager KMDF Class Extension; C:\WINDOWS\System32\Drivers\UcmCx.sys [2016-07-17 95744]
S3 UcmTcpciCx0101;UCM-TCPCI KMDF Class Extension; C:\WINDOWS\System32\Drivers\UcmTcpciCx.sys [2016-07-17 108544]
S3 UcmUcsi;@UcmUcsi.inf,%UcmUcsi.ServiceName%;USB Connector Manager UCSI Client; C:\WINDOWS\System32\drivers\UcmUcsi.sys [2016-07-17 50688]
S3 UdeCx;USB Device Emulation Support Library; C:\WINDOWS\system32\drivers\udecx.sys [2016-07-17 45568]
S3 Ufx01000;USB Function Class Extension; C:\WINDOWS\system32\drivers\ufx01000.sys [2016-07-17 263008]
S3 UfxChipidea;@ufxchipidea.inf,%UfxChipidea.ServiceName%;USB Chipidea Controller; C:\WINDOWS\System32\drivers\UfxChipidea.sys [2016-07-17 96608]
S3 ufxsynopsys;@ufxsynopsys.inf,%ufxsynopsys.ServiceName%;USB Synopsys Controller; C:\WINDOWS\System32\drivers\ufxsynopsys.sys [2016-07-17 137056]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 CDPSvc;@%SystemRoot%\system32\cdpsvc.dll,-100; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
R2 CDPUserSvc_10b8dc39;CDPUserSvc_10b8dc39; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
R2 CoreMessagingRegistrar;@%SystemRoot%\system32\coremessaging.dll,-1; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
R2 DiagTrack;@%SystemRoot%\system32\diagtrack.dll,-3001; C:\WINDOWS\System32\svchost.exe [2016-07-17 44496]
R2 ETDService;Elan Service; C:\Program Files\Elantech\ETDService.exe [2016-11-11 129752]
R2 iBTAudioSrv;Intel(R) Wireless Bluetooth(R) Audio Service; C:\Program Files (x86)\Intel\HPWA\iBTAudioSrv.exe [2014-07-25 573384]
R2 ibtsiva;@oem2.inf,%SERVICE_NAME%;Intel Bluetooth Service; C:\WINDOWS\system32\ibtsiva []
R2 igfxCUIService2.0.0.0;Intel(R) HD Graphics Control Panel Service; C:\WINDOWS\system32\igfxCUIService.exe [2016-07-20 365728]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2015-06-24 223008]
R2 OneSyncSvc_10b8dc39;Sync Host_10b8dc39; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
R2 SamsungSystemConfiguration;SamsungSystemConfiguration; C:\ProgramData\Samsung\SamsungSystemConfiguration\SamsungSystemConfiguration.exe [2014-03-19 23872]
R2 tiledatamodelsvc;@%SystemRoot%\system32\tileobjserver.dll,-1; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
R3 BthHFSrv;@%SystemRoot%\System32\BthHFSrv.dll,-103; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
R3 ClipSVC;@%SystemRoot%\system32\ClipSVC.dll,-103; C:\WINDOWS\System32\svchost.exe [2016-07-17 44496]
R3 diagnosticshub.standardcollector.service;@%SystemRoot%\system32\DiagSvcs\DiagnosticsHub.StandardCollector.ServiceRes.dll,-1000; C:\WINDOWS\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe [2016-07-17 93184]
R3 DsSvc;@%SystemRoot%\system32\dssvc.dll,-10003; C:\WINDOWS\System32\svchost.exe [2016-07-17 44496]
R3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\WINDOWS\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [2016-05-26 43696]
R3 LicenseManager;@%SystemRoot%\system32\licensemanagersvc.dll,-200; C:\WINDOWS\System32\svchost.exe [2016-07-17 44496]
R3 PimIndexMaintenanceSvc_10b8dc39;Contact Data_10b8dc39; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
R3 RmSvc;@%SystemRoot%\system32\RMapi.dll,-1001; C:\WINDOWS\System32\svchost.exe [2016-07-17 44496]
R3 StateRepository;@%SystemRoot%\system32\windows.staterepository.dll,-1; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
R3 TimeBrokerSvc;@%windir%\system32\TimeBrokerServer.dll,-1001; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
R4 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2016-12-19 82640]
R4 AdobeUpdateService;AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [2016-10-12 744640]
R4 AGSService;Adobe Genuine Software Integrity Service; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2016-12-13 2218712]
R4 GoProDeviceDetectionService;GoPro Device Detection Service; D:\Apps\QuikGoPro\GoPro Desktop App\GoProDeviceDetection.exe [2016-12-02 37808]
R4 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2016-11-21 76152]
R4 postgresql-x64-9.3;postgresql-x64-9.3 - PostgreSQL Server 9.3; D:\Apps\Postgres\bin\pg_ctl.exe [2014-10-20 89088]
R4 Settings Launcher;Settings Launcher; C:\Program Files (x86)\Samsung\Settings\CmdServer\SettingsLauncher.exe [2015-06-24 1594176]
R4 SWUpdateService;SW Update Service; C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe [2016-10-04 3296104]
S2 CDPUserSvc;@%SystemRoot%\system32\cdpusersvc.dll,-100; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S2 DoSvc;@%systemroot%\system32\dosvc.dll,-100; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28 144200]
S2 MapsBroker;@%SystemRoot%\System32\moshost.dll,-100; C:\WINDOWS\System32\svchost.exe [2016-07-17 44496]
S2 Net Driver HPZ12;Net Driver HPZ12; C:\windows\System32\svchost.exe [2016-07-17 44496]
S2 OneSyncSvc;@%SystemRoot%\system32\APHostRes.dll,-10002; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\windows\System32\svchost.exe [2016-07-17 44496]
S2 SkypeUpdate;Skype Updater; D:\Apps\Skype\Updater\Updater.exe [2016-03-23 327808]
S3 AJRouter;@%SystemRoot%\system32\AJRouter.dll,-2; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S3 cphs;Intel(R) Content Protection HECI Service; C:\WINDOWS\SysWow64\IntelCpHeciSvc.exe [2016-07-20 293536]
S3 DcpSvc;@%SystemRoot%\system32\dcpsvc.dll,-3001; C:\WINDOWS\System32\svchost.exe [2016-07-17 44496]
S3 DevQueryBroker;@%SystemRoot%\system32\DevQueryBroker.dll,-100; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S3 DmEnrollmentSvc;@%systemroot%\system32\Windows.Internal.Management.dll,-100; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S3 dmwappushservice;@%SystemRoot%\system32\dmwappushsvc.dll,-200; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S3 embeddedmode;@%SystemRoot%\system32\embeddedmodesvc.dll,-201; C:\WINDOWS\System32\svchost.exe [2016-07-17 44496]
S3 EntAppSvc;@EnterpriseAppMgmtSvc.dll,-1; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S3 FrameServer;@%systemroot%\system32\FrameServer.dll,-100; C:\WINDOWS\System32\svchost.exe [2016-07-17 44496]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28 144200]
S3 HvHost;@%SystemRoot%\system32\hvhostsvc.dll,-100; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S3 icssvc;@%SystemRoot%\System32\tetheringservice.dll,-4097; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [2015-05-22 881152]
S3 irmon;@%SystemRoot%\System32\irmon.dll,-2000; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S3 iumsvc;Intel(R) Update Manager; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2016-08-12 177376]
S3 MessagingService;@%SystemRoot%\system32\MessagingService.dll,-100; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S3 MessagingService_10b8dc39;MessagingService_10b8dc39; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S3 NetSetupSvc;@%SystemRoot%\system32\NetSetupSvc.dll,-3; C:\WINDOWS\System32\svchost.exe [2016-07-17 44496]
S3 NgcCtnrSvc;@%SystemRoot%\System32\NgcCtnrSvc.dll,-1; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S3 NgcSvc;@%SystemRoot%\System32\ngcsvc.dll,-100; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S3 ose64;Office 64 Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2014-01-23 178760]
S3 PhoneSvc;@%SystemRoot%\system32\PhoneserviceRes.dll,-10000; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S3 PimIndexMaintenanceSvc;@%SystemRoot%\system32\UserDataAccessRes.dll,-15001; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S3 RetailDemo;@%SystemRoot%\System32\RDXService.dll,-256; C:\WINDOWS\System32\svchost.exe [2016-07-17 44496]
S3 SensorDataService;@%SystemRoot%\system32\SensorDataService.exe,-101; C:\WINDOWS\System32\SensorDataService.exe [2016-10-24 1312768]
S3 SensorService;@%SystemRoot%\System32\sensorservice.dll,-1000; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S3 SmsRouter;@%SystemRoot%\System32\SmsRouterSvc.dll,-10001; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S3 TieringEngineService;@%SystemRoot%\system32\TieringEngineService.exe,-702; C:\WINDOWS\system32\TieringEngineService.exe [2016-07-17 287744]
S4 shpamsvc;@%SystemRoot%\System32\Windows.SharedPC.AccountManager.dll,-100; C:\WINDOWS\System32\svchost.exe [2016-07-17 44496]
S4 tzautoupdate;@%SystemRoot%\system32\tzautoupdate.dll,-200; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
-----------------EOF-----------------
C:\Users\NG\AppData\Local\Dropbox\Update\DropboxUpdate.exe
C:\WINDOWS\tasks\DropboxUpdateTaskUserS-1-5-21-1341208516-2984071467-593012157-1001UA1d23702490d345b.job -
C:\Users\NG\AppData\Local\Dropbox\Update\DropboxUpdate.exe
=========Mozilla firefox=========
ProfilePath - C:\Users\NG\AppData\Roaming\Mozilla\Firefox\Profiles\w8gci29x.default
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 19.0.0.226 Plugin
"Path"=C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_226.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5]
"Description"=Intel IPT WebApi plugin
"Path"=C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.68]
"Description"=Intel IPT WebApi plugin
"Path"=C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater]
"Description"=This plugin updates Intel WebAPI component
"Path"=C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=11.51.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files (x86)\Java\jre1.8.0_51\bin\dtplugin\npDeployJava1.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=11.51.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre1.8.0_51\bin\plugin2\npjp2.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/Lync,version=15.0]
"Description"=Microsoft Lync Plug-in for Firefox
"Path"=C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~2\MICROS~3\Office15\NPSPWRAP.DLL
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3528.0331]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\adobe.com/AdobeAAMDetect]
"Description"=
"Path"=C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 19.0.0.226 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF64_19_0_0_226.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=11.51.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files\Java\jre1.8.0_51\bin\dtplugin\npDeployJava1.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=11.51.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre1.8.0_51\bin\plugin2\npjp2.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=D:\Apps\MSOffice2013\Office15\NPSPWRAP.DLL
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\adobe.com/AdobeAAMDetect]
"Description"=
"Path"=C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Skype for Business Browser Helper - D:\Apps\MSOffice2013\Office15\OCHelper.dll [2016-12-13 229064]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre1.8.0_51\bin\ssv.dll [2015-08-15 551520]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre1.8.0_51\bin\jp2ssv.dll [2015-08-15 212576]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_51\bin\ssv.dll [2015-08-15 460384]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{92EF2EAD-A7CE-4424-B0DB-499CF856608E}]
Evernote extension - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2015-12-01 629456]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft SkyDrive Pro Browser Helper - C:\PROGRA~2\MICROS~3\Office15\GROOVEEX.DLL [2016-11-15 1743664]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_51\bin\jp2ssv.dll [2015-08-15 172640]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2015-09-23 14040296]
"ETDCtrl"=C:\Program Files\Elantech\ETDCtrl.exe [2016-11-11 3242200]
"AdobeAAMUpdater-1.0"=C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2016-07-01 508128]
"Launch LCore"=C:\Program Files\Logitech Gaming Software\LCore.exe [2015-10-15 15009400]
"WindowsDefender"=C:\Program Files\Windows Defender\MSASCuiL.exe [2016-10-24 631808]
"GoPro Tray App"=D:\Apps\QuikGoPro\GoPro Desktop App\GoProDesktopSystemTray.exe [2016-12-02 866224]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Dropbox Update"=C:\Users\NG\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2016-11-05 143144]
"OneDrive"=C:\Users\NG\AppData\Local\Microsoft\OneDrive\OneDrive.exe [2017-01-19 1517280]
"f.lux"=C:\Users\NG\AppData\Local\FluxSoftware\Flux\flux.exe [2013-10-24 1017224]
[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"MMReminderService"=d:\Apps\MindjetManager\MMReminderService.exe [2013-09-07 42312]
"AdobeCEPServiceManager"=C:\Program Files (x86)\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe [2013-05-16 1039240]
"VirtualCloneDrive"=C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [2013-03-11 88984]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2015-06-08 334896]
"Adobe Creative Cloud"=C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2016-10-12 2383040]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
iBTAudioMon.lnk - C:\Program Files (x86)\Intel\HPWA\iBTAudioMon.exe
C:\Users\NG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
EvernoteClipper.lnk - C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
no_zooｍ_ｃhroｍe.exe.lnk - C:\ProgramData\no_zooｍ_ｃhroｍe.exe.lnk.bat
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\Program Files"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
igfxdev.dll []
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ahcache.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CoreMessagingRegistrar]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\iai2c.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SpbCx.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\StateRepository]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TileDataModelSvc]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\uefi.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\UserManager]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{F2E7DD72-6468-4E36-B6F1-6488F42C1B52}]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Ahcache.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\CoreMessagingRegistrar]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SpbCx.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\StateRepository]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TileDataModelSvc]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\uefi.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UserManager]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{F2E7DD72-6468-4E36-B6F1-6488F42C1B52}]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DSCAutomationHostEnabled"=2
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"vidc.i420"=iyuv_32.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"msacm.ac3filter"=ac3filter.acm
"VIDC.CFHD"=CFHD.dll
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
======List of files/folders created in the last 3 months======
2017-01-26 10:12:08 ----D---- C:\rsit
2017-01-25 18:00:20 ----A---- C:\WINDOWS\SYSWOW64\poqexec.exe
2017-01-25 18:00:20 ----A---- C:\WINDOWS\system32\poqexec.exe
2017-01-13 21:21:03 ----D---- C:\WINDOWS\Panther
2017-01-13 21:20:42 ----ASH---- C:\pagefile.sys
2017-01-12 20:27:12 ----A---- C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll
2017-01-12 20:27:11 ----A---- C:\WINDOWS\system32\Windows.UI.Xaml.dll
2017-01-12 20:27:07 ----A---- C:\WINDOWS\system32\Windows.Media.dll
2017-01-12 20:27:06 ----A---- C:\WINDOWS\system32\mfcore.dll
2017-01-12 20:27:05 ----A---- C:\WINDOWS\SYSWOW64\Windows.UI.Logon.dll
2017-01-12 20:27:05 ----A---- C:\WINDOWS\system32\mfmp4srcsnk.dll
2017-01-12 20:27:04 ----A---- C:\WINDOWS\SYSWOW64\StoreAgent.dll
2017-01-12 20:27:04 ----A---- C:\WINDOWS\SYSWOW64\InstallAgentUserBroker.exe
2017-01-12 20:27:04 ----A---- C:\WINDOWS\SYSWOW64\InstallAgent.exe
2017-01-12 20:27:04 ----A---- C:\WINDOWS\system32\d2d1.dll
2017-01-12 20:27:03 ----A---- C:\WINDOWS\SYSWOW64\Windows.Storage.ApplicationData.dll
2017-01-12 20:27:03 ----A---- C:\WINDOWS\system32\mfnetsrc.dll
2017-01-12 20:27:03 ----A---- C:\WINDOWS\system32\mfmpeg2srcsnk.dll
2017-01-12 20:27:02 ----A---- C:\WINDOWS\system32\rdpcore.dll
2017-01-12 20:27:02 ----A---- C:\WINDOWS\system32\mfasfsrcsnk.dll
2017-01-12 20:27:02 ----A---- C:\WINDOWS\system32\D3DCompiler_47.dll
2017-01-12 20:27:02 ----A---- C:\WINDOWS\system32\aeinv.dll
2017-01-12 20:27:01 ----A---- C:\WINDOWS\system32\mstscax.dll
2017-01-12 20:27:01 ----A---- C:\WINDOWS\system32\mfnetcore.dll
2017-01-12 20:27:00 ----A---- C:\WINDOWS\system32\rdpencom.dll
2017-01-12 20:27:00 ----A---- C:\WINDOWS\system32\MCRecvSrc.dll
2017-01-12 20:26:59 ----A---- C:\WINDOWS\SYSWOW64\Windows.UI.CredDialogController.dll
2017-01-12 20:26:59 ----A---- C:\WINDOWS\SYSWOW64\Windows.UI.Cred.dll
2017-01-12 20:26:59 ----A---- C:\WINDOWS\SYSWOW64\Windows.UI.BlockedShutdown.dll
2017-01-12 20:26:59 ----A---- C:\WINDOWS\SYSWOW64\Windows.UI.BioFeedback.dll
2017-01-12 20:26:59 ----A---- C:\WINDOWS\system32\wuuhext.dll
2017-01-12 20:26:59 ----A---- C:\WINDOWS\system32\winlogon.exe
2017-01-12 20:26:59 ----A---- C:\WINDOWS\system32\D3D12.dll
2017-01-12 20:26:58 ----A---- C:\WINDOWS\SYSWOW64\offlinesam.dll
2017-01-12 20:26:58 ----A---- C:\WINDOWS\system32\wuaueng.dll
2017-01-12 20:26:58 ----A---- C:\WINDOWS\system32\sppobjs.dll
2017-01-12 20:26:58 ----A---- C:\WINDOWS\system32\samsrv.dll
2017-01-12 20:26:57 ----A---- C:\WINDOWS\SYSWOW64\msmpeg2vdec.dll
2017-01-12 20:26:57 ----A---- C:\WINDOWS\system32\offlinesam.dll
2017-01-12 20:26:57 ----A---- C:\WINDOWS\system32\lsasrv.dll
2017-01-12 20:26:56 ----A---- C:\WINDOWS\SYSWOW64\aclui.dll
2017-01-12 20:26:55 ----A---- C:\WINDOWS\system32\shell32.dll
2017-01-12 20:26:53 ----A---- C:\WINDOWS\SYSWOW64\shell32.dll
2017-01-12 20:26:51 ----A---- C:\WINDOWS\system32\drivers\cng.sys
2017-01-12 20:26:50 ----A---- C:\WINDOWS\SYSWOW64\updatepolicy.dll
2017-01-12 20:26:50 ----A---- C:\WINDOWS\SYSWOW64\MSVP9DEC.dll
2017-01-12 20:26:50 ----A---- C:\WINDOWS\SYSWOW64\kerberos.dll
2017-01-12 20:26:50 ----A---- C:\WINDOWS\system32\wuapi.dll
2017-01-12 20:26:50 ----A---- C:\WINDOWS\system32\updatepolicy.dll
2017-01-12 20:26:50 ----A---- C:\WINDOWS\system32\msv1_0.dll
2017-01-12 20:26:50 ----A---- C:\WINDOWS\system32\kerberos.dll
2017-01-12 20:26:50 ----A---- C:\WINDOWS\system32\ImplatSetup.dll
2017-01-12 20:26:49 ----A---- C:\WINDOWS\SYSWOW64\WinSCard.dll
2017-01-12 20:26:49 ----A---- C:\WINDOWS\SYSWOW64\cryptui.dll
2017-01-12 20:26:49 ----A---- C:\WINDOWS\system32\wow64.dll
2017-01-12 20:26:49 ----A---- C:\WINDOWS\system32\WinSCard.dll
2017-01-12 20:26:49 ----A---- C:\WINDOWS\system32\ScDeviceEnum.dll
2017-01-12 20:26:49 ----A---- C:\WINDOWS\system32\cryptui.dll
2017-01-12 20:26:49 ----A---- C:\WINDOWS\system32\certprop.dll
2017-01-12 20:26:48 ----A---- C:\WINDOWS\SYSWOW64\indexeddbserver.dll
2017-01-12 20:26:48 ----A---- C:\WINDOWS\SYSWOW64\AUDIOKSE.dll
2017-01-12 20:26:47 ----A---- C:\WINDOWS\SYSWOW64\Windows.UI.Xaml.Resources.dll
2017-01-12 20:26:47 ----A---- C:\WINDOWS\SYSWOW64\AudioSes.dll
2017-01-12 20:26:46 ----A---- C:\WINDOWS\SYSWOW64\mshtml.dll
2017-01-12 20:26:46 ----A---- C:\WINDOWS\SYSWOW64\Chakradiag.dll
2017-01-12 20:26:41 ----A---- C:\WINDOWS\SYSWOW64\Windows.UI.Xaml.dll
2017-01-12 20:26:39 ----A---- C:\WINDOWS\SYSWOW64\Chakra.dll
2017-01-12 20:26:39 ----A---- C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll
2017-01-12 20:26:38 ----A---- C:\WINDOWS\SYSWOW64\AzureSettingSyncProvider.dll
2017-01-12 20:26:37 ----A---- C:\WINDOWS\SYSWOW64\edgehtml.dll
2017-01-12 20:26:35 ----A---- C:\WINDOWS\system32\AzureSettingSyncProvider.dll
2017-01-12 20:26:34 ----A---- C:\WINDOWS\SYSWOW64\mspaint.exe
2017-01-12 20:26:34 ----A---- C:\WINDOWS\system32\Chakra.dll
2017-01-12 20:26:33 ----A---- C:\WINDOWS\system32\win32kbase.sys
2017-01-12 20:26:32 ----A---- C:\WINDOWS\SYSWOW64\twinui.dll
2017-01-12 20:26:31 ----A---- C:\WINDOWS\system32\SettingsHandlers_nt.dll
2017-01-12 20:26:30 ----A---- C:\WINDOWS\system32\mspaint.exe
2017-01-12 20:26:29 ----A---- C:\WINDOWS\SYSWOW64\winmde.dll
2017-01-12 20:26:29 ----A---- C:\WINDOWS\system32\msmpeg2vdec.dll
2017-01-12 20:26:28 ----A---- C:\WINDOWS\system32\mshtml.dll
2017-01-12 20:26:28 ----A---- C:\WINDOWS\system32\indexeddbserver.dll
2017-01-12 20:26:26 ----A---- C:\WINDOWS\system32\twinui.dll
2017-01-12 20:26:25 ----A---- C:\WINDOWS\system32\winmde.dll
2017-01-12 20:26:24 ----A---- C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll
2017-01-12 20:26:24 ----A---- C:\WINDOWS\system32\aadcloudap.dll
2017-01-12 20:26:23 ----A---- C:\WINDOWS\system32\edgehtml.dll
2017-01-12 20:26:18 ----A---- C:\WINDOWS\system32\aadtb.dll
2017-01-12 20:26:15 ----A---- C:\WINDOWS\SYSWOW64\Windows.ApplicationModel.LockScreen.dll
2017-01-12 20:26:14 ----A---- C:\WINDOWS\system32\usocore.dll
2017-01-12 20:26:14 ----A---- C:\WINDOWS\system32\rdpcorets.dll
2017-01-12 20:26:13 ----A---- C:\WINDOWS\SYSWOW64\rdpcore.dll
2017-01-12 20:26:13 ----A---- C:\WINDOWS\system32\Windows.Internal.UI.Logon.ProxyStub.dll
2017-01-12 20:26:13 ----A---- C:\WINDOWS\system32\updatehandlers.dll
2017-01-12 20:26:13 ----A---- C:\WINDOWS\system32\LaunchWinApp.exe
2017-01-12 20:26:12 ----A---- C:\WINDOWS\SYSWOW64\remoteaudioendpoint.dll
2017-01-12 20:26:12 ----A---- C:\WINDOWS\SYSWOW64\LaunchWinApp.exe
2017-01-12 20:26:12 ----A---- C:\WINDOWS\system32\rdpudd.dll
2017-01-12 20:26:12 ----A---- C:\WINDOWS\system32\MSVP9DEC.dll
2017-01-12 20:26:12 ----A---- C:\WINDOWS\system32\DeveloperOptionsSettingsHandlers.dll
2017-01-12 20:26:11 ----A---- C:\WINDOWS\SYSWOW64\SyncSettings.dll
2017-01-12 20:26:11 ----A---- C:\WINDOWS\SYSWOW64\rdpencom.dll
2017-01-12 20:26:11 ----A---- C:\WINDOWS\SYSWOW64\mstscax.dll
2017-01-12 20:26:10 ----A---- C:\WINDOWS\SYSWOW64\MSVPXENC.dll
2017-01-12 20:26:10 ----A---- C:\WINDOWS\SYSWOW64\CloudBackupSettings.dll
2017-01-12 20:26:10 ----A---- C:\WINDOWS\system32\Windows.UI.Shell.dll
2017-01-12 20:26:10 ----A---- C:\WINDOWS\system32\win32kfull.sys
2017-01-12 20:26:10 ----A---- C:\WINDOWS\system32\win32k.sys
2017-01-12 20:26:10 ----A---- C:\WINDOWS\system32\OneBackupHandler.dll
2017-01-12 20:26:09 ----A---- C:\WINDOWS\SYSWOW64\Windows.Media.dll
2017-01-12 20:26:09 ----A---- C:\WINDOWS\SYSWOW64\LogonController.dll
2017-01-12 20:26:08 ----A---- C:\WINDOWS\SYSWOW64\mfcore.dll
2017-01-12 20:26:08 ----A---- C:\WINDOWS\system32\SRHInproc.dll
2017-01-12 20:26:08 ----A---- C:\WINDOWS\system32\SRH.dll
2017-01-12 20:26:07 ----A---- C:\WINDOWS\SYSWOW64\mfmp4srcsnk.dll
2017-01-12 20:26:07 ----A---- C:\WINDOWS\system32\Windows.UI.Logon.dll
2017-01-12 20:26:07 ----A---- C:\WINDOWS\system32\aclui.dll
2017-01-12 20:26:06 ----A---- C:\WINDOWS\system32\dosvc.dll
2017-01-12 20:26:06 ----A---- C:\WINDOWS\system32\domgmt.dll
2017-01-12 20:26:06 ----A---- C:\WINDOWS\system32\AudioSes.dll
2017-01-12 20:26:06 ----A---- C:\WINDOWS\system32\AUDIOKSE.dll
2017-01-12 20:26:06 ----A---- C:\WINDOWS\system32\AudioEng.dll
2017-01-12 20:26:06 ----A---- C:\WINDOWS\system32\AudioEndpointBuilder.dll
2017-01-12 20:26:05 ----A---- C:\WINDOWS\system32\StoreAgent.dll
2017-01-12 20:26:05 ----A---- C:\WINDOWS\system32\SettingSyncHost.exe
2017-01-12 20:26:05 ----A---- C:\WINDOWS\system32\SettingSyncCore.dll
2017-01-12 20:26:05 ----A---- C:\WINDOWS\system32\InstallAgentUserBroker.exe
2017-01-12 20:26:05 ----A---- C:\WINDOWS\system32\InstallAgent.exe
2017-01-12 20:26:05 ----A---- C:\WINDOWS\system32\ClipUp.exe
2017-01-12 20:26:05 ----A---- C:\WINDOWS\system32\audiosrv.dll
2017-01-12 20:26:04 ----A---- C:\WINDOWS\SYSWOW64\mfnetsrc.dll
2017-01-12 20:26:04 ----A---- C:\WINDOWS\system32\ie4uinit.exe
2017-01-12 20:26:03 ----A---- C:\WINDOWS\SYSWOW64\mfasfsrcsnk.dll
2017-01-12 20:26:03 ----A---- C:\WINDOWS\system32\Windows.UI.CredDialogController.dll
2017-01-12 20:26:03 ----A---- C:\WINDOWS\system32\wbiosrvc.dll
2017-01-12 20:26:03 ----A---- C:\WINDOWS\system32\drivers\vhdmp.sys
2017-01-12 20:26:02 ----A---- C:\WINDOWS\SYSWOW64\wuapi.dll
2017-01-12 20:26:02 ----A---- C:\WINDOWS\SYSWOW64\mfnetcore.dll
2017-01-12 20:26:02 ----A---- C:\WINDOWS\system32\remoteaudioendpoint.dll
2017-01-12 20:26:02 ----A---- C:\WINDOWS\system32\cloudAP.dll
2017-01-12 20:26:01 ----A---- C:\WINDOWS\SYSWOW64\mfmpeg2srcsnk.dll
2017-01-12 20:26:01 ----A---- C:\WINDOWS\SYSWOW64\MCRecvSrc.dll
2017-01-12 20:26:01 ----A---- C:\WINDOWS\system32\winsrv.dll
2017-01-12 20:26:01 ----A---- C:\WINDOWS\system32\Windows.UI.BlockedShutdown.dll
2017-01-12 20:26:01 ----A---- C:\WINDOWS\system32\Windows.UI.BioFeedback.dll
2017-01-12 20:26:01 ----A---- C:\WINDOWS\system32\SyncSettings.dll
2017-01-12 20:26:01 ----A---- C:\WINDOWS\system32\fhsettingsprovider.dll
2017-01-12 20:26:01 ----A---- C:\WINDOWS\system32\fhcfg.dll
2017-01-12 20:26:01 ----A---- C:\WINDOWS\system32\CloudBackupSettings.dll
2017-01-12 20:26:00 ----A---- C:\WINDOWS\system32\securekernel.exe
2017-01-12 20:26:00 ----A---- C:\WINDOWS\system32\ntoskrnl.exe
2017-01-12 20:26:00 ----A---- C:\WINDOWS\system32\drivers\pci.sys
2017-01-12 20:25:46 ----A---- C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2017-01-12 20:25:45 ----A---- C:\WINDOWS\system32\AppXDeploymentServer.dll
2017-01-12 20:25:43 ----A---- C:\WINDOWS\SYSWOW64\win32kfull.sys
2017-01-12 20:25:42 ----A---- C:\WINDOWS\SYSWOW64\SettingSyncHost.exe
2017-01-12 20:25:42 ----A---- C:\WINDOWS\SYSWOW64\SettingSyncCore.dll
2017-01-12 20:25:42 ----A---- C:\WINDOWS\SYSWOW64\aadtb.dll
2017-01-12 20:25:41 ----A---- C:\WINDOWS\SYSWOW64\d2d1.dll
2017-01-12 20:25:41 ----A---- C:\WINDOWS\system32\LogonController.dll
2017-01-12 20:25:39 ----A---- C:\WINDOWS\system32\ConsoleLogon.dll
2017-01-12 20:25:39 ----A---- C:\WINDOWS\system32\CloudExperienceHost.dll
2017-01-12 20:25:38 ----A---- C:\WINDOWS\SYSWOW64\win32k.sys
2017-01-12 20:25:38 ----A---- C:\WINDOWS\SYSWOW64\D3DCompiler_47.dll
2017-01-12 20:25:38 ----A---- C:\WINDOWS\system32\MSVPXENC.dll
2017-01-12 20:25:37 ----A---- C:\WINDOWS\SYSWOW64\Windows.Internal.UI.Logon.ProxyStub.dll
2017-01-12 20:25:37 ----A---- C:\WINDOWS\SYSWOW64\msv1_0.dll
2017-01-12 20:25:37 ----A---- C:\WINDOWS\system32\provengine.dll
2017-01-12 20:25:36 ----A---- C:\WINDOWS\system32\ProvPluginEng.dll
2017-01-12 20:25:36 ----A---- C:\WINDOWS\system32\KnobsCsp.dll
2017-01-12 20:25:36 ----A---- C:\WINDOWS\system32\KnobsCore.dll
2017-01-12 20:25:35 ----A---- C:\WINDOWS\SYSWOW64\D3D12.dll
2016-12-23 00:34:33 ----D---- C:\Users\NG\AppData\Roaming\DarkSoulsII
2016-12-23 00:34:32 ----D---- C:\ProgramData\Steam
2016-12-20 17:51:54 ----D---- C:\Users\NG\AppData\Roaming\GoPro
2016-12-20 17:50:54 ----D---- C:\Program Files (x86)\OpenAL
2016-12-20 17:50:54 ----A---- C:\WINDOWS\SYSWOW64\wrap_oal.dll
2016-12-20 17:50:54 ----A---- C:\WINDOWS\SYSWOW64\OpenAL32.dll
2016-12-20 17:50:54 ----A---- C:\WINDOWS\system32\wrap_oal.dll
2016-12-20 17:50:54 ----A---- C:\WINDOWS\system32\OpenAL32.dll
2016-12-15 00:13:14 ----A---- C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2016-12-15 00:13:13 ----A---- C:\WINDOWS\SYSWOW64\MFMediaEngine.dll
2016-12-15 00:13:13 ----A---- C:\WINDOWS\SYSWOW64\AppXDeploymentClient.dll
2016-12-15 00:13:13 ----A---- C:\WINDOWS\system32\ole32.dll
2016-12-15 00:13:13 ----A---- C:\WINDOWS\system32\msdtctm.dll
2016-12-15 00:13:12 ----A---- C:\WINDOWS\SYSWOW64\InputService.dll
2016-12-15 00:13:12 ----A---- C:\WINDOWS\SYSWOW64\d3d10warp.dll
2016-12-15 00:13:12 ----A---- C:\WINDOWS\system32\msi.dll
2016-12-15 00:13:12 ----A---- C:\WINDOWS\system32\hvix64.exe
2016-12-15 00:13:12 ----A---- C:\WINDOWS\system32\hvax64.exe
2016-12-15 00:13:12 ----A---- C:\WINDOWS\system32\AppXDeploymentClient.dll
2016-12-15 00:13:11 ----A---- C:\WINDOWS\SYSWOW64\TextInputFramework.dll
2016-12-15 00:13:11 ----A---- C:\WINDOWS\system32\hvloader.exe
2016-12-15 00:13:10 ----A---- C:\WINDOWS\SYSWOW64\WordBreakers.dll
2016-12-15 00:13:10 ----A---- C:\WINDOWS\SYSWOW64\Windows.UI.Core.TextInput.dll
2016-12-15 00:13:10 ----A---- C:\WINDOWS\SYSWOW64\InputLocaleManager.dll
2016-12-15 00:13:10 ----A---- C:\WINDOWS\SYSWOW64\EditBufferTestHook.dll
2016-12-15 00:13:10 ----A---- C:\WINDOWS\system32\MFMediaEngine.dll
2016-12-15 00:13:10 ----A---- C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2016-12-15 00:13:09 ----A---- C:\WINDOWS\system32\Windows.Security.Authentication.OnlineId.dll
2016-12-15 00:13:09 ----A---- C:\WINDOWS\system32\LicenseManager.dll
2016-12-15 00:13:09 ----A---- C:\WINDOWS\system32\facecredentialprovider.dll
2016-12-15 00:13:09 ----A---- C:\WINDOWS\system32\CoreUIComponents.dll
2016-12-15 00:13:06 ----A---- C:\WINDOWS\SYSWOW64\WindowsCodecs.dll
2016-12-15 00:13:06 ----A---- C:\WINDOWS\SYSWOW64\user32.dll
2016-12-15 00:13:06 ----A---- C:\WINDOWS\system32\InputService.dll
2016-12-15 00:13:05 ----A---- C:\WINDOWS\SYSWOW64\sspicli.dll
2016-12-15 00:13:05 ----A---- C:\WINDOWS\system32\WordBreakers.dll
2016-12-15 00:13:05 ----A---- C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll
2016-12-15 00:13:05 ----A---- C:\WINDOWS\system32\TextInputFramework.dll
2016-12-15 00:13:05 ----A---- C:\WINDOWS\system32\ShareHost.dll
2016-12-15 00:13:05 ----A---- C:\WINDOWS\system32\InputLocaleManager.dll
2016-12-15 00:13:05 ----A---- C:\WINDOWS\system32\EditBufferTestHook.dll
2016-12-15 00:13:04 ----A---- C:\WINDOWS\system32\user32.dll
2016-12-15 00:13:04 ----A---- C:\WINDOWS\system32\ieframe.dll
2016-12-15 00:13:03 ----A---- C:\WINDOWS\SYSWOW64\ieframe.dll
2016-12-15 00:13:03 ----A---- C:\WINDOWS\system32\cdp.dll
2016-12-15 00:13:01 ----A---- C:\WINDOWS\SYSWOW64\msi.dll
2016-12-15 00:13:01 ----A---- C:\WINDOWS\SYSWOW64\gdi32full.dll
2016-12-15 00:13:01 ----A---- C:\WINDOWS\system32\gdi32full.dll
2016-12-15 00:13:01 ----A---- C:\WINDOWS\system32\CoreMessaging.dll
2016-12-15 00:13:00 ----A---- C:\WINDOWS\system32\winresume.exe
2016-12-15 00:12:59 ----A---- C:\WINDOWS\SYSWOW64\Windows.Media.Protection.PlayReady.dll
2016-12-15 00:12:59 ----A---- C:\WINDOWS\system32\winload.exe
2016-12-15 00:12:58 ----A---- C:\WINDOWS\SYSWOW64\WinTypes.dll
2016-12-15 00:12:58 ----A---- C:\WINDOWS\system32\WinTypes.dll
2016-12-15 00:12:57 ----A---- C:\WINDOWS\SYSWOW64\wincorlib.dll
2016-12-15 00:12:57 ----A---- C:\WINDOWS\SYSWOW64\LicenseManager.dll
2016-12-15 00:12:57 ----A---- C:\WINDOWS\SYSWOW64\CoreMessaging.dll
2016-12-15 00:12:57 ----A---- C:\WINDOWS\SYSWOW64\combase.dll
2016-12-15 00:12:57 ----A---- C:\WINDOWS\SYSWOW64\cdp.dll
2016-12-15 00:12:57 ----A---- C:\WINDOWS\system32\enterprisecsps.dll
2016-12-15 00:12:57 ----A---- C:\WINDOWS\system32\DeviceEnroller.exe
2016-12-15 00:12:57 ----A---- C:\WINDOWS\system32\combase.dll
2016-12-15 00:12:57 ----A---- C:\WINDOWS\system32\appraiser.dll
2016-12-15 00:12:57 ----A---- C:\WINDOWS\system32\acmigration.dll
2016-12-15 00:12:56 ----A---- C:\WINDOWS\SYSWOW64\Windows.Security.Authentication.OnlineId.dll
2016-12-15 00:12:56 ----A---- C:\WINDOWS\SYSWOW64\ShareHost.dll
2016-12-15 00:12:56 ----A---- C:\WINDOWS\SYSWOW64\mdmregistration.dll
2016-12-15 00:12:56 ----A---- C:\WINDOWS\SYSWOW64\bcrypt.dll
2016-12-15 00:12:56 ----A---- C:\WINDOWS\system32\wincorlib.dll
2016-12-15 00:12:56 ----A---- C:\WINDOWS\system32\mdmregistration.dll
2016-12-15 00:12:56 ----A---- C:\WINDOWS\system32\drivers\clfs.sys
2016-12-15 00:12:56 ----A---- C:\WINDOWS\system32\bcrypt.dll
2016-12-15 00:12:55 ----A---- C:\WINDOWS\SYSWOW64\jscript9diag.dll
2016-12-15 00:12:55 ----A---- C:\WINDOWS\SYSWOW64\jscript9.dll
2016-12-15 00:12:55 ----A---- C:\WINDOWS\system32\jscript9.dll
2016-12-15 00:12:55 ----A---- C:\WINDOWS\system32\fveapibase.dll
2016-12-15 00:12:54 ----A---- C:\WINDOWS\system32\fveapi.dll
2016-12-15 00:12:54 ----A---- C:\WINDOWS\system32\drivers\dxgmms1.sys
2016-12-15 00:12:53 ----A---- C:\WINDOWS\system32\WindowsCodecs.dll
2016-12-15 00:12:53 ----A---- C:\WINDOWS\system32\drivers\dxgmms2.sys
2016-12-15 00:12:53 ----A---- C:\WINDOWS\system32\drivers\dxgkrnl.sys
2016-12-15 00:12:53 ----A---- C:\WINDOWS\system32\cdd.dll
2016-12-15 00:12:51 ----A---- C:\WINDOWS\SYSWOW64\CoreUIComponents.dll
2016-12-15 00:12:50 ----A---- C:\WINDOWS\SYSWOW64\ole32.dll
2016-12-15 00:12:47 ----A---- C:\WINDOWS\system32\sspicli.dll
2016-12-15 00:12:47 ----A---- C:\WINDOWS\system32\d3d10warp.dll
2016-12-15 00:12:47 ----A---- C:\WINDOWS\system32\CryptoWinRT.dll
2016-12-11 14:26:57 ----AD---- C:\Program Files\Adobe
2016-12-10 03:52:07 ----A---- C:\WINDOWS\SYSWOW64\netshell.dll
2016-12-10 03:52:07 ----A---- C:\WINDOWS\system32\wpnprv.dll
2016-12-10 03:52:07 ----A---- C:\WINDOWS\system32\Windows.Internal.Management.dll
2016-12-10 03:52:07 ----A---- C:\WINDOWS\system32\RDXService.dll
2016-12-10 03:52:07 ----A---- C:\WINDOWS\system32\rascustom.dll
2016-12-10 03:52:07 ----A---- C:\WINDOWS\system32\PlayToManager.dll
2016-12-10 03:52:07 ----A---- C:\WINDOWS\system32\drivers\bthport.sys
2016-12-10 03:52:07 ----A---- C:\WINDOWS\system32\ContentDeliveryManager.Utilities.dll
2016-12-10 03:52:07 ----A---- C:\WINDOWS\system32\browserbroker.dll
2016-12-10 03:52:06 ----A---- C:\WINDOWS\system32\ntshrui.dll
2016-12-10 03:52:06 ----A---- C:\WINDOWS\system32\ntdll.dll
2016-12-10 03:52:06 ----A---- C:\WINDOWS\system32\netshell.dll
2016-12-10 03:52:05 ----A---- C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll
2016-12-10 03:52:04 ----A---- C:\WINDOWS\SYSWOW64\mfsvr.dll
2016-12-10 03:52:03 ----A---- C:\WINDOWS\SYSWOW64\WSManHTTPConfig.exe
2016-12-10 03:52:03 ----A---- C:\WINDOWS\SYSWOW64\Windows.StateRepositoryClient.dll
2016-12-10 03:52:03 ----A---- C:\WINDOWS\SYSWOW64\Windows.StateRepository.dll
2016-12-10 03:52:03 ----A---- C:\WINDOWS\SYSWOW64\NMAA.dll
2016-12-10 03:52:03 ----A---- C:\WINDOWS\SYSWOW64\mfplat.dll
2016-12-10 03:52:03 ----A---- C:\WINDOWS\SYSWOW64\MapControlCore.dll
2016-12-10 03:52:03 ----A---- C:\WINDOWS\SYSWOW64\d3d11.dll
2016-12-10 03:52:03 ----A---- C:\WINDOWS\SYSWOW64\apprepsync.dll
2016-12-10 03:52:03 ----A---- C:\WINDOWS\SYSWOW64\apprepapi.dll
2016-12-10 03:52:03 ----A---- C:\WINDOWS\system32\apprepsync.dll
2016-12-10 03:52:03 ----A---- C:\WINDOWS\system32\apprepapi.dll
2016-12-10 03:52:02 ----A---- C:\WINDOWS\SYSWOW64\WsmSvc.dll
2016-12-10 03:52:02 ----A---- C:\WINDOWS\SYSWOW64\UIAutomationCore.dll
2016-12-10 03:52:02 ----A---- C:\WINDOWS\SYSWOW64\mos.dll
2016-12-10 03:52:02 ----A---- C:\WINDOWS\SYSWOW64\dwmcore.dll
2016-12-10 03:52:01 ----A---- C:\WINDOWS\SYSWOW64\zipfldr.dll
2016-12-10 03:52:01 ----A---- C:\WINDOWS\SYSWOW64\JpMapControl.dll
2016-12-10 03:52:01 ----A---- C:\WINDOWS\SYSWOW64\ExplorerFrame.dll
2016-12-10 03:52:01 ----A---- C:\WINDOWS\SYSWOW64\DisplayManager.dll
2016-12-10 03:52:01 ----A---- C:\WINDOWS\SYSWOW64\comdlg32.dll
2016-12-10 03:52:01 ----A---- C:\WINDOWS\SYSWOW64\BingMaps.dll
2016-12-10 03:52:00 ----A---- C:\WINDOWS\SYSWOW64\MapGeocoder.dll
2016-12-10 03:52:00 ----A---- C:\WINDOWS\system32\drivers\partmgr.sys
2016-12-10 03:51:59 ----A---- C:\WINDOWS\SYSWOW64\MosStorage.dll
2016-12-10 03:51:59 ----A---- C:\WINDOWS\SYSWOW64\mfmkvsrcsnk.dll
2016-12-10 03:51:59 ----A---- C:\WINDOWS\SYSWOW64\mfaudiocnv.dll
2016-12-10 03:51:59 ----A---- C:\WINDOWS\SYSWOW64\MapsBtSvc.dll
2016-12-10 03:51:59 ----A---- C:\WINDOWS\SYSWOW64\MapRouter.dll
2016-12-10 03:51:59 ----A---- C:\WINDOWS\SYSWOW64\MapConfiguration.dll
2016-12-10 03:51:59 ----A---- C:\WINDOWS\SYSWOW64\dxgi.dll
2016-12-10 03:51:59 ----A---- C:\WINDOWS\SYSWOW64\DeviceFlows.DataModel.dll
2016-12-10 03:51:59 ----A---- C:\WINDOWS\SYSWOW64\CloudStorageWizard.exe
2016-12-10 03:51:59 ----A---- C:\WINDOWS\system32\RTWorkQ.dll
2016-12-10 03:51:59 ----A---- C:\WINDOWS\system32\policymanager.dll
2016-12-10 03:51:59 ----A---- C:\WINDOWS\system32\MrmCoreR.dll
2016-12-10 03:51:59 ----A---- C:\WINDOWS\system32\MFPlay.dll
2016-12-10 03:51:59 ----A---- C:\WINDOWS\system32\HttpsDataSource.dll
2016-12-10 03:51:59 ----A---- C:\WINDOWS\system32\drivers\fastfat.sys
2016-12-10 03:51:59 ----A---- C:\WINDOWS\system32\dmenrollengine.dll
2016-12-10 03:51:59 ----A---- C:\WINDOWS\system32\dmcertinst.exe
2016-12-10 03:51:58 ----A---- C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2016-12-10 03:51:58 ----A---- C:\WINDOWS\system32\SearchFolder.dll
2016-12-10 03:51:57 ----A---- C:\WINDOWS\system32\wlidsvc.dll
2016-12-10 03:51:57 ----A---- C:\WINDOWS\system32\Windows.Networking.BackgroundTransfer.BackgroundManagerPolicy.dll
2016-12-10 03:51:57 ----A---- C:\WINDOWS\system32\SettingsHandlers_StorageSense.dll
2016-12-10 03:51:57 ----A---- C:\WINDOWS\system32\ReportingCSP.dll
2016-12-10 03:51:57 ----A---- C:\WINDOWS\system32\msdtcuiu.dll
2016-12-10 03:51:57 ----A---- C:\WINDOWS\system32\EnterpriseModernAppMgmtCSP.dll
2016-12-10 03:51:57 ----A---- C:\WINDOWS\system32\EnterpriseAppMgmtSvc.dll
2016-12-10 03:51:57 ----A---- C:\WINDOWS\system32\EDPCleanup.exe
2016-12-10 03:51:57 ----A---- C:\WINDOWS\system32\EAMProgressHandler.dll
2016-12-10 03:51:57 ----A---- C:\WINDOWS\system32\d3d11.dll
2016-12-10 03:51:57 ----A---- C:\WINDOWS\system32\ActivationManager.dll
2016-12-10 03:51:56 ----A---- C:\WINDOWS\SYSWOW64\usercpl.dll
2016-12-10 03:51:56 ----A---- C:\WINDOWS\SYSWOW64\msctf.dll
2016-12-10 03:51:56 ----A---- C:\WINDOWS\system32\Windows.StateRepositoryClient.dll
2016-12-10 03:51:56 ----A---- C:\WINDOWS\system32\Windows.StateRepositoryBroker.dll
2016-12-10 03:51:56 ----A---- C:\WINDOWS\system32\Windows.StateRepository.dll
2016-12-10 03:51:56 ----A---- C:\WINDOWS\system32\usercpl.dll
2016-12-10 03:51:56 ----A---- C:\WINDOWS\system32\hevcdecoder.dll
2016-12-10 03:51:55 ----A---- C:\WINDOWS\SYSWOW64\PlayToManager.dll
2016-12-10 03:51:55 ----A---- C:\WINDOWS\SYSWOW64\efswrt.dll
2016-12-10 03:51:55 ----A---- C:\WINDOWS\SYSWOW64\BcastDVRHelper.dll
2016-12-10 03:51:55 ----A---- C:\WINDOWS\SYSWOW64\bcastdvr.exe
2016-12-10 03:51:55 ----A---- C:\WINDOWS\SYSWOW64\AppCapture.dll
2016-12-10 03:51:55 ----A---- C:\WINDOWS\system32\Windows.UI.Search.dll
2016-12-10 03:51:55 ----A---- C:\WINDOWS\system32\RDXTaskFactory.dll
2016-12-10 03:51:55 ----A---- C:\WINDOWS\system32\NgcCtnr.dll
2016-12-10 03:51:55 ----A---- C:\WINDOWS\system32\ngccredprov.dll
2016-12-10 03:51:55 ----A---- C:\WINDOWS\system32\drivers\xboxgip.sys
2016-12-10 03:51:55 ----A---- C:\WINDOWS\system32\AppReadiness.dll
2016-12-10 03:51:54 ----A---- C:\WINDOWS\system32\wscsvc.dll
2016-12-10 03:51:54 ----A---- C:\WINDOWS\system32\Windows.Shell.Search.UriHandler.dll
2016-12-10 03:51:54 ----A---- C:\WINDOWS\system32\SystemSettingsThresholdAdminFlowUI.dll
2016-12-10 03:51:54 ----A---- C:\WINDOWS\system32\NetworkMobileSettings.dll
2016-12-10 03:51:54 ----A---- C:\WINDOWS\system32\netplwiz.dll
2016-12-10 03:51:54 ----A---- C:\WINDOWS\system32\dxgi.dll
2016-12-10 03:51:54 ----A---- C:\WINDOWS\system32\DeviceFlows.DataModel.dll
2016-12-10 03:51:53 ----A---- C:\WINDOWS\system32\SystemSettingsAdminFlows.exe
2016-12-10 03:51:53 ----A---- C:\WINDOWS\system32\actxprxy.dll
2016-12-10 03:51:52 ----A---- C:\WINDOWS\SYSWOW64\wsecedit.dll
2016-12-10 03:51:52 ----A---- C:\WINDOWS\SYSWOW64\RTWorkQ.dll
2016-12-10 03:51:52 ----A---- C:\WINDOWS\SYSWOW64\ActivationManager.dll
2016-12-10 03:51:52 ----A---- C:\WINDOWS\system32\wscapi.dll
2016-12-10 03:51:52 ----A---- C:\WINDOWS\system32\services.exe
2016-12-10 03:51:52 ----A---- C:\WINDOWS\system32\cryptngc.dll
2016-12-10 03:51:51 ----A---- C:\WINDOWS\SYSWOW64\wininet.dll
2016-12-10 03:51:51 ----A---- C:\WINDOWS\SYSWOW64\urlmon.dll
2016-12-10 03:51:51 ----A---- C:\WINDOWS\system32\wscinterop.dll
2016-12-10 03:51:51 ----A---- C:\WINDOWS\system32\VEStoreEventHandlers.dll
2016-12-10 03:51:50 ----A---- C:\WINDOWS\SYSWOW64\ntdll.dll
2016-12-10 03:51:50 ----A---- C:\WINDOWS\system32\msctf.dll
2016-12-10 03:51:50 ----A---- C:\WINDOWS\system32\comdlg32.dll
2016-12-10 03:51:49 ----A---- C:\WINDOWS\system32\Windows.UI.Immersive.dll
2016-12-10 03:51:49 ----A---- C:\WINDOWS\system32\modernexecserver.dll
2016-12-10 03:51:49 ----A---- C:\WINDOWS\system32\drivers\tpm.sys
2016-12-10 03:51:48 ----A---- C:\WINDOWS\SYSWOW64\Windows.UI.Search.dll
2016-12-10 03:51:48 ----A---- C:\WINDOWS\SYSWOW64\Windows.UI.Immersive.dll
2016-12-10 03:51:48 ----A---- C:\WINDOWS\SYSWOW64\Windows.Shell.Search.UriHandler.dll
2016-12-10 03:51:48 ----A---- C:\WINDOWS\SYSWOW64\Windows.Internal.Management.dll
2016-12-10 03:51:48 ----A---- C:\WINDOWS\SYSWOW64\gameux.dll
2016-12-10 03:51:48 ----A---- C:\WINDOWS\SYSWOW64\DevicePairing.dll
2016-12-10 03:51:48 ----A---- C:\WINDOWS\system32\cdpsvc.dll
2016-12-10 03:51:47 ----A---- C:\WINDOWS\SYSWOW64\stobject.dll
2016-12-10 03:51:47 ----A---- C:\WINDOWS\SYSWOW64\explorer.exe
2016-12-10 03:51:47 ----A---- C:\WINDOWS\system32\wpncore.dll
2016-12-10 03:51:47 ----A---- C:\WINDOWS\system32\sppwinob.dll
2016-12-10 03:51:47 ----A---- C:\WINDOWS\system32\EditionUpgradeManagerObj.dll
2016-12-10 03:51:47 ----A---- C:\WINDOWS\system32\EditionUpgradeHelper.dll
2016-12-10 03:51:47 ----A---- C:\WINDOWS\system32\cdpusersvc.dll
2016-12-10 03:51:47 ----A---- C:\WINDOWS\system32\ACPBackgroundManagerPolicy.dll
2016-12-10 03:51:46 ----A---- C:\WINDOWS\SYSWOW64\msdtcprx.dll
2016-12-10 03:51:46 ----A---- C:\WINDOWS\SYSWOW64\MrmCoreR.dll
2016-12-10 03:51:46 ----A---- C:\WINDOWS\SYSWOW64\dmenrollengine.dll
2016-12-10 03:51:46 ----A---- C:\WINDOWS\system32\wsecedit.dll
2016-12-10 03:51:46 ----A---- C:\WINDOWS\system32\VPNv2CSP.dll
2016-12-10 03:51:45 ----A---- C:\WINDOWS\SYSWOW64\xolehlp.dll
2016-12-10 03:51:45 ----A---- C:\WINDOWS\SYSWOW64\Windows.Networking.BackgroundTransfer.BackgroundManagerPolicy.dll
2016-12-10 03:51:45 ----A---- C:\WINDOWS\SYSWOW64\sendmail.dll
2016-12-10 03:51:45 ----A---- C:\WINDOWS\SYSWOW64\SearchFolder.dll
2016-12-10 03:51:45 ----A---- C:\WINDOWS\SYSWOW64\rasapi32.dll
2016-12-10 03:51:45 ----A---- C:\WINDOWS\SYSWOW64\policymanager.dll
2016-12-10 03:51:45 ----A---- C:\WINDOWS\SYSWOW64\mtxclu.dll
2016-12-10 03:51:45 ----A---- C:\WINDOWS\SYSWOW64\actxprxy.dll
2016-12-10 03:51:45 ----A---- C:\WINDOWS\system32\StorSvc.dll
2016-12-10 03:51:45 ----A---- C:\WINDOWS\system32\lpremove.exe
2016-12-10 03:51:45 ----A---- C:\WINDOWS\system32\drivers\modem.sys
2016-12-10 03:51:45 ----A---- C:\WINDOWS\system32\DeviceReactivation.dll
2016-12-10 03:51:44 ----A---- C:\WINDOWS\SYSWOW64\ngccredprov.dll
2016-12-10 03:51:44 ----A---- C:\WINDOWS\SYSWOW64\KernelBase.dll
2016-12-10 03:51:44 ----A---- C:\WINDOWS\system32\wkssvc.dll
2016-12-10 03:51:44 ----A---- C:\WINDOWS\system32\mfsvr.dll
2016-12-10 03:51:44 ----A---- C:\WINDOWS\system32\mfplat.dll
2016-12-10 03:51:44 ----A---- C:\WINDOWS\system32\bcastdvr.exe
2016-12-10 03:51:43 ----A---- C:\WINDOWS\SYSWOW64\cryptngc.dll
2016-12-10 03:51:43 ----A---- C:\WINDOWS\system32\BcastDVRHelper.dll
2016-12-10 03:51:42 ----A---- C:\WINDOWS\system32\lsm.dll
2016-12-10 03:51:42 ----A---- C:\WINDOWS\system32\KernelBase.dll
2016-12-10 03:51:41 ----A---- C:\WINDOWS\SYSWOW64\windows.storage.dll
2016-12-10 03:51:41 ----A---- C:\WINDOWS\system32\windows.storage.dll
2016-12-10 03:51:41 ----A---- C:\WINDOWS\system32\AppCapture.dll
2016-12-10 03:51:40 ----A---- C:\WINDOWS\system32\dwmcore.dll
2016-12-10 03:51:40 ----A---- C:\WINDOWS\system32\DisplayManager.dll
2016-12-10 03:51:39 ----A---- C:\WINDOWS\system32\ExplorerFrame.dll
2016-12-10 03:51:39 ----A---- C:\WINDOWS\system32\drivers\srv2.sys
2016-12-10 03:51:37 ----A---- C:\WINDOWS\SYSWOW64\migisol.dll
2016-12-10 03:51:37 ----A---- C:\WINDOWS\SYSWOW64\MFPlay.dll
2016-12-10 03:51:37 ----A---- C:\WINDOWS\system32\msdtcprx.dll
2016-12-10 03:51:37 ----A---- C:\WINDOWS\system32\migisol.dll
2016-12-10 03:51:37 ----A---- C:\WINDOWS\system32\mfmkvsrcsnk.dll
2016-12-10 03:51:37 ----A---- C:\WINDOWS\system32\mfaudiocnv.dll
2016-12-10 03:51:37 ----A---- C:\WINDOWS\system32\dialserver.dll
2016-12-10 03:51:37 ----A---- C:\WINDOWS\system32\CloudStorageWizard.exe
2016-12-10 03:51:36 ----A---- C:\WINDOWS\SYSWOW64\msdtcuiu.dll
2016-12-10 03:51:36 ----A---- C:\WINDOWS\system32\sppnp.dll
2016-12-10 03:51:36 ----A---- C:\WINDOWS\system32\RjvMDMConfig.dll
2016-12-10 03:51:36 ----A---- C:\WINDOWS\system32\ReAgentc.exe
2016-12-10 03:51:36 ----A---- C:\WINDOWS\system32\ProvSysprep.dll
2016-12-10 03:51:36 ----A---- C:\WINDOWS\system32\drivers\mrxsmb10.sys
2016-12-10 03:51:36 ----A---- C:\WINDOWS\system32\dpapisrv.dll
2016-12-10 03:51:36 ----A---- C:\WINDOWS\system32\aitstatic.exe
2016-12-10 03:51:35 ----A---- C:\WINDOWS\SYSWOW64\Windows.ApplicationModel.Store.dll
2016-12-10 03:51:32 ----A---- C:\WINDOWS\SYSWOW64\ieproxy.dll
2016-12-10 03:51:31 ----A---- C:\WINDOWS\system32\stobject.dll
2016-12-10 03:51:31 ----A---- C:\WINDOWS\system32\ieproxy.dll
2016-12-10 03:51:31 ----A---- C:\WINDOWS\system32\drivers\mrxsmb20.sys
2016-12-10 03:51:31 ----A---- C:\WINDOWS\system32\DevicePairing.dll
2016-12-10 03:51:31 ----A---- C:\WINDOWS\system32\DataSenseHandlers.dll
2016-12-10 03:51:30 ----A---- C:\WINDOWS\system32\urlmon.dll
2016-12-10 03:51:30 ----A---- C:\WINDOWS\system32\gameux.dll
2016-12-10 03:51:30 ----A---- C:\WINDOWS\explorer.exe
2016-12-10 03:51:29 ----A---- C:\WINDOWS\system32\WSManHTTPConfig.exe
2016-12-10 03:51:29 ----A---- C:\WINDOWS\system32\NMAA.dll
2016-12-10 03:51:29 ----A---- C:\WINDOWS\system32\MapControlCore.dll
2016-12-10 03:51:29 ----A---- C:\WINDOWS\system32\drivers\rdbss.sys
2016-12-10 03:51:28 ----A---- C:\WINDOWS\system32\zipfldr.dll
2016-12-10 03:51:28 ----A---- C:\WINDOWS\system32\IdCtrls.dll
2016-12-10 03:51:28 ----A---- C:\WINDOWS\system32\efswrt.dll
2016-12-10 03:51:27 ----A---- C:\WINDOWS\system32\WsmSvc.dll
2016-12-10 03:51:27 ----A---- C:\WINDOWS\system32\wininet.dll
2016-12-10 03:51:27 ----A---- C:\WINDOWS\system32\mos.dll
2016-12-10 03:51:26 ----A---- C:\WINDOWS\system32\UIAutomationCore.dll
2016-12-10 03:51:25 ----A---- C:\WINDOWS\SYSWOW64\ntshrui.dll
2016-12-10 03:51:25 ----A---- C:\WINDOWS\system32\SyncCenter.dll
2016-12-10 03:51:24 ----A---- C:\WINDOWS\system32\JpMapControl.dll
2016-12-10 03:51:24 ----A---- C:\WINDOWS\system32\BingMaps.dll
2016-12-10 03:51:23 ----A---- C:\WINDOWS\SYSWOW64\hevcdecoder.dll
2016-12-10 03:51:23 ----A---- C:\WINDOWS\system32\rasmans.dll
2016-12-10 03:51:22 ----A---- C:\WINDOWS\SYSWOW64\setupugc.exe
2016-12-10 03:51:22 ----A---- C:\WINDOWS\system32\setupugc.exe
2016-12-10 03:51:22 ----A---- C:\WINDOWS\system32\moshostcore.dll
2016-12-10 03:51:22 ----A---- C:\WINDOWS\system32\MapsStore.dll
2016-12-10 03:51:22 ----A---- C:\WINDOWS\system32\MapRouter.dll
2016-12-10 03:51:22 ----A---- C:\WINDOWS\system32\MapGeocoder.dll
2016-12-10 03:51:21 ----A---- C:\WINDOWS\SYSWOW64\wscinterop.dll
2016-12-10 03:51:21 ----A---- C:\WINDOWS\SYSWOW64\wscapi.dll
2016-12-10 03:51:21 ----A---- C:\WINDOWS\SYSWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2016-12-10 03:51:21 ----A---- C:\WINDOWS\SYSWOW64\ReAgentc.exe
2016-12-10 03:51:21 ----A---- C:\WINDOWS\SYSWOW64\NetSetupShim.dll
2016-12-10 03:51:21 ----A---- C:\WINDOWS\SYSWOW64\NetCfgNotifyObjectHost.exe
2016-12-10 03:51:21 ----A---- C:\WINDOWS\system32\vpnike.dll
2016-12-10 03:51:21 ----A---- C:\WINDOWS\system32\umpoext.dll
2016-12-10 03:51:21 ----A---- C:\WINDOWS\system32\sendmail.dll
2016-12-10 03:51:21 ----A---- C:\WINDOWS\system32\rasapi32.dll
2016-12-10 03:51:21 ----A---- C:\WINDOWS\system32\NetSetupShim.dll
2016-12-10 03:51:21 ----A---- C:\WINDOWS\system32\NetCfgNotifyObjectHost.exe
2016-12-10 03:51:21 ----A---- C:\WINDOWS\system32\MosStorage.dll
2016-12-10 03:51:21 ----A---- C:\WINDOWS\system32\moshost.dll
2016-12-10 03:51:21 ----A---- C:\WINDOWS\system32\MapsBtSvc.dll
2016-12-10 03:51:21 ----A---- C:\WINDOWS\system32\MapConfiguration.dll
2016-12-10 03:51:21 ----A---- C:\WINDOWS\system32\CbtBackgroundManagerPolicy.dll
2016-12-08 01:38:40 ----D---- C:\Program Files (x86)\Mozilla Firefox
2016-12-02 01:54:46 ----A---- C:\WINDOWS\system32\CFHD.dll
2016-12-02 01:54:42 ----A---- C:\WINDOWS\SYSWOW64\CFHD.dll
2016-11-29 05:50:07 ----A---- C:\WINDOWS\system32\drivers\tap0901.sys
2016-11-29 05:43:58 ----AD---- C:\Program Files\Common Files\DESIGNER
2016-11-29 05:43:38 ----D---- C:\WINDOWS\PCHEALTH
2016-11-26 20:11:25 ----D---- C:\Program Files (x86)\Rockstar Games
2016-11-21 05:41:39 ----A---- C:\WINDOWS\system32\PnkBstrA.exe
2016-11-21 02:10:23 ----A---- C:\WINDOWS\SYSWOW64\PnkBstrB.exe
2016-11-21 02:10:22 ----A---- C:\WINDOWS\SYSWOW64\PnkBstrA.exe
2016-11-20 19:51:49 ----D---- C:\Users\NG\AppData\Roaming\Origin
2016-11-20 19:48:06 ----D---- C:\ProgramData\Origin
2016-11-19 22:18:42 ----D---- C:\Users\NG\AppData\Roaming\Code
2016-11-11 02:26:32 ----A---- C:\WINDOWS\system32\WdfCoInstaller01011.dll
2016-11-11 02:25:14 ----A---- C:\WINDOWS\system32\ETDCoInstaller15014.dll
2016-11-09 18:49:51 ----A---- C:\WINDOWS\system32\WpAXHolder.dll
2016-11-09 18:49:50 ----A---- C:\WINDOWS\SYSWOW64\inetcomm.dll
2016-11-09 18:49:50 ----A---- C:\WINDOWS\SYSWOW64\iertutil.dll
2016-11-09 18:49:50 ----A---- C:\WINDOWS\system32\oleaut32.dll
2016-11-09 18:49:50 ----A---- C:\WINDOWS\system32\ActionCenterCPL.dll
2016-11-09 18:49:49 ----A---- C:\WINDOWS\SYSWOW64\weretw.dll
2016-11-09 18:49:49 ----A---- C:\WINDOWS\SYSWOW64\wer.dll
2016-11-09 18:49:49 ----A---- C:\WINDOWS\SYSWOW64\chartv.dll
2016-11-09 18:49:49 ----A---- C:\WINDOWS\SYSWOW64\fontdrvhost.exe
2016-11-09 18:49:49 ----A---- C:\WINDOWS\system32\weretw.dll
2016-11-09 18:49:49 ----A---- C:\WINDOWS\system32\wer.dll
2016-11-09 18:49:48 ----A---- C:\WINDOWS\SYSWOW64\atmfd.dll
2016-11-09 18:49:48 ----A---- C:\WINDOWS\system32\WpcRefreshTask.dll
2016-11-09 18:49:48 ----A---- C:\WINDOWS\system32\Windows.UI.Cred.dll
2016-11-09 18:49:48 ----A---- C:\WINDOWS\system32\ubpm.dll
2016-11-09 18:49:48 ----A---- C:\WINDOWS\system32\NetworkBindingEngineMigPlugin.dll
2016-11-09 18:49:48 ----A---- C:\WINDOWS\system32\drivers\bowser.sys
2016-11-09 18:49:48 ----A---- C:\WINDOWS\system32\asycfilt.dll
2016-11-09 18:49:47 ----A---- C:\WINDOWS\SYSWOW64\wininetlui.dll
2016-11-09 18:49:47 ----A---- C:\WINDOWS\SYSWOW64\NPSM.dll
2016-11-09 18:49:47 ----A---- C:\WINDOWS\system32\WpcTok.exe
2016-11-09 18:49:47 ----A---- C:\WINDOWS\system32\TSpkg.dll
2016-11-09 18:49:47 ----A---- C:\WINDOWS\system32\ddraw.dll
2016-11-09 18:49:47 ----A---- C:\WINDOWS\system32\dab.dll
2016-11-09 18:49:47 ----A---- C:\WINDOWS\system32\ActionCenter.dll
2016-11-09 18:49:46 ----A---- C:\WINDOWS\SYSWOW64\atmlib.dll
2016-11-09 18:49:45 ----A---- C:\WINDOWS\system32\chartv.dll
2016-11-09 18:49:44 ----A---- C:\WINDOWS\system32\wmp.dll
2016-11-09 18:49:43 ----A---- C:\WINDOWS\SYSWOW64\wmp.dll
2016-11-09 18:49:42 ----A---- C:\WINDOWS\SYSWOW64\twinapi.dll
2016-11-09 18:49:42 ----A---- C:\WINDOWS\SYSWOW64\themecpl.dll
2016-11-09 18:49:42 ----A---- C:\WINDOWS\SYSWOW64\fontext.dll
2016-11-09 18:49:42 ----A---- C:\WINDOWS\system32\twinapi.dll
2016-11-09 18:49:42 ----A---- C:\WINDOWS\system32\authui.dll
2016-11-09 18:49:41 ----A---- C:\WINDOWS\SYSWOW64\sud.dll
2016-11-09 18:49:41 ----A---- C:\WINDOWS\SYSWOW64\hgcpl.dll
2016-11-09 18:49:39 ----A---- C:\WINDOWS\system32\ListSvc.dll
2016-11-09 18:49:39 ----A---- C:\WINDOWS\system32\efsext.dll
2016-11-09 18:49:38 ----A---- C:\WINDOWS\system32\wwansvc.dll
2016-11-09 18:49:37 ----A---- C:\WINDOWS\SYSWOW64\AuthExt.dll
2016-11-09 18:49:34 ----A---- C:\WINDOWS\system32\themecpl.dll
2016-11-09 18:49:34 ----A---- C:\WINDOWS\system32\sud.dll
2016-11-09 18:49:33 ----A---- C:\WINDOWS\SYSWOW64\mstsc.exe
2016-11-09 18:49:33 ----A---- C:\WINDOWS\system32\hgcpl.dll
2016-11-09 18:49:33 ----A---- C:\WINDOWS\system32\fontext.dll
2016-11-09 18:49:32 ----A---- C:\WINDOWS\system32\SystemSettings.UserAccountsHandlers.dll
2016-11-09 18:49:27 ----A---- C:\WINDOWS\system32\WlanMediaManager.dll
2016-11-09 18:49:27 ----A---- C:\WINDOWS\system32\NPSM.dll
2016-11-09 18:49:27 ----A---- C:\WINDOWS\system32\NetworkDesktopSettings.dll
2016-11-09 18:49:27 ----A---- C:\WINDOWS\system32\drivers\ntfs.sys
2016-11-09 18:49:26 ----A---- C:\WINDOWS\SYSWOW64\olepro32.dll
2016-11-09 18:49:26 ----A---- C:\WINDOWS\SYSWOW64\asycfilt.dll
2016-11-09 18:49:26 ----A---- C:\WINDOWS\system32\DeviceCenter.dll
2016-11-09 18:49:25 ----A---- C:\WINDOWS\SYSWOW64\oleaut32.dll
2016-11-09 18:49:25 ----A---- C:\WINDOWS\SYSWOW64\LockAppBroker.dll
2016-11-09 18:49:24 ----A---- C:\WINDOWS\SYSWOW64\mshtmled.dll
2016-11-09 18:49:23 ----A---- C:\WINDOWS\SYSWOW64\ActionCenterCPL.dll
2016-11-09 18:49:22 ----A---- C:\WINDOWS\system32\MSVidCtl.dll
2016-11-09 18:49:22 ----A---- C:\WINDOWS\system32\mfsensorgroup.dll
2016-11-09 18:49:22 ----A---- C:\WINDOWS\system32\LockAppBroker.dll
2016-11-09 18:49:17 ----A---- C:\WINDOWS\system32\shdocvw.dll
2016-11-09 18:49:17 ----A---- C:\WINDOWS\system32\iertutil.dll
2016-11-09 18:49:15 ----A---- C:\WINDOWS\SYSWOW64\ieapfltr.dll
2016-11-09 18:49:15 ----A---- C:\WINDOWS\SYSWOW64\d3d9.dll
2016-11-09 18:49:15 ----A---- C:\WINDOWS\system32\mshtmled.dll
2016-11-09 18:49:15 ----A---- C:\WINDOWS\system32\FSClient.dll
2016-11-09 18:49:13 ----A---- C:\WINDOWS\SYSWOW64\Windows.Globalization.dll
2016-11-09 18:49:13 ----A---- C:\WINDOWS\system32\PsmServiceExtHost.dll
2016-11-09 18:49:13 ----A---- C:\WINDOWS\system32\ieapfltr.dll
2016-11-09 18:49:13 ----A---- C:\WINDOWS\system32\FrameServer.dll
2016-11-09 18:49:09 ----A---- C:\WINDOWS\system32\Windows.Globalization.dll
2016-11-09 18:49:09 ----A---- C:\WINDOWS\system32\inetcomm.dll
2016-11-09 18:49:09 ----A---- C:\WINDOWS\system32\bisrv.dll
2016-11-09 18:49:03 ----A---- C:\WINDOWS\SYSWOW64\dxtrans.dll
2016-11-09 18:49:03 ----A---- C:\WINDOWS\system32\Windows.Devices.HumanInterfaceDevice.dll
2016-11-09 18:49:03 ----A---- C:\WINDOWS\system32\wifinetworkmanager.dll
2016-11-09 18:49:03 ----A---- C:\WINDOWS\system32\ErrorDetails.dll
2016-11-09 18:49:01 ----A---- C:\WINDOWS\SYSWOW64\NetSetupEngine.dll
2016-11-09 18:49:01 ----A---- C:\WINDOWS\system32\mstsc.exe
2016-11-09 18:49:00 ----A---- C:\WINDOWS\SYSWOW64\UIAnimation.dll
2016-11-09 18:49:00 ----A---- C:\WINDOWS\SYSWOW64\NetSetupApi.dll
2016-11-09 18:49:00 ----A---- C:\WINDOWS\SYSWOW64\input.dll
2016-11-09 18:49:00 ----A---- C:\WINDOWS\system32\wifitask.exe
2016-11-09 18:48:59 ----A---- C:\WINDOWS\SYSWOW64\TSpkg.dll
2016-11-09 18:48:59 ----A---- C:\WINDOWS\SYSWOW64\ErrorDetails.dll
2016-11-09 18:48:59 ----A---- C:\WINDOWS\system32\iepeers.dll
2016-11-09 18:48:59 ----A---- C:\WINDOWS\system32\ErrorDetailsUpdate.dll
2016-11-09 18:48:58 ----A---- C:\WINDOWS\SYSWOW64\iepeers.dll
2016-11-09 18:48:58 ----A---- C:\WINDOWS\SYSWOW64\GlobCollationHost.dll
2016-11-09 18:48:58 ----A---- C:\WINDOWS\SYSWOW64\ErrorDetailsUpdate.dll
2016-11-09 18:48:58 ----A---- C:\WINDOWS\system32\ipnathlp.dll
2016-11-09 18:48:58 ----A---- C:\WINDOWS\system32\GlobCollationHost.dll
2016-11-09 18:48:58 ----A---- C:\WINDOWS\system32\dxtrans.dll
2016-11-09 18:48:57 ----A---- C:\WINDOWS\SYSWOW64\mfsensorgroup.dll
2016-11-09 18:48:57 ----A---- C:\WINDOWS\system32\msinfo32.exe
2016-11-09 18:48:56 ----A---- C:\WINDOWS\SYSWOW64\MSVidCtl.dll
2016-11-09 18:48:56 ----A---- C:\WINDOWS\SYSWOW64\msinfo32.exe
2016-11-09 18:48:56 ----A---- C:\WINDOWS\SYSWOW64\FSClient.dll
2016-11-09 18:48:56 ----A---- C:\WINDOWS\SYSWOW64\authui.dll
2016-11-09 18:48:54 ----A---- C:\WINDOWS\system32\d3d9.dll
2016-11-09 18:48:53 ----A---- C:\WINDOWS\system32\fontdrvhost.exe
2016-11-09 18:48:53 ----A---- C:\WINDOWS\system32\FlightSettings.dll
2016-11-09 18:48:52 ----A---- C:\WINDOWS\SYSWOW64\Windows.Devices.HumanInterfaceDevice.dll
2016-11-09 18:48:52 ----A---- C:\WINDOWS\SYSWOW64\efsext.dll
2016-11-09 18:48:52 ----A---- C:\WINDOWS\system32\NetworkUXBroker.dll
2016-11-09 18:48:51 ----A---- C:\WINDOWS\system32\UIAnimation.dll
2016-11-09 18:48:51 ----A---- C:\WINDOWS\system32\NetSetupSvc.dll
2016-11-09 18:48:51 ----A---- C:\WINDOWS\system32\NetSetupEngine.dll
2016-11-09 18:48:51 ----A---- C:\WINDOWS\system32\microsoft-windows-system-events.dll
2016-11-09 18:48:51 ----A---- C:\WINDOWS\system32\drivers\iorate.sys
2016-11-09 18:48:51 ----A---- C:\WINDOWS\system32\atmfd.dll
2016-11-09 18:48:50 ----A---- C:\WINDOWS\SYSWOW64\ddraw.dll
2016-11-09 18:48:50 ----A---- C:\WINDOWS\SYSWOW64\d3d8.dll
2016-11-09 18:48:50 ----A---- C:\WINDOWS\SYSWOW64\comctl32.dll
2016-11-09 18:48:50 ----A---- C:\WINDOWS\system32\wininetlui.dll
2016-11-09 18:48:50 ----A---- C:\WINDOWS\system32\NetSetupApi.dll
2016-11-09 18:48:50 ----A---- C:\WINDOWS\system32\input.dll
2016-11-09 18:48:47 ----A---- C:\WINDOWS\system32\atmlib.dll
2016-11-04 11:27:08 ----A---- C:\WINDOWS\system32\WinUSBCoInstaller2.dll
2016-11-04 11:27:06 ----A---- C:\WINDOWS\system32\WdfCoInstaller01009.dll
2016-10-29 15:59:00 ----D---- C:\WINDOWS\SYSWOW64\directx
2016-10-28 18:53:06 ----A---- C:\WINDOWS\system32\DolbyDecMFT.dll
2016-10-28 18:52:59 ----A---- C:\WINDOWS\system32\mfps.dll
2016-10-28 18:52:38 ----A---- C:\WINDOWS\system32\SettingsHandlers_Bluetooth.dll
2016-10-28 18:52:34 ----A---- C:\WINDOWS\SYSWOW64\Windows.Media.Playback.MediaPlayer.dll
2016-10-28 18:52:34 ----A---- C:\WINDOWS\SYSWOW64\Windows.Media.Playback.BackgroundMediaPlayer.dll
2016-10-28 18:52:34 ----A---- C:\WINDOWS\SYSWOW64\Windows.Media.BackgroundMediaPlayback.dll
2016-10-28 18:52:33 ----A---- C:\WINDOWS\SYSWOW64\RemoteNaturalLanguage.dll
2016-10-28 18:52:32 ----A---- C:\WINDOWS\system32\energy.dll
2016-10-28 18:52:31 ----A---- C:\WINDOWS\SYSWOW64\BluetoothApis.dll
2016-10-28 18:52:31 ----A---- C:\WINDOWS\system32\msvproc.dll
2016-10-28 18:52:31 ----A---- C:\WINDOWS\system32\drivers\ahcache.sys
2016-10-28 18:52:30 ----A---- C:\WINDOWS\SYSWOW64\drvstore.dll
2016-10-28 18:52:30 ----A---- C:\WINDOWS\system32\MusNotification.exe
2016-10-28 18:52:30 ----A---- C:\WINDOWS\system32\MFCaptureEngine.dll
2016-10-28 18:52:29 ----A---- C:\WINDOWS\SYSWOW64\iscsiwmi.dll
2016-10-28 18:52:29 ----A---- C:\WINDOWS\system32\TpmTasks.dll
2016-10-28 18:52:27 ----A---- C:\WINDOWS\system32\Windows.Networking.dll
2016-10-28 18:52:22 ----A---- C:\WINDOWS\system32\Windows.Media.Speech.dll
2016-10-28 18:52:21 ----A---- C:\WINDOWS\system32\Windows.Networking.Connectivity.dll
2016-10-28 18:52:11 ----A---- C:\WINDOWS\SYSWOW64\wsp_health.dll
2016-10-28 18:52:11 ----A---- C:\WINDOWS\SYSWOW64\wsp_fs.dll
2016-10-28 18:52:10 ----A---- C:\WINDOWS\system32\SettingsHandlers_Flights.dll
2016-10-28 18:52:09 ----A---- C:\WINDOWS\system32\drivers\dam.sys
2016-10-28 18:52:08 ----A---- C:\WINDOWS\SYSWOW64\DolbyDecMFT.dll
2016-10-28 18:52:08 ----A---- C:\WINDOWS\SYSWOW64\cmifw.dll
2016-10-28 18:52:08 ----A---- C:\WINDOWS\system32\drivers\capimg.sys
2016-10-28 18:52:07 ----A---- C:\WINDOWS\system32\powercfg.exe
2016-10-28 18:52:07 ----A---- C:\WINDOWS\system32\fhcpl.dll
2016-10-28 18:52:07 ----A---- C:\WINDOWS\system32\Display.dll
2016-10-28 18:52:07 ----A---- C:\WINDOWS\system32\autoplay.dll
2016-10-28 18:52:06 ----A---- C:\WINDOWS\system32\taskbarcpl.dll
2016-10-28 18:52:06 ----A---- C:\WINDOWS\system32\OnDemandConnRouteHelper.dll
2016-10-28 18:52:06 ----A---- C:\WINDOWS\system32\DevicePairingFolder.dll
2016-10-28 18:52:05 ----A---- C:\WINDOWS\system32\qmgr.dll
2016-10-28 18:52:05 ----A---- C:\WINDOWS\system32\mfksproxy.dll
2016-10-28 18:52:02 ----A---- C:\WINDOWS\SYSWOW64\mfksproxy.dll
2016-10-28 18:52:00 ----A---- C:\WINDOWS\SYSWOW64\Geolocation.dll
2016-10-28 18:51:59 ----A---- C:\WINDOWS\SYSWOW64\Windows.Networking.Connectivity.dll
2016-10-28 18:51:54 ----A---- C:\WINDOWS\SYSWOW64\mispace.dll
2016-10-28 18:51:54 ----A---- C:\WINDOWS\system32\mispace.dll
2016-10-28 18:51:54 ----A---- C:\WINDOWS\system32\diagtrack.dll
2016-10-28 18:51:53 ----A---- C:\WINDOWS\system32\generaltel.dll
2016-10-28 18:51:53 ----A---- C:\WINDOWS\system32\devinv.dll
2016-10-28 18:51:53 ----A---- C:\WINDOWS\system32\CompatTelRunner.exe
2016-10-28 18:51:52 ----A---- C:\WINDOWS\system32\wsp_health.dll
2016-10-28 18:51:52 ----A---- C:\WINDOWS\system32\wsp_fs.dll
2016-10-28 18:51:52 ----A---- C:\WINDOWS\system32\spoolsv.exe
2016-10-28 18:51:52 ----A---- C:\WINDOWS\splwow64.exe
2016-10-28 18:51:51 ----A---- C:\WINDOWS\SYSWOW64\Windows.Networking.dll
2016-10-28 18:51:51 ----A---- C:\WINDOWS\SYSWOW64\esent.dll
2016-10-28 18:51:51 ----A---- C:\WINDOWS\system32\wintrust.dll
2016-10-28 18:51:50 ----A---- C:\WINDOWS\system32\esent.dll
2016-10-28 18:51:49 ----A---- C:\WINDOWS\system32\invagent.dll
2016-10-28 18:51:49 ----A---- C:\WINDOWS\system32\aepic.dll
2016-10-28 18:51:48 ----A---- C:\WINDOWS\system32\drivers\crashdmp.sys
2016-10-28 18:51:47 ----A---- C:\WINDOWS\SYSWOW64\wmpeffects.dll
2016-10-28 18:51:47 ----A---- C:\WINDOWS\system32\wmpeffects.dll
2016-10-28 18:51:47 ----A---- C:\WINDOWS\system32\pcasvc.dll
2016-10-28 18:51:47 ----A---- C:\WINDOWS\system32\drvstore.dll
2016-10-28 18:51:46 ----A---- C:\WINDOWS\SYSWOW64\wmpdxm.dll
2016-10-28 18:51:46 ----A---- C:\WINDOWS\system32\wmpshell.dll
2016-10-28 18:51:46 ----A---- C:\WINDOWS\system32\wmpdxm.dll
2016-10-28 18:51:46 ----A---- C:\WINDOWS\system32\iscsiwmi.dll
2016-10-28 18:51:46 ----A---- C:\WINDOWS\system32\drivers\storport.sys
2016-10-28 18:51:46 ----A---- C:\WINDOWS\system32\cmifw.dll
2016-10-28 18:51:44 ----A---- C:\WINDOWS\SYSWOW64\wmpshell.dll
2016-10-28 18:51:43 ----A---- C:\WINDOWS\SYSWOW64\esentutl.exe
2016-10-28 18:51:43 ----A---- C:\WINDOWS\system32\wups.dll
2016-10-28 18:51:43 ----A---- C:\WINDOWS\system32\esentutl.exe
2016-10-28 18:51:40 ----A---- C:\WINDOWS\system32\sppsvc.exe
2016-10-28 18:51:39 ----A---- C:\WINDOWS\system32\SndVolSSO.dll
2016-10-28 18:51:35 ----A---- C:\WINDOWS\SYSWOW64\Windows.Data.Pdf.dll
2016-10-28 18:51:34 ----A---- C:\WINDOWS\system32\FntCache.dll
2016-10-28 18:51:33 ----A---- C:\WINDOWS\system32\Windows.Data.Pdf.dll
2016-10-28 18:51:27 ----A---- C:\WINDOWS\system32\CPFilters.dll
2016-10-28 18:51:26 ----A---- C:\WINDOWS\system32\Windows.Media.Playback.MediaPlayer.dll
2016-10-28 18:51:26 ----A---- C:\WINDOWS\system32\Windows.Media.Playback.BackgroundMediaPlayer.dll
2016-10-28 18:51:26 ----A---- C:\WINDOWS\system32\Windows.Media.BackgroundMediaPlayback.dll
2016-10-28 18:51:26 ----A---- C:\WINDOWS\system32\wc_storage.dll
2016-10-28 18:51:26 ----A---- C:\WINDOWS\system32\daxexec.dll
2016-10-28 18:51:24 ----A---- C:\WINDOWS\system32\DeviceCensus.exe
2016-10-28 18:51:23 ----A---- C:\WINDOWS\SYSWOW64\Windows.Devices.WiFi.dll
2016-10-28 18:51:23 ----A---- C:\WINDOWS\system32\Windows.Devices.WiFi.dll
2016-10-28 18:51:23 ----A---- C:\WINDOWS\system32\crypt32.dll
2016-10-28 18:51:22 ----A---- C:\WINDOWS\system32\winhttp.dll
2016-10-28 18:51:22 ----A---- C:\WINDOWS\system32\BthRadioMedia.dll
2016-10-28 18:51:22 ----A---- C:\WINDOWS\system32\BluetoothApis.dll
2016-10-28 18:51:20 ----A---- C:\WINDOWS\system32\MDMAppInstaller.exe
2016-10-28 18:51:19 ----A---- C:\WINDOWS\SYSWOW64\dtdump.exe
2016-10-28 18:51:19 ----A---- C:\WINDOWS\system32\dafBth.dll
2016-10-28 18:51:16 ----A---- C:\WINDOWS\SYSWOW64\systemcpl.dll
2016-10-28 18:51:16 ----A---- C:\WINDOWS\SYSWOW64\autoplay.dll
2016-10-28 18:51:16 ----A---- C:\WINDOWS\system32\EncDec.dll
2016-10-28 18:51:16 ----A---- C:\WINDOWS\system32\dhcpcore6.dll
2016-10-28 18:51:12 ----A---- C:\WINDOWS\SYSWOW64\DWrite.dll
2016-10-28 18:51:11 ----A---- C:\WINDOWS\system32\drivers\tcpip.sys
2016-10-28 18:51:08 ----A---- C:\WINDOWS\system32\Geolocation.dll
2016-10-28 18:51:06 ----A---- C:\WINDOWS\system32\drivers\http.sys
2016-10-28 18:51:05 ----A---- C:\WINDOWS\system32\NotificationController.dll
2016-10-28 18:51:04 ----A---- C:\WINDOWS\system32\DWrite.dll
2016-10-28 18:51:03 ----A---- C:\WINDOWS\system32\drivers\spaceport.sys
2016-10-28 18:51:01 ----A---- C:\WINDOWS\SYSWOW64\CPFilters.dll
2016-10-28 18:51:00 ----A---- C:\WINDOWS\SYSWOW64\SndVolSSO.dll
2016-10-28 18:50:59 ----A---- C:\WINDOWS\SYSWOW64\daxexec.dll
2016-10-28 18:50:53 ----A---- C:\WINDOWS\SYSWOW64\Windows.Media.Speech.dll
2016-10-28 18:50:47 ----A---- C:\WINDOWS\SYSWOW64\wintrust.dll
2016-10-28 18:50:47 ----A---- C:\WINDOWS\system32\RemoteNaturalLanguage.dll
2016-10-28 18:50:47 ----A---- C:\WINDOWS\system32\LocationFramework.dll
2016-10-28 18:50:46 ----A---- C:\WINDOWS\SYSWOW64\crypt32.dll
2016-10-28 18:50:46 ----A---- C:\WINDOWS\system32\MusUpdateHandlers.dll
2016-10-28 18:50:46 ----A---- C:\WINDOWS\system32\CloudExperienceHostBroker.dll
2016-10-28 18:50:45 ----A---- C:\WINDOWS\system32\iphlpsvc.dll
2016-10-28 18:50:44 ----A---- C:\WINDOWS\SYSWOW64\winhttp.dll
2016-10-28 18:50:44 ----A---- C:\WINDOWS\SYSWOW64\msvproc.dll
2016-10-28 18:50:44 ----A---- C:\WINDOWS\system32\drivers\FWPKCLNT.SYS
2016-10-28 18:50:44 ----A---- C:\WINDOWS\system32\drivers\afd.sys
2016-10-28 18:50:43 ----A---- C:\WINDOWS\system32\twinui.pcshell.dll
2016-10-28 18:50:42 ----A---- C:\WINDOWS\system32\drivers\hidclass.sys
2016-10-28 18:50:42 ----A---- C:\WINDOWS\system32\AudioSrvPolicyManager.dll
2016-10-28 18:50:41 ----A---- C:\WINDOWS\SYSWOW64\powercfg.exe
2016-10-28 18:50:41 ----A---- C:\WINDOWS\SYSWOW64\dhcpcore6.dll
======List of files/folders modified in the last 3 months======
2017-01-26 10:31:21 ----D---- C:\Program Files\trend micro
2017-01-26 10:21:56 ----D---- C:\WINDOWS\Prefetch
2017-01-26 10:07:07 ----D---- C:\WINDOWS\Temp
2017-01-26 10:07:07 ----D---- C:\WINDOWS\system32\SleepStudy
2017-01-26 09:53:17 ----D---- C:\Users\NG\AppData\Roaming\npm-cache
2017-01-26 09:47:17 ----D---- C:\WINDOWS\system32\sru
2017-01-26 09:45:10 ----D---- C:\WINDOWS\System32
2017-01-26 09:45:10 ----A---- C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2017-01-25 21:22:59 ----D---- C:\WINDOWS\system32\config
2017-01-25 21:22:50 ----D---- C:\WINDOWS\CbsTemp
2017-01-25 21:22:49 ----D---- C:\WINDOWS\SysWOW64
2017-01-25 21:22:48 ----D---- C:\WINDOWS\WinSxS
2017-01-25 21:22:45 ----RD---- C:\WINDOWS\Microsoft.NET
2017-01-25 17:46:05 ----D---- C:\Users\NG\AppData\Roaming\Skype
2017-01-25 16:19:24 ----HD---- C:\Program Files\WindowsApps
2017-01-25 16:19:24 ----D---- C:\WINDOWS\AppReadiness
2017-01-23 09:53:42 ----D---- C:\WINDOWS\LiveKernelReports
2017-01-22 17:30:37 ----D---- C:\Users\NG\AppData\Roaming\uTorrent
2017-01-22 00:32:27 ----D---- C:\Users\NG\AppData\Roaming\Dropbox
2017-01-20 21:59:55 ----D---- C:\WINDOWS\system32\Tasks
2017-01-16 16:19:47 ----D---- C:\WINDOWS\system32\NDF
2017-01-14 12:51:27 ----D---- C:\WINDOWS\system32\catroot2
2017-01-13 22:01:01 ----D---- C:\WINDOWS\rescache
2017-01-13 21:54:48 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2017-01-13 21:21:15 ----D---- C:\WINDOWS\system32\DriverStore
2017-01-13 21:21:11 ----D---- C:\WINDOWS\INF
2017-01-13 21:21:03 ----D---- C:\WINDOWS\system32\LogFiles
2017-01-13 21:21:03 ----D---- C:\Windows
2017-01-13 21:20:35 ----SHD---- C:\Config.Msi
2017-01-13 21:20:06 ----RD---- C:\WINDOWS\ImmersiveControlPanel
2017-01-13 21:20:06 ----D---- C:\WINDOWS\system32\WinBioPlugIns
2017-01-13 21:20:06 ----D---- C:\WINDOWS\system32\wbem
2017-01-13 21:20:06 ----D---- C:\WINDOWS\system32\oobe
2017-01-13 21:20:06 ----D---- C:\WINDOWS\ShellExperiences
2017-01-13 21:20:06 ----D---- C:\WINDOWS\Provisioning
2017-01-13 21:20:06 ----D---- C:\Program Files\Internet Explorer
2017-01-13 21:20:06 ----D---- C:\Program Files (x86)\Internet Explorer
2017-01-13 21:20:05 ----D---- C:\WINDOWS\system32\drivers
2017-01-13 19:13:54 ----SHDC---- C:\WINDOWS\Installer
2017-01-12 21:29:58 ----RSD---- C:\WINDOWS\assembly
2017-01-12 21:27:05 ----D---- C:\ProgramData\Microsoft Help
2017-01-12 21:22:45 ----D---- C:\WINDOWS\system32\MRT
2017-01-12 21:13:06 ----AC---- C:\WINDOWS\system32\MRT.exe
2017-01-12 19:25:11 ----D---- C:\WINDOWS\Logs
2016-12-30 13:21:58 ----D---- C:\Users\NG\AppData\Roaming\Adobe
2016-12-30 13:12:21 ----D---- C:\ProgramData\regid.1986-12.com.adobe
2016-12-23 12:13:26 ----A---- C:\WINDOWS\SYSWOW64\FlashPlayerApp.exe
2016-12-23 00:34:32 ----HD---- C:\ProgramData
2016-12-20 17:51:41 ----D---- C:\ProgramData\Package Cache
2016-12-20 17:50:54 ----RD---- C:\Program Files (x86)
2016-12-17 13:09:20 ----D---- C:\WINDOWS\Tasks
2016-12-15 01:04:15 ----D---- C:\WINDOWS\SYSWOW64\en-US
2016-12-15 01:04:15 ----D---- C:\WINDOWS\system32\en-US
2016-12-15 01:04:15 ----D---- C:\WINDOWS\AppPatch
2016-12-15 01:04:14 ----D---- C:\WINDOWS\system32\Boot
2016-12-14 06:43:04 ----D---- C:\ProgramData\Adobe
2016-12-14 01:07:48 ----D---- C:\WINDOWS\SYSWOW64\oobe
2016-12-14 01:07:48 ----D---- C:\WINDOWS\SYSWOW64\Dism
2016-12-14 01:07:47 ----D---- C:\WINDOWS\system32\Sysprep
2016-12-14 01:07:47 ----D---- C:\WINDOWS\system32\sr-Latn-CS
2016-12-14 01:07:47 ----D---- C:\WINDOWS\system32\Dism
2016-12-14 01:07:47 ----D---- C:\WINDOWS\servicing
2016-12-14 01:07:46 ----D---- C:\WINDOWS\bcastdvr
2016-12-11 14:30:52 ----D---- C:\Program Files\Common Files\Adobe
2016-12-11 14:26:57 ----RD---- C:\Program Files
2016-12-11 14:21:45 ----AD---- C:\Program Files (x86)\Adobe
2016-12-10 03:36:48 ----A---- C:\WINDOWS\system32\enrollmentapi.dll
2016-12-08 02:09:28 ----D---- C:\Program Files\Elantech
2016-12-07 21:12:35 ----D---- C:\WINDOWS\system32\CatRoot
2016-12-06 19:36:02 ----AD---- C:\Program Files\Common Files\microsoft shared
2016-12-04 19:59:18 ----D---- C:\WINDOWS\system32\drivers\UMDF
2016-11-29 05:44:03 ----RSD---- C:\WINDOWS\Fonts
2016-11-29 05:43:58 ----D---- C:\Program Files\Common Files
2016-11-29 05:43:50 ----AD---- C:\ProgramData\regid.1991-06.com.microsoft
2016-11-29 05:43:38 ----D---- C:\Program Files (x86)\Microsoft.NET
2016-11-26 11:38:17 ----D---- C:\Program Files (x86)\Common Files
2016-11-22 22:47:36 ----D---- C:\Users\NG\AppData\Roaming\npm
2016-11-18 17:33:32 ----D---- C:\Games
2016-11-10 17:41:29 ----D---- C:\WINDOWS\SYSWOW64\migration
2016-11-10 17:41:24 ----D---- C:\WINDOWS\system32\migwiz
2016-11-10 17:41:24 ----D---- C:\WINDOWS\system32\migration
2016-11-03 20:51:06 ----D---- C:\Users\NG\AppData\Roaming\FileZilla
2016-10-29 17:59:47 ----HD---- C:\WINDOWS\msdownld.tmp
2016-10-29 16:13:06 ----D---- C:\WINDOWS\system32\WDI
2016-10-29 16:09:41 ----D---- C:\WINDOWS\system32\appraiser
2016-10-29 16:09:37 ----D---- C:\Program Files\Windows Media Player
2016-10-29 16:09:37 ----D---- C:\Program Files (x86)\Windows Media Player
2016-10-28 18:09:59 ----N---- C:\WINDOWS\system32\MpSigStub.exe
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 iaStorA;iaStorA; C:\WINDOWS\System32\drivers\iaStorA.sys [2014-04-02 633192]
R0 iorate;@%SystemRoot%\system32\drivers\iorate.sys,-100; C:\WINDOWS\system32\drivers\iorate.sys [2016-11-02 48992]
R1 ElbyCDIO;ElbyCDIO Driver; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [2013-03-05 40344]
R1 FileCrypt;@%systemroot%\system32\drivers\filecrypt.sys,-100; C:\WINDOWS\system32\drivers\filecrypt.sys [2016-07-17 88576]
R1 GpuEnergyDrv;@%SystemRoot%\system32\drivers\gpuenergydrv.sys,-100; C:\WINDOWS\System32\drivers\gpuenergydrv.sys [2016-07-17 8192]
R2 clreg;@%SystemRoot%\system32\drivers\registry.sys,-100; C:\WINDOWS\System32\drivers\registry.sys [2016-07-17 70144]
R2 MMCSS;@%systemroot%\system32\drivers\mmcss.sys,-100; C:\WINDOWS\system32\drivers\mmcss.sys [2016-07-17 48128]
R2 storqosflt;@%SystemRoot%\System32\drivers\storqosflt.sys,-101; C:\WINDOWS\system32\drivers\storqosflt.sys [2016-07-17 78336]
R3 acpials;@sensorsalsdriver.inf,%kbfiltr.SvcDesc%;ALS Sensor Filter; C:\WINDOWS\System32\drivers\acpials.sys [2016-07-17 11264]
R3 BthA2DP;@wdma_bt.inf,%BthA2DP.SvcDesc%;Bluetooth Stereo; C:\WINDOWS\system32\drivers\BthA2DP.sys [2016-10-24 168448]
R3 BthEnum;@bth.inf,%BthEnum.SVCDESC%;Bluetooth Enumerator Service; C:\WINDOWS\System32\drivers\BthEnum.sys [2016-10-24 114176]
R3 BthHFAud;@wdma_bt.inf,%DISPLAY_NAME%;Bluetooth Hands-Free; C:\WINDOWS\system32\DRIVERS\BthHfAud.sys [2016-07-17 37376]
R3 BthLEEnum;@BthLEEnum.inf,%BthLEEnum.SVCDESC%;Bluetooth Low Energy Driver; C:\WINDOWS\system32\DRIVERS\BthLEEnum.sys [2016-10-24 249856]
R3 BthPan;@bthpan.inf,%BthPan.DisplayName%;Bluetooth Device (Personal Area Network); C:\WINDOWS\System32\drivers\bthpan.sys [2016-10-24 128512]
R3 BTHUSB;@bth.inf,%BTHUSB.SvcDesc%;Bluetooth Radio USB Driver; C:\WINDOWS\System32\drivers\BTHUSB.sys [2016-10-24 84992]
R3 ETD;@oem24.inf,%PS2DeviceDesc%;ELAN PS/2 Port Input Device; C:\WINDOWS\system32\DRIVERS\ETD.sys [2016-11-11 589392]
R3 ETDSMBus;ETDSMBus; C:\WINDOWS\system32\DRIVERS\ETDSMBus.sys [2015-09-23 32328]
R3 ibtusb;@oem2.inf,%ibtusb.SVCDESC_IBT%;Intel(R) Wireless Bluetooth(R); C:\WINDOWS\system32\DRIVERS\ibtusb.sys [2016-05-26 345872]
R3 igfx;igfx; C:\WINDOWS\system32\DRIVERS\igdkmd64.sys [2016-07-20 7949952]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RTKVHD64.sys [2015-09-23 4519144]
R3 ISCT;@oem29.inf,%ISCT.DeviceDesc%;Intel(R) Smart Connect Technology Device Driver; C:\WINDOWS\System32\drivers\ISCTD64.sys [2013-07-31 47008]
R3 iwdbus;@oem59.inf,%iwdbus.SVCDESC%;IWD Bus Enumerator; C:\WINDOWS\System32\drivers\iwdbus.sys [2014-05-07 27032]
R3 MEIx64;@oem54.inf,%TEE_SvcDesc%;Intel(R) Management Engine Interface ; C:\WINDOWS\System32\drivers\TeeDriverW8x64.sys [2015-06-12 183584]
R3 NETwNb64;___ Intel(R) Wireless Adapter Driver for Windows 8.1 - 64 Bit; C:\WINDOWS\System32\drivers\Netwbw02.sys [2016-07-17 3485696]
R3 RadioHIDMini;@oem23.inf,%RadioHIDMini%;Radio HID Mini-driver; C:\WINDOWS\System32\drivers\RadioHIDMini.sys [2012-07-28 23408]
R3 RFCOMM;@tdibth.inf,%RFCOMM.DisplayName%;Bluetooth Device (RFCOMM Protocol TDI); C:\WINDOWS\System32\drivers\rfcomm.sys [2016-07-17 183808]
R3 rt640x64;@oem60.inf,%rt640.Service.DispName%;Realtek RT640 NT Driver; C:\WINDOWS\System32\drivers\rt640x64.sys [2015-06-23 895256]
R3 SensorsAlsDriver;@sensorsalsdriver.inf,%WudfSensorsAlsDriverDisplayName%;UMDF Reflector service for SensorsAlsDriver; C:\WINDOWS\System32\drivers\WUDFRd.sys [2016-07-17 216064]
S0 LSI_SAS2i;LSI_SAS2i; C:\WINDOWS\System32\drivers\lsi_sas2i.sys [2016-07-17 105824]
S0 LSI_SAS3i;LSI_SAS3i; C:\WINDOWS\System32\drivers\lsi_sas3i.sys [2016-07-17 101216]
S0 megasas2i;megasas2i; C:\WINDOWS\System32\drivers\MegaSas2i.sys [2016-10-24 64352]
S0 percsas2i;percsas2i; C:\WINDOWS\System32\drivers\percsas2i.sys [2016-07-17 58720]
S0 percsas3i;percsas3i; C:\WINDOWS\System32\drivers\percsas3i.sys [2016-07-17 61792]
S0 scmbus;@scmbus.inf,%scmbus.SvcDesc%;Microsoft Storage Class Memory Bus Driver; C:\WINDOWS\System32\drivers\scmbus.sys [2016-07-17 88416]
S0 storufs;@storufs.inf,%UfsServiceDesc%;Microsoft Universal Flash Storage (UFS) Driver; C:\WINDOWS\System32\drivers\storufs.sys [2016-07-17 32096]
S3 AcpiDev;@acpidev.inf,%AcpiDev.SvcDesc%;ACPI Devices driver; C:\WINDOWS\System32\drivers\AcpiDev.sys [2016-07-17 18432]
S3 acsock;acsock; C:\WINDOWS\system32\DRIVERS\acsock64.sys [2016-03-25 211808]
S3 AMPPAL;Intel(r) Centrino(r) Wireless Bluetooth(r) + High Speed Virtual Adapter; C:\WINDOWS\System32\drivers\AMPPAL.sys [2013-07-29 165344]
S3 applockerfltr;@%systemroot%\system32\srpapi.dll,-102; C:\WINDOWS\system32\drivers\applockerfltr.sys [2016-07-17 15360]
S3 bcmfn;@bcmfn.inf,%bcmfn.SVCDESC%;bcmfn Service; C:\WINDOWS\System32\drivers\bcmfn.sys [2016-07-17 9728]
S3 BTHPORT;@bth.inf,%BTHPORT.SvcDesc%;Bluetooth Port Driver; C:\WINDOWS\System32\drivers\BTHport.sys [2016-11-11 967168]
S3 buttonconverter;@buttonconverter.inf,%btnconv.SvcDesc%;Service for Portable Device Control devices; C:\WINDOWS\System32\drivers\buttonconverter.sys [2016-07-17 38912]
S3 CapImg;@capimg.inf,%CapImgHid_Service%;HID driver for CapImg touch screen; C:\WINDOWS\System32\drivers\capimg.sys [2016-09-11 118272]
S3 genericusbfn;@genericusbfn.inf,%genericusbfn.ServiceName%;Generic USB Function Class; C:\WINDOWS\System32\drivers\genericusbfn.sys [2016-07-17 20480]
S3 hidinterrupt;@hidinterrupt.inf,%HID_Interrupt.SvcDesc%;Common Driver for HID Buttons implemented with interrupts; C:\WINDOWS\System32\drivers\hidinterrupt.sys [2016-07-17 50016]
S3 hvservice;@%SystemRoot%\system32\drivers\hvservice.sys,-16; C:\WINDOWS\system32\drivers\hvservice.sys [2016-10-24 73568]
S3 cht4iscsi;cht4iscsi; C:\WINDOWS\System32\drivers\cht4sx64.sys [2016-07-17 346976]
S3 cht4vbd;@cht4vx64.inf,%cht4vbd.generic%;Chelsio Virtual Bus Driver; C:\WINDOWS\System32\drivers\cht4vx64.sys [2016-07-17 2104160]
S3 iagpio;@iagpio.inf,%iagpio.SVCDESC%;Intel Serial IO GPIO Controller Driver; C:\WINDOWS\System32\drivers\iagpio.sys [2016-07-17 33280]
S3 iai2c;@iai2c.inf,%iai2c.SVCDESC%;Intel(R) Serial IO I2C Host Controller; C:\WINDOWS\System32\drivers\iai2c.sys [2016-07-17 81408]
S3 iaLPSS2i_GPIO2;@iaLPSS2i_GPIO2_SKL.inf,%iaLPSS2i_GPIO2.SVCDESC%;Intel(R) Serial IO GPIO Driver v2; C:\WINDOWS\System32\drivers\iaLPSS2i_GPIO2.sys [2016-07-17 64512]
S3 iaLPSS2i_I2C;@iaLPSS2i_I2C_SKL.inf,%iaLPSS2i_I2C.SVCDESC%;Intel(R) Serial IO I2C Driver v2; C:\WINDOWS\System32\drivers\iaLPSS2i_I2C.sys [2016-07-17 176384]
S3 ibbus;@mlx4_bus.inf,%Ibbus.ServiceDesc%;Mellanox InfiniBand Bus/AL (Filter Driver); C:\WINDOWS\System32\drivers\ibbus.sys [2016-07-17 526176]
S3 IndirectKmd;@%SystemRoot%\system32\drivers\IndirectKmd.sys,-100; C:\WINDOWS\System32\drivers\IndirectKmd.sys [2016-07-17 35840]
S3 INETMON;INETMON; \??\C:\windows\System32\Drivers\INETMON.sys [2013-08-08 29088]
S3 intaud_WaveExtensible;Intel WiDi Audio Device; C:\WINDOWS\system32\drivers\intelaud.sys [2014-05-07 38296]
S3 IntcDAud;@oem66.inf,%IntcDAud.SvcDesc%;Intel(R) Display Audio; C:\WINDOWS\system32\DRIVERS\IntcDAud.sys [2016-07-15 481768]
S3 irda;IrDA; C:\WINDOWS\system32\drivers\irda.sys [2016-07-17 120320]
S3 mlx4_bus;@mlx4_bus.inf,%MLX4BUS.ServiceDesc%;Mellanox ConnectX Bus Enumerator; C:\WINDOWS\System32\drivers\mlx4_bus.sys [2016-07-17 842584]
S3 ndfltr;@mlx4_bus.inf,%ndfltr.ServiceDesc%;NetworkDirect Service; C:\WINDOWS\System32\drivers\ndfltr.sys [2016-07-17 108896]
S3 NetAdapterCx;Network Adapter Wdf Class Extension Library; C:\WINDOWS\system32\drivers\NetAdapterCx.sys [2016-07-17 90624]
S3 ReFSv1;ReFSv1; C:\WINDOWS\system32\drivers\ReFSv1.sys [2016-07-17 928608]
S3 scmdisk0101;@scmdisk0101.inf,%scmdisk0101.SvcDesc%;Microsoft NVDIMM-N disk driver; C:\WINDOWS\System32\drivers\scmdisk0101.sys [2016-07-17 123904]
S3 tap0901;@oem9.inf,%DeviceDescription%;TAP-Windows Adapter V9; C:\WINDOWS\System32\drivers\tap0901.sys [2013-08-23 40664]
S3 UcmCx0101;USB Connector Manager KMDF Class Extension; C:\WINDOWS\System32\Drivers\UcmCx.sys [2016-07-17 95744]
S3 UcmTcpciCx0101;UCM-TCPCI KMDF Class Extension; C:\WINDOWS\System32\Drivers\UcmTcpciCx.sys [2016-07-17 108544]
S3 UcmUcsi;@UcmUcsi.inf,%UcmUcsi.ServiceName%;USB Connector Manager UCSI Client; C:\WINDOWS\System32\drivers\UcmUcsi.sys [2016-07-17 50688]
S3 UdeCx;USB Device Emulation Support Library; C:\WINDOWS\system32\drivers\udecx.sys [2016-07-17 45568]
S3 Ufx01000;USB Function Class Extension; C:\WINDOWS\system32\drivers\ufx01000.sys [2016-07-17 263008]
S3 UfxChipidea;@ufxchipidea.inf,%UfxChipidea.ServiceName%;USB Chipidea Controller; C:\WINDOWS\System32\drivers\UfxChipidea.sys [2016-07-17 96608]
S3 ufxsynopsys;@ufxsynopsys.inf,%ufxsynopsys.ServiceName%;USB Synopsys Controller; C:\WINDOWS\System32\drivers\ufxsynopsys.sys [2016-07-17 137056]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 CDPSvc;@%SystemRoot%\system32\cdpsvc.dll,-100; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
R2 CDPUserSvc_10b8dc39;CDPUserSvc_10b8dc39; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
R2 CoreMessagingRegistrar;@%SystemRoot%\system32\coremessaging.dll,-1; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
R2 DiagTrack;@%SystemRoot%\system32\diagtrack.dll,-3001; C:\WINDOWS\System32\svchost.exe [2016-07-17 44496]
R2 ETDService;Elan Service; C:\Program Files\Elantech\ETDService.exe [2016-11-11 129752]
R2 iBTAudioSrv;Intel(R) Wireless Bluetooth(R) Audio Service; C:\Program Files (x86)\Intel\HPWA\iBTAudioSrv.exe [2014-07-25 573384]
R2 ibtsiva;@oem2.inf,%SERVICE_NAME%;Intel Bluetooth Service; C:\WINDOWS\system32\ibtsiva []
R2 igfxCUIService2.0.0.0;Intel(R) HD Graphics Control Panel Service; C:\WINDOWS\system32\igfxCUIService.exe [2016-07-20 365728]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2015-06-24 223008]
R2 OneSyncSvc_10b8dc39;Sync Host_10b8dc39; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
R2 SamsungSystemConfiguration;SamsungSystemConfiguration; C:\ProgramData\Samsung\SamsungSystemConfiguration\SamsungSystemConfiguration.exe [2014-03-19 23872]
R2 tiledatamodelsvc;@%SystemRoot%\system32\tileobjserver.dll,-1; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
R3 BthHFSrv;@%SystemRoot%\System32\BthHFSrv.dll,-103; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
R3 ClipSVC;@%SystemRoot%\system32\ClipSVC.dll,-103; C:\WINDOWS\System32\svchost.exe [2016-07-17 44496]
R3 diagnosticshub.standardcollector.service;@%SystemRoot%\system32\DiagSvcs\DiagnosticsHub.StandardCollector.ServiceRes.dll,-1000; C:\WINDOWS\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe [2016-07-17 93184]
R3 DsSvc;@%SystemRoot%\system32\dssvc.dll,-10003; C:\WINDOWS\System32\svchost.exe [2016-07-17 44496]
R3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\WINDOWS\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [2016-05-26 43696]
R3 LicenseManager;@%SystemRoot%\system32\licensemanagersvc.dll,-200; C:\WINDOWS\System32\svchost.exe [2016-07-17 44496]
R3 PimIndexMaintenanceSvc_10b8dc39;Contact Data_10b8dc39; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
R3 RmSvc;@%SystemRoot%\system32\RMapi.dll,-1001; C:\WINDOWS\System32\svchost.exe [2016-07-17 44496]
R3 StateRepository;@%SystemRoot%\system32\windows.staterepository.dll,-1; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
R3 TimeBrokerSvc;@%windir%\system32\TimeBrokerServer.dll,-1001; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
R4 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2016-12-19 82640]
R4 AdobeUpdateService;AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [2016-10-12 744640]
R4 AGSService;Adobe Genuine Software Integrity Service; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2016-12-13 2218712]
R4 GoProDeviceDetectionService;GoPro Device Detection Service; D:\Apps\QuikGoPro\GoPro Desktop App\GoProDeviceDetection.exe [2016-12-02 37808]
R4 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2016-11-21 76152]
R4 postgresql-x64-9.3;postgresql-x64-9.3 - PostgreSQL Server 9.3; D:\Apps\Postgres\bin\pg_ctl.exe [2014-10-20 89088]
R4 Settings Launcher;Settings Launcher; C:\Program Files (x86)\Samsung\Settings\CmdServer\SettingsLauncher.exe [2015-06-24 1594176]
R4 SWUpdateService;SW Update Service; C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe [2016-10-04 3296104]
S2 CDPUserSvc;@%SystemRoot%\system32\cdpusersvc.dll,-100; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S2 DoSvc;@%systemroot%\system32\dosvc.dll,-100; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28 144200]
S2 MapsBroker;@%SystemRoot%\System32\moshost.dll,-100; C:\WINDOWS\System32\svchost.exe [2016-07-17 44496]
S2 Net Driver HPZ12;Net Driver HPZ12; C:\windows\System32\svchost.exe [2016-07-17 44496]
S2 OneSyncSvc;@%SystemRoot%\system32\APHostRes.dll,-10002; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\windows\System32\svchost.exe [2016-07-17 44496]
S2 SkypeUpdate;Skype Updater; D:\Apps\Skype\Updater\Updater.exe [2016-03-23 327808]
S3 AJRouter;@%SystemRoot%\system32\AJRouter.dll,-2; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S3 cphs;Intel(R) Content Protection HECI Service; C:\WINDOWS\SysWow64\IntelCpHeciSvc.exe [2016-07-20 293536]
S3 DcpSvc;@%SystemRoot%\system32\dcpsvc.dll,-3001; C:\WINDOWS\System32\svchost.exe [2016-07-17 44496]
S3 DevQueryBroker;@%SystemRoot%\system32\DevQueryBroker.dll,-100; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S3 DmEnrollmentSvc;@%systemroot%\system32\Windows.Internal.Management.dll,-100; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S3 dmwappushservice;@%SystemRoot%\system32\dmwappushsvc.dll,-200; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S3 embeddedmode;@%SystemRoot%\system32\embeddedmodesvc.dll,-201; C:\WINDOWS\System32\svchost.exe [2016-07-17 44496]
S3 EntAppSvc;@EnterpriseAppMgmtSvc.dll,-1; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S3 FrameServer;@%systemroot%\system32\FrameServer.dll,-100; C:\WINDOWS\System32\svchost.exe [2016-07-17 44496]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28 144200]
S3 HvHost;@%SystemRoot%\system32\hvhostsvc.dll,-100; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S3 icssvc;@%SystemRoot%\System32\tetheringservice.dll,-4097; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [2015-05-22 881152]
S3 irmon;@%SystemRoot%\System32\irmon.dll,-2000; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S3 iumsvc;Intel(R) Update Manager; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2016-08-12 177376]
S3 MessagingService;@%SystemRoot%\system32\MessagingService.dll,-100; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S3 MessagingService_10b8dc39;MessagingService_10b8dc39; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S3 NetSetupSvc;@%SystemRoot%\system32\NetSetupSvc.dll,-3; C:\WINDOWS\System32\svchost.exe [2016-07-17 44496]
S3 NgcCtnrSvc;@%SystemRoot%\System32\NgcCtnrSvc.dll,-1; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S3 NgcSvc;@%SystemRoot%\System32\ngcsvc.dll,-100; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S3 ose64;Office 64 Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2014-01-23 178760]
S3 PhoneSvc;@%SystemRoot%\system32\PhoneserviceRes.dll,-10000; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S3 PimIndexMaintenanceSvc;@%SystemRoot%\system32\UserDataAccessRes.dll,-15001; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S3 RetailDemo;@%SystemRoot%\System32\RDXService.dll,-256; C:\WINDOWS\System32\svchost.exe [2016-07-17 44496]
S3 SensorDataService;@%SystemRoot%\system32\SensorDataService.exe,-101; C:\WINDOWS\System32\SensorDataService.exe [2016-10-24 1312768]
S3 SensorService;@%SystemRoot%\System32\sensorservice.dll,-1000; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S3 SmsRouter;@%SystemRoot%\System32\SmsRouterSvc.dll,-10001; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
S3 TieringEngineService;@%SystemRoot%\system32\TieringEngineService.exe,-702; C:\WINDOWS\system32\TieringEngineService.exe [2016-07-17 287744]
S4 shpamsvc;@%SystemRoot%\System32\Windows.SharedPC.AccountManager.dll,-100; C:\WINDOWS\System32\svchost.exe [2016-07-17 44496]
S4 tzautoupdate;@%SystemRoot%\system32\tzautoupdate.dll,-200; C:\WINDOWS\system32\svchost.exe [2016-07-17 44496]
-----------------EOF-----------------
Re: HOSTS soubor s cizími adresami (AdClick virus?)
PS: Překopírovat (CTRL C -> CTRL V) první 4 řádky mého 2. příspěvku jsem musel manuálně (přenesl se vždy jen první řádek a zbytek logu se uřezal). Od části 'Mozilla Firefox' bez problémů.
-
Rudy
- Site Admin
- Příspěvky: 119671
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: HOSTS soubor s cizími adresami (AdClick virus?)
Spusťte tuto utilitu:
Stáhněte AdwCleaner https://toolslib.net/downloads/viewdown ... dwcleaner/
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve na >Scan<(hledání) a pak na >Clean< (mazání).
Proběhne skenováni a pak se objeví log, který sem vložte.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Re: HOSTS soubor s cizími adresami (AdClick virus?)
# AdwCleaner v6.042 - Logfile created 27/01/2017 at 06:48:33
# Updated on 06/01/2017 by Malwarebytes
# Database : 2017-01-26.1 [Server]
# Operating System : Windows 10 Home (X64)
# Username : NG - NG-NTB
# Running from : C:\Users\NG\Downloads\adwcleaner_6.042.exe
# Mode: Clean
# Support : https://www.malwarebytes.com/support
***** [ Services ] *****
***** [ Folders ] *****
[-] Folder deleted: C:\Users\NG\AppData\Local\Google\Chrome\User Data\Default\Extensions\chklaanhfefbnpoihckbnefhakgolnmc
[-] Folder deleted: C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\chklaanhfefbnpoihckbnefhakgolnmc
***** [ Files ] *****
[-] File deleted: C:\END
[-] File deleted: C:\Users\NG\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_chklaanhfefbnpoihckbnefhakgolnmc_0.localstorage
[-] File deleted: C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Local Storage\chrome-extension_chklaanhfefbnpoihckbnefhakgolnmc_0.localstorage
[-] File deleted: C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Local Storage\hxxp_st.chatango.com_0.localstorage
[-] File deleted: C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Local Storage\hxxp_st.chatango.com_0.localstorage-journal
***** [ DLL ] *****
***** [ WMI ] *****
***** [ Shortcuts ] *****
***** [ Scheduled Tasks ] *****
***** [ Registry ] *****
[-] Key deleted: HKLM\SOFTWARE\MPC
***** [ Web browsers ] *****
[-] [C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Web data] [Search Provider] Deleted: key-remapper.en.softonic.com
[-] [C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Web data] [Search Provider] Deleted: keymapper.en.softonic.com
[-] [C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Web data] [Search Provider] Deleted: ceskedalnice.cz
[-] [C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Web data] [Search Provider] Deleted: stanice-cng.cz
[-] [C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Web data] [Search Provider] Deleted: utorrent.en.softonic.com
[-] [C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Web data] [Search Provider] Deleted: safari.en.softonic.com
[-] [C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1] [extension] Deleted: chklaanhfefbnpoihckbnefhakgolnmc
*************************
:: "Tracing" keys deleted
:: Winsock settings cleared
*************************
C:\AdwCleaner\AdwCleaner[C0].txt - [2507 Bytes] - [27/01/2017 06:48:33]
C:\AdwCleaner\AdwCleaner[S0].txt - [2678 Bytes] - [27/01/2017 06:48:08]
########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [2653 Bytes] ##########
# Updated on 06/01/2017 by Malwarebytes
# Database : 2017-01-26.1 [Server]
# Operating System : Windows 10 Home (X64)
# Username : NG - NG-NTB
# Running from : C:\Users\NG\Downloads\adwcleaner_6.042.exe
# Mode: Clean
# Support : https://www.malwarebytes.com/support
***** [ Services ] *****
***** [ Folders ] *****
[-] Folder deleted: C:\Users\NG\AppData\Local\Google\Chrome\User Data\Default\Extensions\chklaanhfefbnpoihckbnefhakgolnmc
[-] Folder deleted: C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\chklaanhfefbnpoihckbnefhakgolnmc
***** [ Files ] *****
[-] File deleted: C:\END
[-] File deleted: C:\Users\NG\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_chklaanhfefbnpoihckbnefhakgolnmc_0.localstorage
[-] File deleted: C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Local Storage\chrome-extension_chklaanhfefbnpoihckbnefhakgolnmc_0.localstorage
[-] File deleted: C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Local Storage\hxxp_st.chatango.com_0.localstorage
[-] File deleted: C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Local Storage\hxxp_st.chatango.com_0.localstorage-journal
***** [ DLL ] *****
***** [ WMI ] *****
***** [ Shortcuts ] *****
***** [ Scheduled Tasks ] *****
***** [ Registry ] *****
[-] Key deleted: HKLM\SOFTWARE\MPC
***** [ Web browsers ] *****
[-] [C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Web data] [Search Provider] Deleted: key-remapper.en.softonic.com
[-] [C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Web data] [Search Provider] Deleted: keymapper.en.softonic.com
[-] [C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Web data] [Search Provider] Deleted: ceskedalnice.cz
[-] [C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Web data] [Search Provider] Deleted: stanice-cng.cz
[-] [C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Web data] [Search Provider] Deleted: utorrent.en.softonic.com
[-] [C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Web data] [Search Provider] Deleted: safari.en.softonic.com
[-] [C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1] [extension] Deleted: chklaanhfefbnpoihckbnefhakgolnmc
*************************
:: "Tracing" keys deleted
:: Winsock settings cleared
*************************
C:\AdwCleaner\AdwCleaner[C0].txt - [2507 Bytes] - [27/01/2017 06:48:33]
C:\AdwCleaner\AdwCleaner[S0].txt - [2678 Bytes] - [27/01/2017 06:48:08]
########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [2653 Bytes] ##########
-
Rudy
- Site Admin
- Příspěvky: 119671
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: HOSTS soubor s cizími adresami (AdClick virus?)
Teď dejte log FRST: http://forum.viry.cz/viewtopic.php?f=13&t=133100 .
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Re: HOSTS soubor s cizími adresami (AdClick virus?)
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-01-2017
Ran by NG (03-02-2017 19:18:35)
Running from C:\Users\NG\Downloads
Windows 10 Home Version 1607 (X64) (2016-10-22 20:03:49)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-1341208516-2984071467-593012157-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1341208516-2984071467-593012157-503 - Limited - Disabled)
Guest (S-1-5-21-1341208516-2984071467-593012157-501 - Limited - Disabled)
NG (S-1-5-21-1341208516-2984071467-593012157-1001 - Administrator - Enabled) => C:\Users\NG
Visitor (S-1-5-21-1341208516-2984071467-593012157-1002 - Limited - Enabled) => C:\Users\Visitor
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
µTorrent (HKU\S-1-5-21-1341208516-2984071467-593012157-1001\...\uTorrent) (Version: 3.4.9.43085 - BitTorrent Inc.)
64 Bit HP CIO Components Installer (Version: 7.2.4 - Hewlett-Packard) Hidden
Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 3.9.0.327 - Adobe Systems Incorporated)
Adobe Flash Player 19 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 19.0.0.226 - Adobe Systems Incorporated)
Adobe Illustrator CC (HKLM-x32\...\{F2321021-08A2-44D6-B1DF-BDB415F23EC3}) (Version: 17.0 - Adobe Systems Incorporated)
Adobe Lightroom (HKLM-x32\...\{8048A5DF-8A70-5BE1-954B-E0FDE1BD0D0D}) (Version: 6.7 - Adobe Systems Incorporated)
Adobe Photoshop CC 2014 (HKLM-x32\...\{D7A4F897-B20A-42D0-862D-CB5F6DB7391D}) (Version: 15.0 - Adobe Systems Incorporated)
Adobe Premiere Pro CC 2017 (HKLM-x32\...\PPRO_11_0_0) (Version: 11.0.0 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.19) - Czech (HKLM-x32\...\{AC76BA86-7AD7-1029-7B44-AB0000000001}) (Version: 11.0.19 - Adobe Systems Incorporated)
Aplikace Intel(R) Wireless Bluetooth(R) Audio (HKLM-x32\...\{DFDA116C-E4DE-4AC5-A115-C5BB6FC9799E}) (Version: 17.0.1430.01 - Intel Corporation)
Aplikace Intel(R) Wireless Bluetooth(R)(patch version 17.1.1431.1) (HKLM\...\{302600C1-6BDF-4FD1-1407-148929CC1385}) (Version: 17.1.1407.0480 - Intel Corporation)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
BS.Player FREE (HKLM-x32\...\BSPlayerf) (Version: 2.68.1077 - AB Team, d.o.o.)
CCleaner (HKLM\...\CCleaner) (Version: 5.22 - Piriform)
Composer - Php Dependency Manager (HKLM-x32\...\{7315AF68-E777-496A-A6A2-4763A98ED35A}_is1) (Version: - getcomposer.org)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version: - Valve)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dark Souls 2 (HKLM-x32\...\RGFya1NvdWxzMg==_is1) (Version: 1 - )
Dropbox (HKU\S-1-5-21-1341208516-2984071467-593012157-1001\...\Dropbox) (Version: 18.4.32 - Dropbox, Inc.)
ELAN Touchpad driver X64 15.7.9.2_WHQL (HKLM\...\Elantech) (Version: 15.7.9.2 - ELAN Microelectronic Corp.)
Evernote v. 5.9.6 (HKLM-x32\...\{A542D366-9877-11E5-B101-005056951CAD}) (Version: 5.9.6.9494 - Evernote Corp.)
f.lux (HKU\S-1-5-21-1341208516-2984071467-593012157-1001\...\Flux) (Version: - )
FileZilla Client 3.22.1 (HKLM-x32\...\FileZilla Client) (Version: 3.22.1 - Tim Kosse)
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Git version 2.10.0 (HKLM\...\Git_is1) (Version: 2.10.0 - The Git Development Community)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 57.0.2987.21 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.32.7 - Google Inc.) Hidden
GoPro Studio (x32 Version: 5.10.4643 - GoPro, Inc.) Hidden
Hearthstone (HKLM-x32\...\Hearthstone) (Version: - Blizzard Entertainment)
INSIDE.Build.2016-ALI213 version 1.0 (HKLM-x32\...\{DEAC15B9-1A51-4974-8293-4B65D36DE2BB}}_is1) (Version: 1.0 - Ali213.net)
Intel(R) Experience Center Desktop Software (HKLM-x32\...\{85de612b-ee05-476a-87cc-52e5740de420}) (Version: 1.9.0.8 - Intel)
Intel(R) Chipset Device Software (x32 Version: 10.1.1.8 - Intel(R) Corporation) Hidden
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.0.0.1153 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.4549 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.9.3.1000 - Intel Corporation)
Intel(R) Update Manager (HKLM-x32\...\{7224B7CE-196C-4E2A-A1AE-1D7BF259FD36}) (Version: 3.4.1942 - Intel Corporation)
Intel(R) Wireless Bluetooth(R) (HKLM-x32\...\{97F4CEAE-8F2B-4012-93CC-75428373214D}) (Version: 19.00.1621.3340 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{313c06de-4aa7-4a1f-930a-f10f80380426}) (Version: 17.14.0 - Intel Corporation)
Java 8 Update 51 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418051F0}) (Version: 8.0.510 - Oracle Corporation)
Java 8 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218051F0}) (Version: 8.0.510 - Oracle Corporation)
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1341208516-2984071467-593012157-1001\...\OneDriveSetup.exe) (Version: 17.3.6743.1212 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50901.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 ENU (HKLM-x32\...\{3A9FC03D-C685-4831-94CF-4EDFD3749497}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 x64 ENU (HKLM\...\{D4AD39AD-091E-4D33-BB2B-59F6FCB8ADC3}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 Redistributable - x86 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23918 (HKLM-x32\...\{dab68466-3a7d-41a8-a5cf-415e3ff8ef71}) (Version: 14.0.23918.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23918 (HKLM-x32\...\{2e085fd2-a3e4-4b39-8e10-6b8d35f55244}) (Version: 14.0.23918.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio Code (HKLM-x32\...\{F8A2A208-72B3-4D61-95FC-8A65D340689B}_is1) (Version: 1.8.1 - Microsoft Corporation)
Mindjet 14 (HKLM-x32\...\{5C1060A2-462B-4883-A26A-065EEF6E35DF}) (Version: 14.0.334 - Mindjet)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 49.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 49.0.1 (x86 en-US)) (Version: 49.0.1 - Mozilla)
Mozilla Thunderbird 38.1.0 (x86 en-US) (HKLM-x32\...\Mozilla Thunderbird 38.1.0 (x86 en-US)) (Version: 38.1.0 - Mozilla)
N-Com wizard (HKLM-x32\...\{3EBC6CA5-5C4D-4C76-B1FC-71C2A6B8F694}) (Version: 2.3 - Nolangroup S.p.A.)
Node.js (HKLM-x32\...\{B97F7A50-A386-4556-AB1B-7D81EE6AC7D7}) (Version: 5.3.0 - Node.js Foundation)
NVIDIA PhysX (HKLM-x32\...\{DA909E62-3B45-4BA1-8B58-FCAEBA4BCEC9}) (Version: 9.12.0213 - NVIDIA Corporation)
OpenAL (HKLM-x32\...\OpenAL) (Version: - )
OpenOffice 4.1.1 (HKLM-x32\...\{86F2B095-3998-41D5-833D-1C5075300950}) (Version: 4.11.9775 - Apache Software Foundation)
Opera Stable 42.0.2393.517 (HKLM-x32\...\Opera 42.0.2393.517) (Version: 42.0.2393.517 - Opera Software)
Oracle VM VirtualBox 5.0.16 (HKLM\...\{F2E958A1-9215-4C7D-9A2E-F0740B8CA5B7}) (Version: 5.0.16 - Oracle Corporation)
Outils de vérification linguistique 2013 de Microsoft Office - Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
PDF Settings CC (x32 Version: 12.0 - Adobe Systems Incorporated) Hidden
PostgreSQL 9.3 (HKLM\...\PostgreSQL 9.3) (Version: 9.3 - PostgreSQL Global Development Group)
ProxyGate version 3.0.0.1176 (HKU\S-1-5-21-1341208516-2984071467-593012157-1001\...\{1EC095EE-8CA3-43D6-B9F5-0C55B82ED3D7}}_is1) (Version: 3.0.0.1176 - Gold Click Ltd) <==== ATTENTION
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Quik (HKLM-x32\...\{71fc4e33-8ac1-4b21-8cb5-040ce8986c4e}) (Version: 2.0.0.4643 - GoPro, Inc.)
Quik (Version: 0.1.4643 - GoPro, Inc.) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.1.505.2015 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7543 - Realtek Semiconductor Corp.)
Rockstar Games Social Club (HKLM-x32\...\Rockstar Games Social Club) (Version: 1.1.0.6 - Rockstar Games)
S Agent (Version: 1.1.58 - Samsung Electronics Co., Ltd.) Hidden
Safari (HKLM-x32\...\{C779648B-410E-4BBA-B75B-5815BCEFE71D}) (Version: 5.34.57.2 - Apple Inc.)
Samsung Settings (HKLM-x32\...\{3BB58176-B3A7-47FD-9F18-C3576431D193}) (Version: 2.2.0 - Samsung Electronics CO., LTD.)
Samsung Update (HKLM-x32\...\{006DD65B-ECE1-4E73-9EBD-E7051F5E31FD}) (Version: 2.2.42 - Samsung Electronics Co., Ltd.)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version: - Microsoft)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version: - Microsoft) Hidden
Shark007 Standard Codecs (HKLM-x32\...\{898E81AD-6DB9-4750-866B-B8958C5DC7AA}) (Version: 2.2.5 - Shark007)
SharpKeys (HKLM-x32\...\{636E94DA-99C0-448F-A931-3DAD83B4975F}) (Version: 3.5.0000 - RandyRants.com)
Skype™ 7.22 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.22.109 - Skype Technologies S.A.)
SRS Premium Sound (HKLM-x32\...\{E44F8A34-529E-4318-A0E1-1893C337A47F}) (Version: 1.00.4700 - DTS, Inc.)
StarCraft II (HKLM-x32\...\StarCraft II) (Version: - Blizzard Entertainment)
Stellaris (HKLM-x32\...\Stellaris_is1) (Version: - )
Support Center FAQ (x32 Version: 1.0.11 - Samsung Electronics CO., LTD.) Hidden
Tyranny (HKLM-x32\...\1266051739_is1) (Version: 2.0.0.1 - GOG.com)
Update for Skype for Business 2015 (KB3039776) 64-Bit Edition (HKLM\...\{90150000-012B-0409-1000-0000000FF1CE}_Office15.PROPLUS_{0FA8AE0C-69AE-4F60-A1AB-F79C6BA5A999}) (Version: - Microsoft)
Update for Skype for Business 2015 (KB3141468) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{CB85A0CF-0448-43D8-8006-173A8C84A018}) (Version: - Microsoft)
Update for Skype for Business 2015 (KB3141468) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUS_{CB85A0CF-0448-43D8-8006-173A8C84A018}) (Version: - Microsoft)
Update for Skype for Business 2015 (KB3141468) 64-Bit Edition (HKLM\...\{90150000-012B-0409-1000-0000000FF1CE}_Office15.PROPLUS_{CB85A0CF-0448-43D8-8006-173A8C84A018}) (Version: - Microsoft)
Vegas Pro 13.0 (64-bit) (HKLM\...\{3814DB30-091D-11E4-BDE0-F04DA23A5C58}) (Version: 13.0.373 - Sony)
VFW_Codec32 (x32 Version: 0.1.160.0 - GoPro, Inc.) Hidden
VFW_Codec64 (Version: 0.1.160.0 - GoPro, Inc.) Hidden
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version: 5.4.7.0 - Elaborate Bytes)
WampServer 2.5 (HKLM-x32\...\WampServer 2_is1) (Version: - Hervé Leclerc (HeL))
Windows Driver Package - Cambridge Silicon Radio Ltd. (CSRBC) USB (07/01/2016 2.5.2.3) (HKLM\...\F6E7FAEC5C1773411DCE89B345BDAEEA407C921B) (Version: 07/01/2016 2.5.2.3 - Cambridge Silicon Radio Ltd.)
Windows Driver Package - GoPro (WinUSB) Universal Serial Bus devices (03/07/2012 ) (HKLM\...\0B624A43DD66DBF5CF3EDFA9741A364E688062A4) (Version: 03/07/2012 - GoPro)
Windows Driver Package - Samsung Electronics Co. Ltd. (RadioHIDMini) HIDClass (08/23/2013 6.2.8400.4218) (HKLM\...\26BFE384C802803107F583AE1A739E4FEB56134B) (Version: 08/23/2013 6.2.8400.4218 - Samsung Electronics Co. Ltd.)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
WinRAR 5.20 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH)
x64Components v2.2.5 (HKLM\...\Standard x64Components_is1) (Version: 2.2.5 - Shark007)
Yarn (HKLM-x32\...\{EB54467E-B07C-48E6-BCCE-1C453DF66E9E}) (Version: 0.17.6 - Yarn Contributors)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-1341208516-2984071467-593012157-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\NG\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1341208516-2984071467-593012157-1001_Classes\CLSID\{e8c77137-e224-5791-b6e9-ff0305797a13}\InprocServer32 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)
CustomCLSID: HKU\S-1-5-21-1341208516-2984071467-593012157-1001_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1341208516-2984071467-593012157-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1341208516-2984071467-593012157-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1341208516-2984071467-593012157-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1341208516-2984071467-593012157-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1341208516-2984071467-593012157-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1341208516-2984071467-593012157-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1341208516-2984071467-593012157-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1341208516-2984071467-593012157-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1341208516-2984071467-593012157-1001_Classes\CLSID\{FB314EE1-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1341208516-2984071467-593012157-1001_Classes\CLSID\{FB314EE2-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1341208516-2984071467-593012157-1001_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {11085776-3D74-4F95-B9C4-29EAC65C7017} - \GenericSettingsHandler\Windows-Credentials\RetrySyncTask_for_S-1-5-21-1341208516-2984071467-593012157-1001 -> No File <==== ATTENTION
Task: {198ED845-F593-43CC-B012-BBB8A4298A69} - System32\Tasks\RtHDVBg_SRSSA => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2015-09-23] (Realtek Semiconductor)
Task: {20F9237A-8539-423C-93ED-4A14DC9D996A} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1341208516-2984071467-593012157-1001Core1d2370248faa6d7 => C:\Users\NG\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2016-11-05] (Dropbox, Inc.)
Task: {23DF0692-5CC7-4A81-8110-9E618338A48D} - System32\Tasks\SAgent => C:\Program Files\Samsung\S Agent\CommonAgent.exe [2016-02-24] (Samsung Electronics Co., Ltd.)
Task: {32B134C1-9053-421D-A35C-3FDEACF1EE4E} - System32\Tasks\Microsoft_Hardware_Launch_IType_exe => c:\Program Files\Microsoft IntelliType Pro\IType.exe
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\WINDOWS\System32\AutoWorkplace.exe
Task: {364AFFD1-B7A8-4582-82C2-A1DFF6CFD40E} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {3C17DCC3-4D4F-4B0B-8AC7-698723F071DE} - System32\Tasks\LaunchSettings => C:\Program Files (x86)\Samsung\Settings\Settings.exe [2015-06-24] ()
Task: {44CA9A65-1D36-448B-A3BA-35D20BD04BC0} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)
Task: {466A8CE6-0289-4687-9956-E31704660DF9} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2016-08-12] (Intel Corporation)
Task: {4AED022B-6231-4179-9A1F-31854A4D8664} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-12-19] (Adobe Systems Incorporated)
Task: {4D6DA131-3277-441A-BE3C-86F300D83E8F} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {5118A3EB-CE42-4706-A5BB-C8B963ED84AC} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2016-08-12] (Intel Corporation)
Task: {55757F2F-891A-4B1E-934A-250222852AF1} - System32\Tasks\{00FD5094-A25A-46A0-9F02-28DE4DB0DC3B} => pcalua.exe -a C:\Users\NG\Downloads\win64_153330.exe -d C:\Users\NG\Downloads
Task: {57672138-E4A1-4C01-8FEF-C1254C42ACEF} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe
Task: {5D6E03D4-E9E3-4E94-9DE7-720C7CB6E105} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {5E1A28CB-7050-4A08-BF82-7B5FF267904A} - System32\Tasks\LCDModeChecker => C:\ProgramData\Samsung\LCDModeChecker\LCDModeChecker.exe [2013-09-17] (Samsung Electronics Co., Ltd.)
Task: {5EC1111D-4EE0-42EC-8230-F5D8D6DF89AE} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {5FBF216F-A3A6-482F-9C83-40666D13B6E1} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe
Task: {606E0E54-3A32-44B1-9FA6-1641B2B3AB28} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {757BC7B8-DCDA-451E-BAE0-F05857B4C6C0} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {76B2EB46-DD6A-4A1B-9AD4-DAE39CA23007} - System32\Tasks\Opera scheduled Autoupdate 1474786425 => D:\Apps\Opera\launcher.exe [2017-01-27] (Opera Software)
Task: {789A24A1-F558-42DB-8D9C-179ED3D1B42A} - System32\Tasks\Opera scheduled Autoupdate 1417044029 => D:\Apps\Opera\launcher.exe [2017-01-27] (Opera Software)
Task: {7D43C8A6-8AEE-45A9-A66F-D88DF1793B5A} - \WPD\SqmUpload_S-1-5-21-1341208516-2984071467-593012157-1001 -> No File <==== ATTENTION
Task: {827D7DBC-B275-411E-A146-B8D315A96741} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1341208516-2984071467-593012157-1001UA1d23702490d345b => C:\Users\NG\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2016-11-05] (Dropbox, Inc.)
Task: {82C23161-86DB-4816-A8A9-E2E94E3973B5} - System32\Tasks\SettingsHibernateMonitor => C:\Program Files (x86)\Samsung\Settings\SettingsHibernateMonitor.exe [2015-06-24] (Samsung Electronics CO., LTD.)
Task: {8383CC46-1C6D-4370-A382-62CFAEEC1712} - System32\Tasks\AdobeAAMUpdater-1.0-NG-NTB-NG => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2016-07-01] (Adobe Systems Incorporated)
Task: {85A67450-CE0C-4B9A-B9B2-EF736DBDF55C} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {8DBEE4C7-3541-4D4F-BE3D-4344371B9C4D} - System32\Tasks\RTKCPL => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2015-09-23] (Realtek Semiconductor)
Task: {909F0605-0D08-4737-8A8A-A28B57A6E3F7} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {917D5837-B8CB-46E2-8441-781C7867D0CD} - System32\Tasks\IntelGfxColorWA2 => C:\ProgramData\Samsung\GFXPatch\IntelGfxColorWA2.exe [2014-07-25] (Samsung Electronics Co., Ltd.)
Task: {A2542B4A-4802-4B12-9900-36884DADEFF9} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {B085ADDB-E934-4854-BDDD-34E69A2B7180} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2017-01-12] (Microsoft Corporation)
Task: {B2DB622F-4D7D-45CD-9297-7B1C20C08EED} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
Task: {B3B169F8-CEFE-4D0A-89D4-EA80F101CB21} - \WPD\SqmUpload_S-1-5-21-1341208516-2984071467-593012157-1002 -> No File <==== ATTENTION
Task: {BCF8BD77-EA73-4889-9312-984255DDB1FF} - System32\Tasks\CCleanerSkipUAC => D:\Apps\CCleaner\CCleaner.exe [2016-08-27] (Piriform Ltd)
Task: {BDC9676E-CA63-4493-AAC7-82BA1F4EE43B} - \OfficeSoftwareProtectionPlatform\SvcRestartTask -> No File <==== ATTENTION
Task: {C4F66084-A005-41DF-AD5C-4B4731CAB161} - System32\Tasks\SettingsEventHandlerMonitor => C:\Program Files (x86)\Samsung\Settings\CmdServer\RSSettingEventHandler.exe [2015-06-24] (Samsung Electronics CO., LTD.)
Task: {CFDBAC60-F6E6-4929-B6E1-4720578CF797} - System32\Tasks\OneDrive Standalone Update Task => C:\Users\NG\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\OneDriveStandaloneUpdater.exe
Task: {DA8091DB-4583-40C1-89EC-26B83B28C041} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
Task: {DD234E5B-4B80-4706-BDD0-BE75341F8E01} - System32\Tasks\IdleStateFanCtrl => C:\ProgramData\Samsung\SamsungSystemConfiguration\IdleStateFanCtrl.exe [2014-03-19] (Samsung Electronics CO., LTD.)
Task: {E65F8190-5C5E-4A18-AFCD-CD7C1D11DAD7} - System32\Tasks\ShutdownOpt => C:\ProgramData\Samsung\ShutdownEvent.exe [2013-09-17] (SAMSUNG Electronics co., LTD.)
Task: {ECC5930B-B688-4B09-9A37-3818D82DA6CB} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {FF308900-46B2-4533-9427-E10A15FB0490} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-1341208516-2984071467-593012157-1001Core1d2370248faa6d7.job => C:\Users\NG\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-1341208516-2984071467-593012157-1001UA1d23702490d345b.job => C:\Users\NG\AppData\Local\Dropbox\Update\DropboxUpdate.exe
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
Shortcut: C:\Users\NG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\no_zooｍ_ｃhroｍe.exe.lnk -> C:\ProgramData\no_zooｍ_ｃhroｍe.exe.lnk.bat ()
ShortcutWithArgument: C:\Users\NG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Aplikace Chrome\Hudba Google Play (1).lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory="Profile 1" --app-id=fahmaaghhglfmonjliepjlchgpgfmobi
ShortcutWithArgument: C:\Users\NG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Aplikace Chrome\Hudba Google Play.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=fahmaaghhglfmonjliepjlchgpgfmobi
ShortcutWithArgument: C:\Users\NG\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\e4326e3335cd16c6\Pushbullet.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory="Profile 1" --app-id=chlffgpmiacpedhhbkiomidkjlcfhogd
ShortcutWithArgument: C:\Users\NG\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\a41ce5b91aa3166e\MightyText - SMS Text Messaging ⟷ Computer.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=dkfhfaphfkopdgpbfkebjfcblcafcmpi
ShortcutWithArgument: C:\Users\NG\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\3e2d507742482bc7\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=pherlerspclipickwzy
==================== Loaded Modules (Whitelisted) ==============
2016-07-17 00:42 - 2016-07-17 00:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-12-15 00:13 - 2016-12-09 23:29 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-12-15 00:13 - 2016-12-09 23:29 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll
2016-10-04 03:57 - 2016-10-04 03:57 - 00052400 _____ () D:\Apps\FileZilla\FileZilla FTP Client\fzshellext_64.dll
2016-06-10 01:41 - 2016-06-10 01:41 - 00491184 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll
2016-10-24 05:45 - 2016-10-24 05:45 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2017-01-12 20:26 - 2016-12-21 20:09 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2017-01-12 20:26 - 2016-12-21 20:08 - 00693248 _____ () C:\Windows\ShellExperiences\MtcUvc.dll
2017-01-12 20:25 - 2016-12-21 19:54 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-01-12 20:25 - 2016-12-21 19:48 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-01-12 20:25 - 2016-12-21 19:48 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2017-01-12 20:25 - 2016-12-21 19:48 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2017-01-12 20:25 - 2016-12-21 19:53 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2016-07-20 01:05 - 2017-01-18 01:52 - 00401904 _____ () C:\WINDOWS\system32\igfxTray.exe
2017-01-26 17:15 - 2017-01-25 20:29 - 02459992 _____ () C:\Program Files (x86)\Google\Chrome\Application\56.0.2924.76\libglesv2.dll
2017-01-26 17:15 - 2017-01-25 20:29 - 00099672 _____ () C:\Program Files (x86)\Google\Chrome\Application\56.0.2924.76\libegl.dll
2016-12-02 02:09 - 2016-12-02 02:09 - 00866224 _____ () D:\Apps\QuikGoPro\GoPro Desktop App\GoProDesktopSystemTray.exe
2016-10-01 07:08 - 2016-10-01 07:08 - 31723696 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
2015-06-24 17:05 - 2015-06-24 17:05 - 00211064 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\WinCRT.dll
2016-10-12 17:28 - 2016-10-12 17:28 - 40523456 _____ () C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\CEF\libcef.dll
2016-10-12 01:08 - 2016-10-12 01:08 - 00118272 _____ () \\?\C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\js\node_modules\fs-ext\build\Release\fs-ext.node
2016-10-12 01:08 - 2016-10-12 01:08 - 00223232 _____ () \\?\C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\js\node_modules\node-vulcanjs\build\Release\VulcanJS.node
2016-10-12 01:08 - 2016-10-12 01:08 - 00117248 _____ () \\?\C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\js\node_modules\ref\build\Release\binding.node
2016-10-12 01:08 - 2016-10-12 01:08 - 00124928 _____ () \\?\C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\js\node_modules\ffi\build\Release\ffi_bindings.node
2016-10-12 20:11 - 2016-10-12 20:11 - 00098496 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\js\node_modules\node-ProxyResolver\build\Release\ProxyResolverWin.dll
2016-10-12 01:08 - 2016-10-12 01:08 - 00166400 _____ () \\?\C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\js\node_modules\idle-gc\build\Release\idle-gc.node
2014-10-25 23:20 - 2014-03-18 20:10 - 00022920 _____ () C:\ProgramData\Samsung\SamsungSystemConfiguration\wsabi.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\ProgramData\TEMP:054203E4 [302]
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-23 02:25 - 2017-01-26 10:10 - 00001508 ____A C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 localhost
127.0.0.1 stage.localhost127.0.0.1 dev.ccri.cz
127.0.0.1 www.dev.ccri.cz
127.0.0.1 code.ccri.cz
127.0.0.1 www.code.ccri.cz127.0.0.1 www.dev.tb.cz
127.0.0.1 dev.tb.cz127.0.0.1 dev.admin.modgen.net
127.0.0.1 www.dev.admin.modgen.net
127.0.0.1 code.admin.modgen.net
127.0.0.1 www.code.admin.modgen.net130.195.2.40 stage.victoria.ac.nz
130.195.2.40 cms.victoria.ac.nz
127.0.0.1 local.victoria.ac.nz
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1341208516-2984071467-593012157-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\NG\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppBackground\{2020c6d1-2069-4073-a1ad-1f5995f75f52}.jpg
DNS Servers: 192.168.2.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: AdobeUpdateService => 2
MSCONFIG\Services: AGSService => 2
MSCONFIG\Services: GoProDeviceDetectionService => 2
MSCONFIG\Services: PnkBstrA => 2
MSCONFIG\Services: postgresql-x64-9.3 => 2
MSCONFIG\Services: SWUpdateService => 2
HKLM\...\StartupApproved\StartupFolder: => "GoPro Importer.lnk"
HKLM\...\StartupApproved\Run: => "BTMTrayAgent"
HKLM\...\StartupApproved\Run: => "AdobeAAMUpdater-1.0"
HKLM\...\StartupApproved\Run: => "Logitech Download Assistant"
HKLM\...\StartupApproved\Run32: => "AdobeCS6ServiceManager"
HKLM\...\StartupApproved\Run32: => "APSDaemon"
HKLM\...\StartupApproved\Run32: => "MMReminderService"
HKLM\...\StartupApproved\Run32: => "QuickTime Task"
HKLM\...\StartupApproved\Run32: => "SwitchBoard"
HKLM\...\StartupApproved\Run32: => "AdobeCEPServiceManager"
HKLM\...\StartupApproved\Run32: => "Adobe ARM"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "VirtualCloneDrive"
HKLM\...\StartupApproved\Run32: => "Cisco AnyConnect Secure Mobility Agent for Windows"
HKLM\...\StartupApproved\Run32: => "AdobeAAMUpdater-1.0"
HKU\S-1-5-21-1341208516-2984071467-593012157-1001\...\StartupApproved\StartupFolder: => "EvernoteClipper.lnk"
HKU\S-1-5-21-1341208516-2984071467-593012157-1001\...\StartupApproved\Run: => "Dropbox Update"
HKU\S-1-5-21-1341208516-2984071467-593012157-1001\...\StartupApproved\Run: => "CCleaner Monitoring"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [vm-monitoring-nb-session] => LPort=139
FirewallRules: [{A6C7E23B-2B78-49CB-9FE5-3DF3C157203C}] => D:\Apps\Firefox\firefox.exe
FirewallRules: [{F7D904A0-B785-497E-8358-2F79C1FE8E1B}] => D:\Apps\Firefox\firefox.exe
FirewallRules: [UDP Query User{D3299861-8070-4DE3-8DA4-58FCEEA6D830}C:\users\ng\downloads\microsoft-office-2013-professional-plus-cz-+-crack-[kedar_cz]\microsoft office 2013 professional plus\microsoft toolkit 2.4.5.exe] => C:\users\ng\downloads\microsoft-office-2013-professional-plus-cz-+-crack-[kedar_cz]\microsoft office 2013 professional plus\microsoft toolkit 2.4.5.exe
FirewallRules: [TCP Query User{4AB584C3-F38B-4046-B013-E70D8CF4850F}C:\users\ng\downloads\microsoft-office-2013-professional-plus-cz-+-crack-[kedar_cz]\microsoft office 2013 professional plus\microsoft toolkit 2.4.5.exe] => C:\users\ng\downloads\microsoft-office-2013-professional-plus-cz-+-crack-[kedar_cz]\microsoft office 2013 professional plus\microsoft toolkit 2.4.5.exe
FirewallRules: [{DA884EA8-CCCD-4BD5-AABC-D9BC84462DB7}] => C:\Users\NG\AppData\Local\Temp\MPCOnline\MPCDownload.exe
FirewallRules: [{01ECDCF8-4FED-4C26-BF2C-B689E8C27F9B}] => C:\Users\NG\AppData\Local\Temp\MPCOnline\MPCDownload.exe
FirewallRules: [{C3C222A1-B305-4CB6-8CBC-F3A08E96641C}] => C:\Program Files\Bignox\BigNoxVM\RTNoxVMHandle.exe
FirewallRules: [{AB5883B8-CBE2-4096-8560-0817B1830E01}] => C:\Users\NG\AppData\Roaming\Nox\bin\Nox.exe
FirewallRules: [UDP Query User{2C46A2C0-E818-4CAA-896E-142506F6C0EB}C:\games\starcraft ii\versions\base43478\sc2_x64.exe] => C:\games\starcraft ii\versions\base43478\sc2_x64.exe
FirewallRules: [TCP Query User{FF6BAD8A-4058-48D9-9DDF-4ADECE6FC694}C:\games\starcraft ii\versions\base43478\sc2_x64.exe] => C:\games\starcraft ii\versions\base43478\sc2_x64.exe
FirewallRules: [UDP Query User{966E73BA-E2F7-4B23-B8B1-28FA856873B5}C:\games\starcraft ii\versions\base42932\sc2_x64.exe] => C:\games\starcraft ii\versions\base42932\sc2_x64.exe
FirewallRules: [TCP Query User{00F5EE8D-C1C9-4C57-B2ED-7D15B387CDF6}C:\games\starcraft ii\versions\base42932\sc2_x64.exe] => C:\games\starcraft ii\versions\base42932\sc2_x64.exe
FirewallRules: [UDP Query User{7C663382-AFBF-4AA0-AFCE-3DFE0513EB4A}C:\games\hearthstone\hearthstone.exe] => C:\games\hearthstone\hearthstone.exe
FirewallRules: [TCP Query User{B8DE66C1-00E2-414C-B4AB-8A6DFBF30D40}C:\games\hearthstone\hearthstone.exe] => C:\games\hearthstone\hearthstone.exe
FirewallRules: [UDP Query User{A9EA6715-E36C-4C16-A7C3-3F95EA46D847}C:\games\overwatch\overwatch.exe] => C:\games\overwatch\overwatch.exe
FirewallRules: [TCP Query User{4D5A824B-4CA6-48FC-8662-DBC48E2B743B}C:\games\overwatch\overwatch.exe] => C:\games\overwatch\overwatch.exe
FirewallRules: [UDP Query User{06485021-CA6A-446C-A3D1-F35F3F564714}D:\games\xcom 2\binaries\win64\xcom2.exe] => D:\games\xcom 2\binaries\win64\xcom2.exe
FirewallRules: [TCP Query User{6A224766-3C8E-46F1-B370-21BD5F1E7947}D:\games\xcom 2\binaries\win64\xcom2.exe] => D:\games\xcom 2\binaries\win64\xcom2.exe
FirewallRules: [UDP Query User{23F22206-D36B-4C48-A0A4-38987FE8B1FD}C:\games\starcraft ii\versions\base42253\sc2_x64.exe] => C:\games\starcraft ii\versions\base42253\sc2_x64.exe
FirewallRules: [TCP Query User{815FE612-8A6A-4619-8030-795E417582A1}C:\games\starcraft ii\versions\base42253\sc2_x64.exe] => C:\games\starcraft ii\versions\base42253\sc2_x64.exe
FirewallRules: [UDP Query User{9B6EB4CD-7E53-4E6F-8121-619F6F19641C}D:\dropbox\codevels\devtools\node.js\node.exe] => D:\dropbox\codevels\devtools\node.js\node.exe
FirewallRules: [TCP Query User{89696AAD-6214-4E6F-A15E-D0BC213EE669}D:\dropbox\codevels\devtools\node.js\node.exe] => D:\dropbox\codevels\devtools\node.js\node.exe
FirewallRules: [UDP Query User{D3462247-67A8-4FCC-B49B-7DF3C10D5E67}C:\games\starcraft ii\versions\base41743\sc2_x64.exe] => C:\games\starcraft ii\versions\base41743\sc2_x64.exe
FirewallRules: [TCP Query User{D33E5D5F-F10C-4850-9608-C2C2D21AFCF8}C:\games\starcraft ii\versions\base41743\sc2_x64.exe] => C:\games\starcraft ii\versions\base41743\sc2_x64.exe
FirewallRules: [UDP Query User{F7A77FE5-85A2-4A07-B3CD-040D63CCEB0A}C:\games\left 4 dead 2\left4dead2.exe] => C:\games\left 4 dead 2\left4dead2.exe
FirewallRules: [TCP Query User{545863B7-9F8A-443E-B364-DEF85E86E28C}C:\games\left 4 dead 2\left4dead2.exe] => C:\games\left 4 dead 2\left4dead2.exe
FirewallRules: [UDP Query User{E750CAAA-6D95-43AD-8709-C260CDFFBC2F}C:\games\left 4 dead 2\left4dead2.exe] => C:\games\left 4 dead 2\left4dead2.exe
FirewallRules: [TCP Query User{256F664A-57CC-4744-AC52-A20C6CD38965}C:\games\left 4 dead 2\left4dead2.exe] => C:\games\left 4 dead 2\left4dead2.exe
FirewallRules: [UDP Query User{013FECAB-14A4-4B0D-ABF5-E887FF2428E0}C:\games\unrealtournament\system\unrealtournament.exe] => C:\games\unrealtournament\system\unrealtournament.exe
FirewallRules: [TCP Query User{F8174969-C7B9-456A-AF85-F7E0E9565F38}C:\games\unrealtournament\system\unrealtournament.exe] => C:\games\unrealtournament\system\unrealtournament.exe
FirewallRules: [UDP Query User{0734D25B-5829-47D2-A33E-178EE990F770}C:\games\starcraft ii\versions\base41743\sc2_x64.exe] => C:\games\starcraft ii\versions\base41743\sc2_x64.exe
FirewallRules: [TCP Query User{E4F89B10-C349-4C31-8875-DE5E5A85ED78}C:\games\starcraft ii\versions\base41743\sc2_x64.exe] => C:\games\starcraft ii\versions\base41743\sc2_x64.exe
FirewallRules: [UDP Query User{D2996139-5F51-4212-8533-68BCFA6128E2}C:\games\starcraft ii\versions\base39576\sc2_x64.exe] => C:\games\starcraft ii\versions\base39576\sc2_x64.exe
FirewallRules: [TCP Query User{16AB17E6-910A-4CB8-8D01-1913B2F99E68}C:\games\starcraft ii\versions\base39576\sc2_x64.exe] => C:\games\starcraft ii\versions\base39576\sc2_x64.exe
FirewallRules: [UDP Query User{45E53A7A-137D-4223-B312-F60C1E641151}D:\games\xcom\steamapps\depotcache\xcom 2\binaries\win64\xcom2.exe] => D:\games\xcom\steamapps\depotcache\xcom 2\binaries\win64\xcom2.exe
FirewallRules: [TCP Query User{BDC3BD1A-5BB7-4E21-9A51-89EFB39151A2}D:\games\xcom\steamapps\depotcache\xcom 2\binaries\win64\xcom2.exe] => D:\games\xcom\steamapps\depotcache\xcom 2\binaries\win64\xcom2.exe
FirewallRules: [{1FD62836-56FF-42A8-A4AF-74529D9ACAA3}] => C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [UDP Query User{724D53C6-705E-4CB3-B43F-02608F7C7AC1}D:\apps\firefox\firefox.exe] => D:\apps\firefox\firefox.exe
FirewallRules: [TCP Query User{03578233-F15E-41A0-978A-6B685EC46263}D:\apps\firefox\firefox.exe] => D:\apps\firefox\firefox.exe
FirewallRules: [UDP Query User{F32CEE0D-ECB4-47EB-8AE4-6399AB267A6C}D:\dropbox\codevels\devtools\ruby\bin\ruby.exe] => D:\dropbox\codevels\devtools\ruby\bin\ruby.exe
FirewallRules: [TCP Query User{58364074-5787-4B73-BED6-F30B0A897732}D:\dropbox\codevels\devtools\ruby\bin\ruby.exe] => D:\dropbox\codevels\devtools\ruby\bin\ruby.exe
FirewallRules: [UDP Query User{DE93B902-B85C-4854-BE94-3332AAFA24C0}C:\users\ng\downloads\wifi_speed_test_server.exe] => C:\users\ng\downloads\wifi_speed_test_server.exe
FirewallRules: [TCP Query User{FC297728-13EE-4A3D-BADF-9E30BA698363}C:\users\ng\downloads\wifi_speed_test_server.exe] => C:\users\ng\downloads\wifi_speed_test_server.exe
FirewallRules: [UDP Query User{6CAF321E-1E8E-41B7-B72F-DD2316EF96F5}D:\games\heroes of the storm\versions\base34659\heroesofthestorm_x64.exe] => D:\games\heroes of the storm\versions\base34659\heroesofthestorm_x64.exe
FirewallRules: [TCP Query User{C9346E09-D55C-4E86-941E-6A1955CCF113}D:\games\heroes of the storm\versions\base34659\heroesofthestorm_x64.exe] => D:\games\heroes of the storm\versions\base34659\heroesofthestorm_x64.exe
FirewallRules: [UDP Query User{02F560F7-F5E8-4EC8-8629-97809732713F}D:\apps\skype\phone\skype.exe] => D:\apps\skype\phone\skype.exe
FirewallRules: [TCP Query User{84A42D7E-D813-4001-BDFC-CAA7B10B5A05}D:\apps\skype\phone\skype.exe] => D:\apps\skype\phone\skype.exe
FirewallRules: [UDP Query User{8DF99BE6-ED69-45F7-906D-5B688564B083}C:\program files (x86)\starcraft ii\versions\base32283\sc2.exe] => C:\program files (x86)\starcraft ii\versions\base32283\sc2.exe
FirewallRules: [TCP Query User{A8593E4E-8894-40EB-80F6-FD52DC20F4EA}C:\program files (x86)\starcraft ii\versions\base32283\sc2.exe] => C:\program files (x86)\starcraft ii\versions\base32283\sc2.exe
FirewallRules: [{B6336367-E3F5-486E-BF7C-22EDE6B58BAC}] => C:\Program Files (x86)\StarCraft II\StarCraft II.exe
FirewallRules: [{6349DB12-5A7D-4F7F-965D-7AF8EF860882}] => C:\Program Files (x86)\StarCraft II\StarCraft II.exe
FirewallRules: [{E9B13221-76A9-47BE-9B4F-C23B88440002}] => D:\Games\Bnet\Battle.net\Battle.net.exe
FirewallRules: [{D2C83B34-14AB-4DD5-A338-AC2EFD89DD0F}] => D:\Games\Bnet\Battle.net\Battle.net.exe
FirewallRules: [UDP Query User{2952968B-FDCE-4284-A7FA-63989B12218E}D:\games\starcraft\starcraft\starcraft.exe] => D:\games\starcraft\starcraft\starcraft.exe
FirewallRules: [TCP Query User{1046E745-51B8-420A-84AB-36C07DD60A36}D:\games\starcraft\starcraft\starcraft.exe] => D:\games\starcraft\starcraft\starcraft.exe
FirewallRules: [UDP Query User{B18A6A63-705A-4193-8714-0B55E9A2308D}D:\games\gh3\gh3.exe] => D:\games\gh3\gh3.exe
FirewallRules: [TCP Query User{E5C08494-3F9E-410D-9B12-3D1CABCF17EB}D:\games\gh3\gh3.exe] => D:\games\gh3\gh3.exe
FirewallRules: [{C84771C1-9A8F-4A91-9FE4-D92CC8BD36EA}] => D:\Apps\MSOffice\Office14\GROOVE.EXE
FirewallRules: [{A572664C-5FB9-46E7-AB6A-03A82876646E}] => LPort=1900
FirewallRules: [{1E7445CD-7308-49CD-9EAA-2544E4B28718}] => LPort=2869
FirewallRules: [{9ED8E504-B5FA-44A2-8C44-3E831F7C4E3A}] => C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{F6FBA829-633E-401E-B2F1-9413A1F93E2A}] => D:\Apps\PhotoshopCC\Adobe Photoshop CC 2014\Photoshop.exe
FirewallRules: [{3504863B-F818-4E16-9A85-175FA4E863F3}] => D:\Apps\PhotoshopCC\Adobe Photoshop CC 2014\Photoshop.exe
FirewallRules: [{6D04D97D-EDC9-48E3-8E0A-78E9B1743EAB}] => D:\Apps\Lightroom5\lightroom.exe
FirewallRules: [{1B788054-196D-4801-A005-3BEC0F245A05}] => C:\Users\NG\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{5394E7D7-6996-4896-94A4-92DF1C81297B}] => C:\Users\NG\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [UDP Query User{3041BC19-67C0-4DE3-886E-3A088C396AD5}D:\apps\wamp\bin\apache\apache2.4.9\bin\httpd.exe] => D:\apps\wamp\bin\apache\apache2.4.9\bin\httpd.exe
FirewallRules: [TCP Query User{F9D584AB-6BF4-4F5D-817C-7A54305C1BF4}D:\apps\wamp\bin\apache\apache2.4.9\bin\httpd.exe] => D:\apps\wamp\bin\apache\apache2.4.9\bin\httpd.exe
FirewallRules: [UDP Query User{4FA02E0C-2E74-4965-BE13-C41C02CDBC5C}C:\users\ng\appdata\roaming\dropbox\bin\dropbox.exe] => C:\users\ng\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [TCP Query User{B2DF4C0D-5205-4121-B77D-79A10117738E}C:\users\ng\appdata\roaming\dropbox\bin\dropbox.exe] => C:\users\ng\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{AEB7CCBF-CAAF-421A-B3CA-9D10C4C757CC}] => C:\Users\NG\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{CAB0B899-A39A-414C-B74D-804A69DE2FFD}] => C:\Users\NG\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{FF1B9C7A-B023-4D7B-9C14-BDF2FCF64C3E}] => C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [{60A56908-14D6-4AED-8DEF-BF5B848F6C87}] => C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [{13531E42-A4B8-4EE4-A474-9DC1B7CCDABA}] => LPort=1900
FirewallRules: [{751B363D-F5B8-4932-8B99-593D3B1D7C22}] => LPort=7900
FirewallRules: [{60C8834F-6786-423A-9C2F-2B04701BA6F1}] => LPort=24234
FirewallRules: [{C9FFC453-C685-4CE4-BBA6-5CBC582D9AEF}] => LPort=7679
FirewallRules: [{9AFDB637-0AFC-4C99-BB80-05383DBFC1F5}] => LPort=7676
FirewallRules: [{4E65F180-4DED-4C22-8FD2-2D5A62EE9557}] => LPort=8643
FirewallRules: [{23842018-ED38-4310-AAC9-4B4A2E49DE4F}] => LPort=8743
FirewallRules: [{BC56ADC2-9390-4983-8AA4-15775A26F94E}] => C:\Program Files\Samsung\AllShare Framework DMS\1.3.18\AllShareFrameworkDMS.exe
FirewallRules: [{07A26CE5-E05C-4C06-96F9-AF67BAA92373}] => C:\Program Files\Samsung\AllShare Framework DMS\1.3.18\AllShareFrameworkDMS.exe
FirewallRules: [{54B5F467-76E3-4ECE-AF03-42F3C8F27DE2}] => C:\Program Files\Samsung\AllShare Framework DMS\1.3.18\AllShareFrameworkDMS.exe
FirewallRules: [{B64BE013-6DFC-40B1-A661-501EF1282EC7}] => C:\Program Files\Samsung\AllShare Framework DMS\1.3.18\AllShareFrameworkDMS.exe
FirewallRules: [TCP Query User{763F1E33-1A3F-4F93-A1F4-43DEB76EE6A2}D:\dropbox\codevels\devtools\node.js\node.exe] => D:\dropbox\codevels\devtools\node.js\node.exe
FirewallRules: [UDP Query User{A99F2F1F-AA1F-4C51-954C-E702513F0CA3}D:\dropbox\codevels\devtools\node.js\node.exe] => D:\dropbox\codevels\devtools\node.js\node.exe
FirewallRules: [{3CB882A0-8F12-4EF2-8A1D-DDA6551533BF}] => C:\Games\Steam\Steam.exe
FirewallRules: [{E1DE5DAA-C213-4F0D-8C82-7E0AEA02293F}] => C:\Games\Steam\Steam.exe
FirewallRules: [{1898CC25-F017-4B63-946C-8AAA191B5444}] => C:\Games\Steam\bin\steamwebhelper.exe
FirewallRules: [{4D7CDEA0-4359-4FAE-94B7-6C9848F1BC66}] => C:\Games\Steam\bin\steamwebhelper.exe
FirewallRules: [{F909B10E-1A9B-4DD1-BD08-580E9B3DD913}] => C:\Games\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{EF03E0FE-966A-43B1-B7C7-8F2BBFF497E5}] => C:\Games\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [TCP Query User{65269872-2591-4932-A2F1-E996A6061F47}C:\program files\logitech gaming software\lcore.exe] => C:\program files\logitech gaming software\lcore.exe
FirewallRules: [UDP Query User{44A9DD36-5160-4BFD-9F9E-791B0DBF9FBC}C:\program files\logitech gaming software\lcore.exe] => C:\program files\logitech gaming software\lcore.exe
FirewallRules: [TCP Query User{6B7E9C63-10D5-4CB0-84E8-BF69DE20E54C}D:\games\nvn\neverwinter_en\neverwinter\live\gameclient.exe] => D:\games\nvn\neverwinter_en\neverwinter\live\gameclient.exe
FirewallRules: [UDP Query User{6AF522AD-3BD7-4D21-9C02-6C36A8D0962F}D:\games\nvn\neverwinter_en\neverwinter\live\gameclient.exe] => D:\games\nvn\neverwinter_en\neverwinter\live\gameclient.exe
FirewallRules: [TCP Query User{8090D879-501D-492C-9AC4-035B3D6EB445}D:\dropbox\codevels\devtools\ruby\bin\ruby.exe] => D:\dropbox\codevels\devtools\ruby\bin\ruby.exe
FirewallRules: [UDP Query User{48BFD708-CFE0-4DE5-8E6C-D4A55A3150A6}D:\dropbox\codevels\devtools\ruby\bin\ruby.exe] => D:\dropbox\codevels\devtools\ruby\bin\ruby.exe
FirewallRules: [TCP Query User{9E72E14F-27B2-4263-AB0E-7FA9AF66C314}C:\games\bnet\battle.net\battle.net.8098\battle.net.exe] => C:\games\bnet\battle.net\battle.net.8098\battle.net.exe
FirewallRules: [UDP Query User{38F3EE79-0610-4714-B110-CE8C83738931}C:\games\bnet\battle.net\battle.net.8098\battle.net.exe] => C:\games\bnet\battle.net\battle.net.8098\battle.net.exe
FirewallRules: [{227B1AE6-756D-4AE5-ABB2-F5C0C80EE8DB}] => D:\Games\WarOfWarships\WoWSLauncher.exe
FirewallRules: [{A5249309-25B0-4854-8E65-12A5AFCE3773}] => D:\Games\WarOfWarships\WoWSLauncher.exe
FirewallRules: [{8658C2B7-CE55-405D-B98F-CE5F0F763F22}] => D:\Games\WarOfWarships\worldofwarships.exe
FirewallRules: [{02624C73-AB1A-423D-90DB-9FCA4A3590AC}] => D:\Games\WarOfWarships\worldofwarships.exe
FirewallRules: [{AE7E9574-EE7C-4F3D-A31E-FD054A86D1F4}] => D:\Games\World_of_Warships\WoWSLauncher.exe
FirewallRules: [{921A918C-1BD4-4350-AB96-9B3AA74C4ED8}] => D:\Games\World_of_Warships\WoWSLauncher.exe
FirewallRules: [{4A072A2E-E802-4F75-BA90-888095E91412}] => D:\Games\World_of_Warships\worldofwarships.exe
FirewallRules: [{C007EA6B-6A05-4BF5-B539-CE87021313F8}] => D:\Games\World_of_Warships\worldofwarships.exe
FirewallRules: [TCP Query User{8EC3D2C6-0BF9-47DB-94E2-55844605C48E}C:\games\starcraft ii\versions\base47185\sc2_x64.exe] => C:\games\starcraft ii\versions\base47185\sc2_x64.exe
FirewallRules: [UDP Query User{EE1E0DFD-BCD0-4126-95B6-97BDF32AFB2E}C:\games\starcraft ii\versions\base47185\sc2_x64.exe] => C:\games\starcraft ii\versions\base47185\sc2_x64.exe
FirewallRules: [TCP Query User{A668036C-63AD-41E1-A929-42BEAE18F1E9}C:\games\firewatch\firewatch.exe] => C:\games\firewatch\firewatch.exe
FirewallRules: [UDP Query User{D8835FC2-EAF4-49EF-A5AE-D24F1DC491F0}C:\games\firewatch\firewatch.exe] => C:\games\firewatch\firewatch.exe
FirewallRules: [{87896745-D720-466A-B6AD-5AD0CFF0670F}] => C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{91779B20-534F-4512-ACBC-14A0A900192A}] => C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{A4928EC1-E953-4BC1-ACC8-867E041C04CB}] => C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{F36E27E8-AE86-4BC6-A74A-41F1CB4C1700}] => C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [TCP Query User{916ACD7D-EC39-46AF-97CC-9D63C12E63E7}D:\program files (x86)\origin games\battlefield 4\bf4.exe] => D:\program files (x86)\origin games\battlefield 4\bf4.exe
FirewallRules: [UDP Query User{FB1E3706-A821-45E9-A663-5C188787848E}D:\program files (x86)\origin games\battlefield 4\bf4.exe] => D:\program files (x86)\origin games\battlefield 4\bf4.exe
FirewallRules: [TCP Query User{9495A682-DB86-457C-AB60-5BE82ACE7875}D:\games\maxpayne3\maxpayne3.exe] => D:\games\maxpayne3\maxpayne3.exe
FirewallRules: [UDP Query User{C4432B8D-3AF8-4AEF-B5BC-269D90925057}D:\games\maxpayne3\maxpayne3.exe] => D:\games\maxpayne3\maxpayne3.exe
FirewallRules: [{FDD28A5E-9804-4467-858A-56F0E6D0602D}] => D:\Apps\MSOffice2013\Office15\lync.exe
FirewallRules: [{FAB76CBF-EC48-45FF-A674-E1B23366A4F4}] => D:\Apps\MSOffice2013\Office15\lync.exe
FirewallRules: [{EC2BFFFB-1F24-455A-9C4C-77637CF3AD13}] => D:\Apps\MSOffice2013\Office15\UcMapi.exe
FirewallRules: [{F6B72990-3617-4D12-A0C0-75FDDACBA21A}] => D:\Apps\MSOffice2013\Office15\UcMapi.exe
FirewallRules: [{37DEDD1D-118B-40E8-8CA8-4CEA8667EC8A}] => D:\Apps\QuikGoPro\GoPro Desktop App\Quik.exe
FirewallRules: [{D6301CFB-547D-44A8-8220-1E9E6D0D893B}] => D:\Apps\QuikGoPro\GoPro Desktop App\GoProMsgBus.exe
FirewallRules: [{17EBB74E-6A0D-4A37-A57F-14AA9E4DCC8F}] => D:\Apps\QuikGoPro\GoPro Desktop App\GoProIDService.exe
FirewallRules: [{4D707E83-EF2D-4232-BEB5-32D35157699D}] => D:\Apps\QuikGoPro\GoPro Desktop App\GoProLauncher.exe
FirewallRules: [{00D3F097-A12E-4433-9502-F1B98F7666B5}] => D:\Apps\Opera\42.0.2393.137\opera.exe
FirewallRules: [{778D2218-4E88-408E-8CC0-11126ED9121D}] => D:\Apps\Opera\42.0.2393.517\opera.exe
FirewallRules: [{11D8B3BB-352C-4212-B0A1-83A05BAC7433}] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Restore Points =========================
ATTENTION: System Restore is disabled
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (02/03/2017 05:06:25 PM) (Source: iBTAudioSrv) (EventID: 0) (User: )
Description: Event-ID 0
Error: (02/03/2017 03:49:47 PM) (Source: iBTAudioSrv) (EventID: 0) (User: )
Description: Event-ID 0
Error: (02/03/2017 01:10:40 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT AUTHORITY)
Description: Skipping: Eap method DLL path validation failed. Error: typeId=43, authorId=9, vendorId=0, vendorType=0
Error: (02/03/2017 01:10:40 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT AUTHORITY)
Description: Skipping: Eap method DLL path validation failed. Error: typeId=25, authorId=9, vendorId=0, vendorType=0
Error: (02/03/2017 01:10:40 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT AUTHORITY)
Description: Skipping: Eap method DLL path validation failed. Error: typeId=17, authorId=9, vendorId=0, vendorType=0
Error: (02/03/2017 01:10:40 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT AUTHORITY)
Description: Skipping: Eap method DLL path validation failed. Error: typeId=43, authorId=9, vendorId=0, vendorType=0
Error: (02/03/2017 01:10:40 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT AUTHORITY)
Description: Skipping: Eap method DLL path validation failed. Error: typeId=25, authorId=9, vendorId=0, vendorType=0
Error: (02/03/2017 01:10:40 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT AUTHORITY)
Description: Skipping: Eap method DLL path validation failed. Error: typeId=17, authorId=9, vendorId=0, vendorType=0
Error: (02/01/2017 04:46:53 PM) (Source: iBTAudioSrv) (EventID: 0) (User: )
Description: Event-ID 0
Error: (02/01/2017 07:33:56 AM) (Source: iBTAudioSrv) (EventID: 0) (User: )
Description: Event-ID 0
System errors:
=============
Error: (02/03/2017 05:06:04 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (02/03/2017 04:03:20 PM) (Source: DCOM) (EventID: 10010) (User: NG-NTB)
Description: The server {DABF28BE-F6B4-4E40-8F40-C4FB26F3116C} did not register with DCOM within the required timeout.
Error: (02/03/2017 04:02:40 PM) (Source: DCOM) (EventID: 10010) (User: NG-NTB)
Description: The server {DABF28BE-F6B4-4E40-8F40-C4FB26F3116C} did not register with DCOM within the required timeout.
Error: (02/03/2017 03:53:14 PM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)
Description: The server {784E29F4-5EBE-4279-9948-1E8FE941646D} did not register with DCOM within the required timeout.
Error: (02/03/2017 03:52:08 PM) (Source: DCOM) (EventID: 10010) (User: NG-NTB)
Description: The server {DABF28BE-F6B4-4E40-8F40-C4FB26F3116C} did not register with DCOM within the required timeout.
Error: (02/03/2017 03:51:38 PM) (Source: DCOM) (EventID: 10010) (User: NG-NTB)
Description: The server {DABF28BE-F6B4-4E40-8F40-C4FB26F3116C} did not register with DCOM within the required timeout.
Error: (02/03/2017 03:50:12 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (02/03/2017 03:50:12 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (02/03/2017 03:50:11 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
and APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (02/03/2017 01:10:05 AM) (Source: DCOM) (EventID: 10010) (User: NG-NTB)
Description: The server Windows.Media.Capture.Internal.AppCaptureShell did not register with DCOM within the required timeout.
CodeIntegrity:
===================================
Date: 2017-02-03 17:06:07.101
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-01-31 08:36:59.914
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-01-29 17:45:15.978
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-01-27 06:59:20.015
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-01-13 21:56:06.003
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-12-15 21:10:49.437
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-12-14 15:17:27.314
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-12-08 09:13:47.757
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-11-04 20:31:29.612
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-11-04 20:31:29.584
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-4500U CPU @ 1.80GHz
Percentage of memory in use: 66%
Total physical RAM: 8106.94 MB
Available physical RAM: 2695.11 MB
Total Virtual: 11761.57 MB
Available Virtual: 4668.34 MB
==================== Drives ================================
Drive c: (_Core) (Fixed) (Total:115.71 GB) (Free:3.18 GB) NTFS
Drive d: (_Data) (Fixed) (Total:107.86 GB) (Free:6.15 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 238.5 GB) (Disk ID: 16CEE6F6)
Partition: GPT.
==================== End of Addition.txt ============================
Ran by NG (03-02-2017 19:18:35)
Running from C:\Users\NG\Downloads
Windows 10 Home Version 1607 (X64) (2016-10-22 20:03:49)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-1341208516-2984071467-593012157-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1341208516-2984071467-593012157-503 - Limited - Disabled)
Guest (S-1-5-21-1341208516-2984071467-593012157-501 - Limited - Disabled)
NG (S-1-5-21-1341208516-2984071467-593012157-1001 - Administrator - Enabled) => C:\Users\NG
Visitor (S-1-5-21-1341208516-2984071467-593012157-1002 - Limited - Enabled) => C:\Users\Visitor
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
µTorrent (HKU\S-1-5-21-1341208516-2984071467-593012157-1001\...\uTorrent) (Version: 3.4.9.43085 - BitTorrent Inc.)
64 Bit HP CIO Components Installer (Version: 7.2.4 - Hewlett-Packard) Hidden
Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 3.9.0.327 - Adobe Systems Incorporated)
Adobe Flash Player 19 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 19.0.0.226 - Adobe Systems Incorporated)
Adobe Illustrator CC (HKLM-x32\...\{F2321021-08A2-44D6-B1DF-BDB415F23EC3}) (Version: 17.0 - Adobe Systems Incorporated)
Adobe Lightroom (HKLM-x32\...\{8048A5DF-8A70-5BE1-954B-E0FDE1BD0D0D}) (Version: 6.7 - Adobe Systems Incorporated)
Adobe Photoshop CC 2014 (HKLM-x32\...\{D7A4F897-B20A-42D0-862D-CB5F6DB7391D}) (Version: 15.0 - Adobe Systems Incorporated)
Adobe Premiere Pro CC 2017 (HKLM-x32\...\PPRO_11_0_0) (Version: 11.0.0 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.19) - Czech (HKLM-x32\...\{AC76BA86-7AD7-1029-7B44-AB0000000001}) (Version: 11.0.19 - Adobe Systems Incorporated)
Aplikace Intel(R) Wireless Bluetooth(R) Audio (HKLM-x32\...\{DFDA116C-E4DE-4AC5-A115-C5BB6FC9799E}) (Version: 17.0.1430.01 - Intel Corporation)
Aplikace Intel(R) Wireless Bluetooth(R)(patch version 17.1.1431.1) (HKLM\...\{302600C1-6BDF-4FD1-1407-148929CC1385}) (Version: 17.1.1407.0480 - Intel Corporation)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
BS.Player FREE (HKLM-x32\...\BSPlayerf) (Version: 2.68.1077 - AB Team, d.o.o.)
CCleaner (HKLM\...\CCleaner) (Version: 5.22 - Piriform)
Composer - Php Dependency Manager (HKLM-x32\...\{7315AF68-E777-496A-A6A2-4763A98ED35A}_is1) (Version: - getcomposer.org)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version: - Valve)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dark Souls 2 (HKLM-x32\...\RGFya1NvdWxzMg==_is1) (Version: 1 - )
Dropbox (HKU\S-1-5-21-1341208516-2984071467-593012157-1001\...\Dropbox) (Version: 18.4.32 - Dropbox, Inc.)
ELAN Touchpad driver X64 15.7.9.2_WHQL (HKLM\...\Elantech) (Version: 15.7.9.2 - ELAN Microelectronic Corp.)
Evernote v. 5.9.6 (HKLM-x32\...\{A542D366-9877-11E5-B101-005056951CAD}) (Version: 5.9.6.9494 - Evernote Corp.)
f.lux (HKU\S-1-5-21-1341208516-2984071467-593012157-1001\...\Flux) (Version: - )
FileZilla Client 3.22.1 (HKLM-x32\...\FileZilla Client) (Version: 3.22.1 - Tim Kosse)
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Git version 2.10.0 (HKLM\...\Git_is1) (Version: 2.10.0 - The Git Development Community)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 57.0.2987.21 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.32.7 - Google Inc.) Hidden
GoPro Studio (x32 Version: 5.10.4643 - GoPro, Inc.) Hidden
Hearthstone (HKLM-x32\...\Hearthstone) (Version: - Blizzard Entertainment)
INSIDE.Build.2016-ALI213 version 1.0 (HKLM-x32\...\{DEAC15B9-1A51-4974-8293-4B65D36DE2BB}}_is1) (Version: 1.0 - Ali213.net)
Intel(R) Experience Center Desktop Software (HKLM-x32\...\{85de612b-ee05-476a-87cc-52e5740de420}) (Version: 1.9.0.8 - Intel)
Intel(R) Chipset Device Software (x32 Version: 10.1.1.8 - Intel(R) Corporation) Hidden
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.0.0.1153 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.4549 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.9.3.1000 - Intel Corporation)
Intel(R) Update Manager (HKLM-x32\...\{7224B7CE-196C-4E2A-A1AE-1D7BF259FD36}) (Version: 3.4.1942 - Intel Corporation)
Intel(R) Wireless Bluetooth(R) (HKLM-x32\...\{97F4CEAE-8F2B-4012-93CC-75428373214D}) (Version: 19.00.1621.3340 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{313c06de-4aa7-4a1f-930a-f10f80380426}) (Version: 17.14.0 - Intel Corporation)
Java 8 Update 51 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418051F0}) (Version: 8.0.510 - Oracle Corporation)
Java 8 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218051F0}) (Version: 8.0.510 - Oracle Corporation)
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1341208516-2984071467-593012157-1001\...\OneDriveSetup.exe) (Version: 17.3.6743.1212 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50901.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 ENU (HKLM-x32\...\{3A9FC03D-C685-4831-94CF-4EDFD3749497}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 x64 ENU (HKLM\...\{D4AD39AD-091E-4D33-BB2B-59F6FCB8ADC3}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 Redistributable - x86 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23918 (HKLM-x32\...\{dab68466-3a7d-41a8-a5cf-415e3ff8ef71}) (Version: 14.0.23918.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23918 (HKLM-x32\...\{2e085fd2-a3e4-4b39-8e10-6b8d35f55244}) (Version: 14.0.23918.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio Code (HKLM-x32\...\{F8A2A208-72B3-4D61-95FC-8A65D340689B}_is1) (Version: 1.8.1 - Microsoft Corporation)
Mindjet 14 (HKLM-x32\...\{5C1060A2-462B-4883-A26A-065EEF6E35DF}) (Version: 14.0.334 - Mindjet)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 49.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 49.0.1 (x86 en-US)) (Version: 49.0.1 - Mozilla)
Mozilla Thunderbird 38.1.0 (x86 en-US) (HKLM-x32\...\Mozilla Thunderbird 38.1.0 (x86 en-US)) (Version: 38.1.0 - Mozilla)
N-Com wizard (HKLM-x32\...\{3EBC6CA5-5C4D-4C76-B1FC-71C2A6B8F694}) (Version: 2.3 - Nolangroup S.p.A.)
Node.js (HKLM-x32\...\{B97F7A50-A386-4556-AB1B-7D81EE6AC7D7}) (Version: 5.3.0 - Node.js Foundation)
NVIDIA PhysX (HKLM-x32\...\{DA909E62-3B45-4BA1-8B58-FCAEBA4BCEC9}) (Version: 9.12.0213 - NVIDIA Corporation)
OpenAL (HKLM-x32\...\OpenAL) (Version: - )
OpenOffice 4.1.1 (HKLM-x32\...\{86F2B095-3998-41D5-833D-1C5075300950}) (Version: 4.11.9775 - Apache Software Foundation)
Opera Stable 42.0.2393.517 (HKLM-x32\...\Opera 42.0.2393.517) (Version: 42.0.2393.517 - Opera Software)
Oracle VM VirtualBox 5.0.16 (HKLM\...\{F2E958A1-9215-4C7D-9A2E-F0740B8CA5B7}) (Version: 5.0.16 - Oracle Corporation)
Outils de vérification linguistique 2013 de Microsoft Office - Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
PDF Settings CC (x32 Version: 12.0 - Adobe Systems Incorporated) Hidden
PostgreSQL 9.3 (HKLM\...\PostgreSQL 9.3) (Version: 9.3 - PostgreSQL Global Development Group)
ProxyGate version 3.0.0.1176 (HKU\S-1-5-21-1341208516-2984071467-593012157-1001\...\{1EC095EE-8CA3-43D6-B9F5-0C55B82ED3D7}}_is1) (Version: 3.0.0.1176 - Gold Click Ltd) <==== ATTENTION
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Quik (HKLM-x32\...\{71fc4e33-8ac1-4b21-8cb5-040ce8986c4e}) (Version: 2.0.0.4643 - GoPro, Inc.)
Quik (Version: 0.1.4643 - GoPro, Inc.) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.1.505.2015 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7543 - Realtek Semiconductor Corp.)
Rockstar Games Social Club (HKLM-x32\...\Rockstar Games Social Club) (Version: 1.1.0.6 - Rockstar Games)
S Agent (Version: 1.1.58 - Samsung Electronics Co., Ltd.) Hidden
Safari (HKLM-x32\...\{C779648B-410E-4BBA-B75B-5815BCEFE71D}) (Version: 5.34.57.2 - Apple Inc.)
Samsung Settings (HKLM-x32\...\{3BB58176-B3A7-47FD-9F18-C3576431D193}) (Version: 2.2.0 - Samsung Electronics CO., LTD.)
Samsung Update (HKLM-x32\...\{006DD65B-ECE1-4E73-9EBD-E7051F5E31FD}) (Version: 2.2.42 - Samsung Electronics Co., Ltd.)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version: - Microsoft)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version: - Microsoft) Hidden
Shark007 Standard Codecs (HKLM-x32\...\{898E81AD-6DB9-4750-866B-B8958C5DC7AA}) (Version: 2.2.5 - Shark007)
SharpKeys (HKLM-x32\...\{636E94DA-99C0-448F-A931-3DAD83B4975F}) (Version: 3.5.0000 - RandyRants.com)
Skype™ 7.22 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.22.109 - Skype Technologies S.A.)
SRS Premium Sound (HKLM-x32\...\{E44F8A34-529E-4318-A0E1-1893C337A47F}) (Version: 1.00.4700 - DTS, Inc.)
StarCraft II (HKLM-x32\...\StarCraft II) (Version: - Blizzard Entertainment)
Stellaris (HKLM-x32\...\Stellaris_is1) (Version: - )
Support Center FAQ (x32 Version: 1.0.11 - Samsung Electronics CO., LTD.) Hidden
Tyranny (HKLM-x32\...\1266051739_is1) (Version: 2.0.0.1 - GOG.com)
Update for Skype for Business 2015 (KB3039776) 64-Bit Edition (HKLM\...\{90150000-012B-0409-1000-0000000FF1CE}_Office15.PROPLUS_{0FA8AE0C-69AE-4F60-A1AB-F79C6BA5A999}) (Version: - Microsoft)
Update for Skype for Business 2015 (KB3141468) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{CB85A0CF-0448-43D8-8006-173A8C84A018}) (Version: - Microsoft)
Update for Skype for Business 2015 (KB3141468) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUS_{CB85A0CF-0448-43D8-8006-173A8C84A018}) (Version: - Microsoft)
Update for Skype for Business 2015 (KB3141468) 64-Bit Edition (HKLM\...\{90150000-012B-0409-1000-0000000FF1CE}_Office15.PROPLUS_{CB85A0CF-0448-43D8-8006-173A8C84A018}) (Version: - Microsoft)
Vegas Pro 13.0 (64-bit) (HKLM\...\{3814DB30-091D-11E4-BDE0-F04DA23A5C58}) (Version: 13.0.373 - Sony)
VFW_Codec32 (x32 Version: 0.1.160.0 - GoPro, Inc.) Hidden
VFW_Codec64 (Version: 0.1.160.0 - GoPro, Inc.) Hidden
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version: 5.4.7.0 - Elaborate Bytes)
WampServer 2.5 (HKLM-x32\...\WampServer 2_is1) (Version: - Hervé Leclerc (HeL))
Windows Driver Package - Cambridge Silicon Radio Ltd. (CSRBC) USB (07/01/2016 2.5.2.3) (HKLM\...\F6E7FAEC5C1773411DCE89B345BDAEEA407C921B) (Version: 07/01/2016 2.5.2.3 - Cambridge Silicon Radio Ltd.)
Windows Driver Package - GoPro (WinUSB) Universal Serial Bus devices (03/07/2012 ) (HKLM\...\0B624A43DD66DBF5CF3EDFA9741A364E688062A4) (Version: 03/07/2012 - GoPro)
Windows Driver Package - Samsung Electronics Co. Ltd. (RadioHIDMini) HIDClass (08/23/2013 6.2.8400.4218) (HKLM\...\26BFE384C802803107F583AE1A739E4FEB56134B) (Version: 08/23/2013 6.2.8400.4218 - Samsung Electronics Co. Ltd.)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
WinRAR 5.20 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH)
x64Components v2.2.5 (HKLM\...\Standard x64Components_is1) (Version: 2.2.5 - Shark007)
Yarn (HKLM-x32\...\{EB54467E-B07C-48E6-BCCE-1C453DF66E9E}) (Version: 0.17.6 - Yarn Contributors)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-1341208516-2984071467-593012157-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\NG\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1341208516-2984071467-593012157-1001_Classes\CLSID\{e8c77137-e224-5791-b6e9-ff0305797a13}\InprocServer32 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)
CustomCLSID: HKU\S-1-5-21-1341208516-2984071467-593012157-1001_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1341208516-2984071467-593012157-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1341208516-2984071467-593012157-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1341208516-2984071467-593012157-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1341208516-2984071467-593012157-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1341208516-2984071467-593012157-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1341208516-2984071467-593012157-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1341208516-2984071467-593012157-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1341208516-2984071467-593012157-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1341208516-2984071467-593012157-1001_Classes\CLSID\{FB314EE1-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1341208516-2984071467-593012157-1001_Classes\CLSID\{FB314EE2-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1341208516-2984071467-593012157-1001_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {11085776-3D74-4F95-B9C4-29EAC65C7017} - \GenericSettingsHandler\Windows-Credentials\RetrySyncTask_for_S-1-5-21-1341208516-2984071467-593012157-1001 -> No File <==== ATTENTION
Task: {198ED845-F593-43CC-B012-BBB8A4298A69} - System32\Tasks\RtHDVBg_SRSSA => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2015-09-23] (Realtek Semiconductor)
Task: {20F9237A-8539-423C-93ED-4A14DC9D996A} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1341208516-2984071467-593012157-1001Core1d2370248faa6d7 => C:\Users\NG\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2016-11-05] (Dropbox, Inc.)
Task: {23DF0692-5CC7-4A81-8110-9E618338A48D} - System32\Tasks\SAgent => C:\Program Files\Samsung\S Agent\CommonAgent.exe [2016-02-24] (Samsung Electronics Co., Ltd.)
Task: {32B134C1-9053-421D-A35C-3FDEACF1EE4E} - System32\Tasks\Microsoft_Hardware_Launch_IType_exe => c:\Program Files\Microsoft IntelliType Pro\IType.exe
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\WINDOWS\System32\AutoWorkplace.exe
Task: {364AFFD1-B7A8-4582-82C2-A1DFF6CFD40E} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {3C17DCC3-4D4F-4B0B-8AC7-698723F071DE} - System32\Tasks\LaunchSettings => C:\Program Files (x86)\Samsung\Settings\Settings.exe [2015-06-24] ()
Task: {44CA9A65-1D36-448B-A3BA-35D20BD04BC0} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)
Task: {466A8CE6-0289-4687-9956-E31704660DF9} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2016-08-12] (Intel Corporation)
Task: {4AED022B-6231-4179-9A1F-31854A4D8664} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-12-19] (Adobe Systems Incorporated)
Task: {4D6DA131-3277-441A-BE3C-86F300D83E8F} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {5118A3EB-CE42-4706-A5BB-C8B963ED84AC} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2016-08-12] (Intel Corporation)
Task: {55757F2F-891A-4B1E-934A-250222852AF1} - System32\Tasks\{00FD5094-A25A-46A0-9F02-28DE4DB0DC3B} => pcalua.exe -a C:\Users\NG\Downloads\win64_153330.exe -d C:\Users\NG\Downloads
Task: {57672138-E4A1-4C01-8FEF-C1254C42ACEF} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe
Task: {5D6E03D4-E9E3-4E94-9DE7-720C7CB6E105} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {5E1A28CB-7050-4A08-BF82-7B5FF267904A} - System32\Tasks\LCDModeChecker => C:\ProgramData\Samsung\LCDModeChecker\LCDModeChecker.exe [2013-09-17] (Samsung Electronics Co., Ltd.)
Task: {5EC1111D-4EE0-42EC-8230-F5D8D6DF89AE} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {5FBF216F-A3A6-482F-9C83-40666D13B6E1} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe
Task: {606E0E54-3A32-44B1-9FA6-1641B2B3AB28} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {757BC7B8-DCDA-451E-BAE0-F05857B4C6C0} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {76B2EB46-DD6A-4A1B-9AD4-DAE39CA23007} - System32\Tasks\Opera scheduled Autoupdate 1474786425 => D:\Apps\Opera\launcher.exe [2017-01-27] (Opera Software)
Task: {789A24A1-F558-42DB-8D9C-179ED3D1B42A} - System32\Tasks\Opera scheduled Autoupdate 1417044029 => D:\Apps\Opera\launcher.exe [2017-01-27] (Opera Software)
Task: {7D43C8A6-8AEE-45A9-A66F-D88DF1793B5A} - \WPD\SqmUpload_S-1-5-21-1341208516-2984071467-593012157-1001 -> No File <==== ATTENTION
Task: {827D7DBC-B275-411E-A146-B8D315A96741} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1341208516-2984071467-593012157-1001UA1d23702490d345b => C:\Users\NG\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2016-11-05] (Dropbox, Inc.)
Task: {82C23161-86DB-4816-A8A9-E2E94E3973B5} - System32\Tasks\SettingsHibernateMonitor => C:\Program Files (x86)\Samsung\Settings\SettingsHibernateMonitor.exe [2015-06-24] (Samsung Electronics CO., LTD.)
Task: {8383CC46-1C6D-4370-A382-62CFAEEC1712} - System32\Tasks\AdobeAAMUpdater-1.0-NG-NTB-NG => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2016-07-01] (Adobe Systems Incorporated)
Task: {85A67450-CE0C-4B9A-B9B2-EF736DBDF55C} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {8DBEE4C7-3541-4D4F-BE3D-4344371B9C4D} - System32\Tasks\RTKCPL => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2015-09-23] (Realtek Semiconductor)
Task: {909F0605-0D08-4737-8A8A-A28B57A6E3F7} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {917D5837-B8CB-46E2-8441-781C7867D0CD} - System32\Tasks\IntelGfxColorWA2 => C:\ProgramData\Samsung\GFXPatch\IntelGfxColorWA2.exe [2014-07-25] (Samsung Electronics Co., Ltd.)
Task: {A2542B4A-4802-4B12-9900-36884DADEFF9} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {B085ADDB-E934-4854-BDDD-34E69A2B7180} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2017-01-12] (Microsoft Corporation)
Task: {B2DB622F-4D7D-45CD-9297-7B1C20C08EED} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
Task: {B3B169F8-CEFE-4D0A-89D4-EA80F101CB21} - \WPD\SqmUpload_S-1-5-21-1341208516-2984071467-593012157-1002 -> No File <==== ATTENTION
Task: {BCF8BD77-EA73-4889-9312-984255DDB1FF} - System32\Tasks\CCleanerSkipUAC => D:\Apps\CCleaner\CCleaner.exe [2016-08-27] (Piriform Ltd)
Task: {BDC9676E-CA63-4493-AAC7-82BA1F4EE43B} - \OfficeSoftwareProtectionPlatform\SvcRestartTask -> No File <==== ATTENTION
Task: {C4F66084-A005-41DF-AD5C-4B4731CAB161} - System32\Tasks\SettingsEventHandlerMonitor => C:\Program Files (x86)\Samsung\Settings\CmdServer\RSSettingEventHandler.exe [2015-06-24] (Samsung Electronics CO., LTD.)
Task: {CFDBAC60-F6E6-4929-B6E1-4720578CF797} - System32\Tasks\OneDrive Standalone Update Task => C:\Users\NG\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\OneDriveStandaloneUpdater.exe
Task: {DA8091DB-4583-40C1-89EC-26B83B28C041} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
Task: {DD234E5B-4B80-4706-BDD0-BE75341F8E01} - System32\Tasks\IdleStateFanCtrl => C:\ProgramData\Samsung\SamsungSystemConfiguration\IdleStateFanCtrl.exe [2014-03-19] (Samsung Electronics CO., LTD.)
Task: {E65F8190-5C5E-4A18-AFCD-CD7C1D11DAD7} - System32\Tasks\ShutdownOpt => C:\ProgramData\Samsung\ShutdownEvent.exe [2013-09-17] (SAMSUNG Electronics co., LTD.)
Task: {ECC5930B-B688-4B09-9A37-3818D82DA6CB} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {FF308900-46B2-4533-9427-E10A15FB0490} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-1341208516-2984071467-593012157-1001Core1d2370248faa6d7.job => C:\Users\NG\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-1341208516-2984071467-593012157-1001UA1d23702490d345b.job => C:\Users\NG\AppData\Local\Dropbox\Update\DropboxUpdate.exe
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
Shortcut: C:\Users\NG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\no_zooｍ_ｃhroｍe.exe.lnk -> C:\ProgramData\no_zooｍ_ｃhroｍe.exe.lnk.bat ()
ShortcutWithArgument: C:\Users\NG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Aplikace Chrome\Hudba Google Play (1).lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory="Profile 1" --app-id=fahmaaghhglfmonjliepjlchgpgfmobi
ShortcutWithArgument: C:\Users\NG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Aplikace Chrome\Hudba Google Play.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=fahmaaghhglfmonjliepjlchgpgfmobi
ShortcutWithArgument: C:\Users\NG\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\e4326e3335cd16c6\Pushbullet.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory="Profile 1" --app-id=chlffgpmiacpedhhbkiomidkjlcfhogd
ShortcutWithArgument: C:\Users\NG\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\a41ce5b91aa3166e\MightyText - SMS Text Messaging ⟷ Computer.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=dkfhfaphfkopdgpbfkebjfcblcafcmpi
ShortcutWithArgument: C:\Users\NG\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\3e2d507742482bc7\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=pherlerspclipickwzy
==================== Loaded Modules (Whitelisted) ==============
2016-07-17 00:42 - 2016-07-17 00:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-12-15 00:13 - 2016-12-09 23:29 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-12-15 00:13 - 2016-12-09 23:29 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll
2016-10-04 03:57 - 2016-10-04 03:57 - 00052400 _____ () D:\Apps\FileZilla\FileZilla FTP Client\fzshellext_64.dll
2016-06-10 01:41 - 2016-06-10 01:41 - 00491184 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll
2016-10-24 05:45 - 2016-10-24 05:45 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2017-01-12 20:26 - 2016-12-21 20:09 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2017-01-12 20:26 - 2016-12-21 20:08 - 00693248 _____ () C:\Windows\ShellExperiences\MtcUvc.dll
2017-01-12 20:25 - 2016-12-21 19:54 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-01-12 20:25 - 2016-12-21 19:48 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-01-12 20:25 - 2016-12-21 19:48 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2017-01-12 20:25 - 2016-12-21 19:48 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2017-01-12 20:25 - 2016-12-21 19:53 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2016-07-20 01:05 - 2017-01-18 01:52 - 00401904 _____ () C:\WINDOWS\system32\igfxTray.exe
2017-01-26 17:15 - 2017-01-25 20:29 - 02459992 _____ () C:\Program Files (x86)\Google\Chrome\Application\56.0.2924.76\libglesv2.dll
2017-01-26 17:15 - 2017-01-25 20:29 - 00099672 _____ () C:\Program Files (x86)\Google\Chrome\Application\56.0.2924.76\libegl.dll
2016-12-02 02:09 - 2016-12-02 02:09 - 00866224 _____ () D:\Apps\QuikGoPro\GoPro Desktop App\GoProDesktopSystemTray.exe
2016-10-01 07:08 - 2016-10-01 07:08 - 31723696 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
2015-06-24 17:05 - 2015-06-24 17:05 - 00211064 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\WinCRT.dll
2016-10-12 17:28 - 2016-10-12 17:28 - 40523456 _____ () C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\CEF\libcef.dll
2016-10-12 01:08 - 2016-10-12 01:08 - 00118272 _____ () \\?\C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\js\node_modules\fs-ext\build\Release\fs-ext.node
2016-10-12 01:08 - 2016-10-12 01:08 - 00223232 _____ () \\?\C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\js\node_modules\node-vulcanjs\build\Release\VulcanJS.node
2016-10-12 01:08 - 2016-10-12 01:08 - 00117248 _____ () \\?\C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\js\node_modules\ref\build\Release\binding.node
2016-10-12 01:08 - 2016-10-12 01:08 - 00124928 _____ () \\?\C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\js\node_modules\ffi\build\Release\ffi_bindings.node
2016-10-12 20:11 - 2016-10-12 20:11 - 00098496 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\js\node_modules\node-ProxyResolver\build\Release\ProxyResolverWin.dll
2016-10-12 01:08 - 2016-10-12 01:08 - 00166400 _____ () \\?\C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\js\node_modules\idle-gc\build\Release\idle-gc.node
2014-10-25 23:20 - 2014-03-18 20:10 - 00022920 _____ () C:\ProgramData\Samsung\SamsungSystemConfiguration\wsabi.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\ProgramData\TEMP:054203E4 [302]
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-23 02:25 - 2017-01-26 10:10 - 00001508 ____A C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 localhost
127.0.0.1 stage.localhost127.0.0.1 dev.ccri.cz
127.0.0.1 www.dev.ccri.cz
127.0.0.1 code.ccri.cz
127.0.0.1 www.code.ccri.cz127.0.0.1 www.dev.tb.cz
127.0.0.1 dev.tb.cz127.0.0.1 dev.admin.modgen.net
127.0.0.1 www.dev.admin.modgen.net
127.0.0.1 code.admin.modgen.net
127.0.0.1 www.code.admin.modgen.net130.195.2.40 stage.victoria.ac.nz
130.195.2.40 cms.victoria.ac.nz
127.0.0.1 local.victoria.ac.nz
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1341208516-2984071467-593012157-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\NG\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppBackground\{2020c6d1-2069-4073-a1ad-1f5995f75f52}.jpg
DNS Servers: 192.168.2.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: AdobeUpdateService => 2
MSCONFIG\Services: AGSService => 2
MSCONFIG\Services: GoProDeviceDetectionService => 2
MSCONFIG\Services: PnkBstrA => 2
MSCONFIG\Services: postgresql-x64-9.3 => 2
MSCONFIG\Services: SWUpdateService => 2
HKLM\...\StartupApproved\StartupFolder: => "GoPro Importer.lnk"
HKLM\...\StartupApproved\Run: => "BTMTrayAgent"
HKLM\...\StartupApproved\Run: => "AdobeAAMUpdater-1.0"
HKLM\...\StartupApproved\Run: => "Logitech Download Assistant"
HKLM\...\StartupApproved\Run32: => "AdobeCS6ServiceManager"
HKLM\...\StartupApproved\Run32: => "APSDaemon"
HKLM\...\StartupApproved\Run32: => "MMReminderService"
HKLM\...\StartupApproved\Run32: => "QuickTime Task"
HKLM\...\StartupApproved\Run32: => "SwitchBoard"
HKLM\...\StartupApproved\Run32: => "AdobeCEPServiceManager"
HKLM\...\StartupApproved\Run32: => "Adobe ARM"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "VirtualCloneDrive"
HKLM\...\StartupApproved\Run32: => "Cisco AnyConnect Secure Mobility Agent for Windows"
HKLM\...\StartupApproved\Run32: => "AdobeAAMUpdater-1.0"
HKU\S-1-5-21-1341208516-2984071467-593012157-1001\...\StartupApproved\StartupFolder: => "EvernoteClipper.lnk"
HKU\S-1-5-21-1341208516-2984071467-593012157-1001\...\StartupApproved\Run: => "Dropbox Update"
HKU\S-1-5-21-1341208516-2984071467-593012157-1001\...\StartupApproved\Run: => "CCleaner Monitoring"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [vm-monitoring-nb-session] => LPort=139
FirewallRules: [{A6C7E23B-2B78-49CB-9FE5-3DF3C157203C}] => D:\Apps\Firefox\firefox.exe
FirewallRules: [{F7D904A0-B785-497E-8358-2F79C1FE8E1B}] => D:\Apps\Firefox\firefox.exe
FirewallRules: [UDP Query User{D3299861-8070-4DE3-8DA4-58FCEEA6D830}C:\users\ng\downloads\microsoft-office-2013-professional-plus-cz-+-crack-[kedar_cz]\microsoft office 2013 professional plus\microsoft toolkit 2.4.5.exe] => C:\users\ng\downloads\microsoft-office-2013-professional-plus-cz-+-crack-[kedar_cz]\microsoft office 2013 professional plus\microsoft toolkit 2.4.5.exe
FirewallRules: [TCP Query User{4AB584C3-F38B-4046-B013-E70D8CF4850F}C:\users\ng\downloads\microsoft-office-2013-professional-plus-cz-+-crack-[kedar_cz]\microsoft office 2013 professional plus\microsoft toolkit 2.4.5.exe] => C:\users\ng\downloads\microsoft-office-2013-professional-plus-cz-+-crack-[kedar_cz]\microsoft office 2013 professional plus\microsoft toolkit 2.4.5.exe
FirewallRules: [{DA884EA8-CCCD-4BD5-AABC-D9BC84462DB7}] => C:\Users\NG\AppData\Local\Temp\MPCOnline\MPCDownload.exe
FirewallRules: [{01ECDCF8-4FED-4C26-BF2C-B689E8C27F9B}] => C:\Users\NG\AppData\Local\Temp\MPCOnline\MPCDownload.exe
FirewallRules: [{C3C222A1-B305-4CB6-8CBC-F3A08E96641C}] => C:\Program Files\Bignox\BigNoxVM\RTNoxVMHandle.exe
FirewallRules: [{AB5883B8-CBE2-4096-8560-0817B1830E01}] => C:\Users\NG\AppData\Roaming\Nox\bin\Nox.exe
FirewallRules: [UDP Query User{2C46A2C0-E818-4CAA-896E-142506F6C0EB}C:\games\starcraft ii\versions\base43478\sc2_x64.exe] => C:\games\starcraft ii\versions\base43478\sc2_x64.exe
FirewallRules: [TCP Query User{FF6BAD8A-4058-48D9-9DDF-4ADECE6FC694}C:\games\starcraft ii\versions\base43478\sc2_x64.exe] => C:\games\starcraft ii\versions\base43478\sc2_x64.exe
FirewallRules: [UDP Query User{966E73BA-E2F7-4B23-B8B1-28FA856873B5}C:\games\starcraft ii\versions\base42932\sc2_x64.exe] => C:\games\starcraft ii\versions\base42932\sc2_x64.exe
FirewallRules: [TCP Query User{00F5EE8D-C1C9-4C57-B2ED-7D15B387CDF6}C:\games\starcraft ii\versions\base42932\sc2_x64.exe] => C:\games\starcraft ii\versions\base42932\sc2_x64.exe
FirewallRules: [UDP Query User{7C663382-AFBF-4AA0-AFCE-3DFE0513EB4A}C:\games\hearthstone\hearthstone.exe] => C:\games\hearthstone\hearthstone.exe
FirewallRules: [TCP Query User{B8DE66C1-00E2-414C-B4AB-8A6DFBF30D40}C:\games\hearthstone\hearthstone.exe] => C:\games\hearthstone\hearthstone.exe
FirewallRules: [UDP Query User{A9EA6715-E36C-4C16-A7C3-3F95EA46D847}C:\games\overwatch\overwatch.exe] => C:\games\overwatch\overwatch.exe
FirewallRules: [TCP Query User{4D5A824B-4CA6-48FC-8662-DBC48E2B743B}C:\games\overwatch\overwatch.exe] => C:\games\overwatch\overwatch.exe
FirewallRules: [UDP Query User{06485021-CA6A-446C-A3D1-F35F3F564714}D:\games\xcom 2\binaries\win64\xcom2.exe] => D:\games\xcom 2\binaries\win64\xcom2.exe
FirewallRules: [TCP Query User{6A224766-3C8E-46F1-B370-21BD5F1E7947}D:\games\xcom 2\binaries\win64\xcom2.exe] => D:\games\xcom 2\binaries\win64\xcom2.exe
FirewallRules: [UDP Query User{23F22206-D36B-4C48-A0A4-38987FE8B1FD}C:\games\starcraft ii\versions\base42253\sc2_x64.exe] => C:\games\starcraft ii\versions\base42253\sc2_x64.exe
FirewallRules: [TCP Query User{815FE612-8A6A-4619-8030-795E417582A1}C:\games\starcraft ii\versions\base42253\sc2_x64.exe] => C:\games\starcraft ii\versions\base42253\sc2_x64.exe
FirewallRules: [UDP Query User{9B6EB4CD-7E53-4E6F-8121-619F6F19641C}D:\dropbox\codevels\devtools\node.js\node.exe] => D:\dropbox\codevels\devtools\node.js\node.exe
FirewallRules: [TCP Query User{89696AAD-6214-4E6F-A15E-D0BC213EE669}D:\dropbox\codevels\devtools\node.js\node.exe] => D:\dropbox\codevels\devtools\node.js\node.exe
FirewallRules: [UDP Query User{D3462247-67A8-4FCC-B49B-7DF3C10D5E67}C:\games\starcraft ii\versions\base41743\sc2_x64.exe] => C:\games\starcraft ii\versions\base41743\sc2_x64.exe
FirewallRules: [TCP Query User{D33E5D5F-F10C-4850-9608-C2C2D21AFCF8}C:\games\starcraft ii\versions\base41743\sc2_x64.exe] => C:\games\starcraft ii\versions\base41743\sc2_x64.exe
FirewallRules: [UDP Query User{F7A77FE5-85A2-4A07-B3CD-040D63CCEB0A}C:\games\left 4 dead 2\left4dead2.exe] => C:\games\left 4 dead 2\left4dead2.exe
FirewallRules: [TCP Query User{545863B7-9F8A-443E-B364-DEF85E86E28C}C:\games\left 4 dead 2\left4dead2.exe] => C:\games\left 4 dead 2\left4dead2.exe
FirewallRules: [UDP Query User{E750CAAA-6D95-43AD-8709-C260CDFFBC2F}C:\games\left 4 dead 2\left4dead2.exe] => C:\games\left 4 dead 2\left4dead2.exe
FirewallRules: [TCP Query User{256F664A-57CC-4744-AC52-A20C6CD38965}C:\games\left 4 dead 2\left4dead2.exe] => C:\games\left 4 dead 2\left4dead2.exe
FirewallRules: [UDP Query User{013FECAB-14A4-4B0D-ABF5-E887FF2428E0}C:\games\unrealtournament\system\unrealtournament.exe] => C:\games\unrealtournament\system\unrealtournament.exe
FirewallRules: [TCP Query User{F8174969-C7B9-456A-AF85-F7E0E9565F38}C:\games\unrealtournament\system\unrealtournament.exe] => C:\games\unrealtournament\system\unrealtournament.exe
FirewallRules: [UDP Query User{0734D25B-5829-47D2-A33E-178EE990F770}C:\games\starcraft ii\versions\base41743\sc2_x64.exe] => C:\games\starcraft ii\versions\base41743\sc2_x64.exe
FirewallRules: [TCP Query User{E4F89B10-C349-4C31-8875-DE5E5A85ED78}C:\games\starcraft ii\versions\base41743\sc2_x64.exe] => C:\games\starcraft ii\versions\base41743\sc2_x64.exe
FirewallRules: [UDP Query User{D2996139-5F51-4212-8533-68BCFA6128E2}C:\games\starcraft ii\versions\base39576\sc2_x64.exe] => C:\games\starcraft ii\versions\base39576\sc2_x64.exe
FirewallRules: [TCP Query User{16AB17E6-910A-4CB8-8D01-1913B2F99E68}C:\games\starcraft ii\versions\base39576\sc2_x64.exe] => C:\games\starcraft ii\versions\base39576\sc2_x64.exe
FirewallRules: [UDP Query User{45E53A7A-137D-4223-B312-F60C1E641151}D:\games\xcom\steamapps\depotcache\xcom 2\binaries\win64\xcom2.exe] => D:\games\xcom\steamapps\depotcache\xcom 2\binaries\win64\xcom2.exe
FirewallRules: [TCP Query User{BDC3BD1A-5BB7-4E21-9A51-89EFB39151A2}D:\games\xcom\steamapps\depotcache\xcom 2\binaries\win64\xcom2.exe] => D:\games\xcom\steamapps\depotcache\xcom 2\binaries\win64\xcom2.exe
FirewallRules: [{1FD62836-56FF-42A8-A4AF-74529D9ACAA3}] => C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [UDP Query User{724D53C6-705E-4CB3-B43F-02608F7C7AC1}D:\apps\firefox\firefox.exe] => D:\apps\firefox\firefox.exe
FirewallRules: [TCP Query User{03578233-F15E-41A0-978A-6B685EC46263}D:\apps\firefox\firefox.exe] => D:\apps\firefox\firefox.exe
FirewallRules: [UDP Query User{F32CEE0D-ECB4-47EB-8AE4-6399AB267A6C}D:\dropbox\codevels\devtools\ruby\bin\ruby.exe] => D:\dropbox\codevels\devtools\ruby\bin\ruby.exe
FirewallRules: [TCP Query User{58364074-5787-4B73-BED6-F30B0A897732}D:\dropbox\codevels\devtools\ruby\bin\ruby.exe] => D:\dropbox\codevels\devtools\ruby\bin\ruby.exe
FirewallRules: [UDP Query User{DE93B902-B85C-4854-BE94-3332AAFA24C0}C:\users\ng\downloads\wifi_speed_test_server.exe] => C:\users\ng\downloads\wifi_speed_test_server.exe
FirewallRules: [TCP Query User{FC297728-13EE-4A3D-BADF-9E30BA698363}C:\users\ng\downloads\wifi_speed_test_server.exe] => C:\users\ng\downloads\wifi_speed_test_server.exe
FirewallRules: [UDP Query User{6CAF321E-1E8E-41B7-B72F-DD2316EF96F5}D:\games\heroes of the storm\versions\base34659\heroesofthestorm_x64.exe] => D:\games\heroes of the storm\versions\base34659\heroesofthestorm_x64.exe
FirewallRules: [TCP Query User{C9346E09-D55C-4E86-941E-6A1955CCF113}D:\games\heroes of the storm\versions\base34659\heroesofthestorm_x64.exe] => D:\games\heroes of the storm\versions\base34659\heroesofthestorm_x64.exe
FirewallRules: [UDP Query User{02F560F7-F5E8-4EC8-8629-97809732713F}D:\apps\skype\phone\skype.exe] => D:\apps\skype\phone\skype.exe
FirewallRules: [TCP Query User{84A42D7E-D813-4001-BDFC-CAA7B10B5A05}D:\apps\skype\phone\skype.exe] => D:\apps\skype\phone\skype.exe
FirewallRules: [UDP Query User{8DF99BE6-ED69-45F7-906D-5B688564B083}C:\program files (x86)\starcraft ii\versions\base32283\sc2.exe] => C:\program files (x86)\starcraft ii\versions\base32283\sc2.exe
FirewallRules: [TCP Query User{A8593E4E-8894-40EB-80F6-FD52DC20F4EA}C:\program files (x86)\starcraft ii\versions\base32283\sc2.exe] => C:\program files (x86)\starcraft ii\versions\base32283\sc2.exe
FirewallRules: [{B6336367-E3F5-486E-BF7C-22EDE6B58BAC}] => C:\Program Files (x86)\StarCraft II\StarCraft II.exe
FirewallRules: [{6349DB12-5A7D-4F7F-965D-7AF8EF860882}] => C:\Program Files (x86)\StarCraft II\StarCraft II.exe
FirewallRules: [{E9B13221-76A9-47BE-9B4F-C23B88440002}] => D:\Games\Bnet\Battle.net\Battle.net.exe
FirewallRules: [{D2C83B34-14AB-4DD5-A338-AC2EFD89DD0F}] => D:\Games\Bnet\Battle.net\Battle.net.exe
FirewallRules: [UDP Query User{2952968B-FDCE-4284-A7FA-63989B12218E}D:\games\starcraft\starcraft\starcraft.exe] => D:\games\starcraft\starcraft\starcraft.exe
FirewallRules: [TCP Query User{1046E745-51B8-420A-84AB-36C07DD60A36}D:\games\starcraft\starcraft\starcraft.exe] => D:\games\starcraft\starcraft\starcraft.exe
FirewallRules: [UDP Query User{B18A6A63-705A-4193-8714-0B55E9A2308D}D:\games\gh3\gh3.exe] => D:\games\gh3\gh3.exe
FirewallRules: [TCP Query User{E5C08494-3F9E-410D-9B12-3D1CABCF17EB}D:\games\gh3\gh3.exe] => D:\games\gh3\gh3.exe
FirewallRules: [{C84771C1-9A8F-4A91-9FE4-D92CC8BD36EA}] => D:\Apps\MSOffice\Office14\GROOVE.EXE
FirewallRules: [{A572664C-5FB9-46E7-AB6A-03A82876646E}] => LPort=1900
FirewallRules: [{1E7445CD-7308-49CD-9EAA-2544E4B28718}] => LPort=2869
FirewallRules: [{9ED8E504-B5FA-44A2-8C44-3E831F7C4E3A}] => C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{F6FBA829-633E-401E-B2F1-9413A1F93E2A}] => D:\Apps\PhotoshopCC\Adobe Photoshop CC 2014\Photoshop.exe
FirewallRules: [{3504863B-F818-4E16-9A85-175FA4E863F3}] => D:\Apps\PhotoshopCC\Adobe Photoshop CC 2014\Photoshop.exe
FirewallRules: [{6D04D97D-EDC9-48E3-8E0A-78E9B1743EAB}] => D:\Apps\Lightroom5\lightroom.exe
FirewallRules: [{1B788054-196D-4801-A005-3BEC0F245A05}] => C:\Users\NG\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{5394E7D7-6996-4896-94A4-92DF1C81297B}] => C:\Users\NG\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [UDP Query User{3041BC19-67C0-4DE3-886E-3A088C396AD5}D:\apps\wamp\bin\apache\apache2.4.9\bin\httpd.exe] => D:\apps\wamp\bin\apache\apache2.4.9\bin\httpd.exe
FirewallRules: [TCP Query User{F9D584AB-6BF4-4F5D-817C-7A54305C1BF4}D:\apps\wamp\bin\apache\apache2.4.9\bin\httpd.exe] => D:\apps\wamp\bin\apache\apache2.4.9\bin\httpd.exe
FirewallRules: [UDP Query User{4FA02E0C-2E74-4965-BE13-C41C02CDBC5C}C:\users\ng\appdata\roaming\dropbox\bin\dropbox.exe] => C:\users\ng\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [TCP Query User{B2DF4C0D-5205-4121-B77D-79A10117738E}C:\users\ng\appdata\roaming\dropbox\bin\dropbox.exe] => C:\users\ng\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{AEB7CCBF-CAAF-421A-B3CA-9D10C4C757CC}] => C:\Users\NG\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{CAB0B899-A39A-414C-B74D-804A69DE2FFD}] => C:\Users\NG\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{FF1B9C7A-B023-4D7B-9C14-BDF2FCF64C3E}] => C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [{60A56908-14D6-4AED-8DEF-BF5B848F6C87}] => C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [{13531E42-A4B8-4EE4-A474-9DC1B7CCDABA}] => LPort=1900
FirewallRules: [{751B363D-F5B8-4932-8B99-593D3B1D7C22}] => LPort=7900
FirewallRules: [{60C8834F-6786-423A-9C2F-2B04701BA6F1}] => LPort=24234
FirewallRules: [{C9FFC453-C685-4CE4-BBA6-5CBC582D9AEF}] => LPort=7679
FirewallRules: [{9AFDB637-0AFC-4C99-BB80-05383DBFC1F5}] => LPort=7676
FirewallRules: [{4E65F180-4DED-4C22-8FD2-2D5A62EE9557}] => LPort=8643
FirewallRules: [{23842018-ED38-4310-AAC9-4B4A2E49DE4F}] => LPort=8743
FirewallRules: [{BC56ADC2-9390-4983-8AA4-15775A26F94E}] => C:\Program Files\Samsung\AllShare Framework DMS\1.3.18\AllShareFrameworkDMS.exe
FirewallRules: [{07A26CE5-E05C-4C06-96F9-AF67BAA92373}] => C:\Program Files\Samsung\AllShare Framework DMS\1.3.18\AllShareFrameworkDMS.exe
FirewallRules: [{54B5F467-76E3-4ECE-AF03-42F3C8F27DE2}] => C:\Program Files\Samsung\AllShare Framework DMS\1.3.18\AllShareFrameworkDMS.exe
FirewallRules: [{B64BE013-6DFC-40B1-A661-501EF1282EC7}] => C:\Program Files\Samsung\AllShare Framework DMS\1.3.18\AllShareFrameworkDMS.exe
FirewallRules: [TCP Query User{763F1E33-1A3F-4F93-A1F4-43DEB76EE6A2}D:\dropbox\codevels\devtools\node.js\node.exe] => D:\dropbox\codevels\devtools\node.js\node.exe
FirewallRules: [UDP Query User{A99F2F1F-AA1F-4C51-954C-E702513F0CA3}D:\dropbox\codevels\devtools\node.js\node.exe] => D:\dropbox\codevels\devtools\node.js\node.exe
FirewallRules: [{3CB882A0-8F12-4EF2-8A1D-DDA6551533BF}] => C:\Games\Steam\Steam.exe
FirewallRules: [{E1DE5DAA-C213-4F0D-8C82-7E0AEA02293F}] => C:\Games\Steam\Steam.exe
FirewallRules: [{1898CC25-F017-4B63-946C-8AAA191B5444}] => C:\Games\Steam\bin\steamwebhelper.exe
FirewallRules: [{4D7CDEA0-4359-4FAE-94B7-6C9848F1BC66}] => C:\Games\Steam\bin\steamwebhelper.exe
FirewallRules: [{F909B10E-1A9B-4DD1-BD08-580E9B3DD913}] => C:\Games\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{EF03E0FE-966A-43B1-B7C7-8F2BBFF497E5}] => C:\Games\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [TCP Query User{65269872-2591-4932-A2F1-E996A6061F47}C:\program files\logitech gaming software\lcore.exe] => C:\program files\logitech gaming software\lcore.exe
FirewallRules: [UDP Query User{44A9DD36-5160-4BFD-9F9E-791B0DBF9FBC}C:\program files\logitech gaming software\lcore.exe] => C:\program files\logitech gaming software\lcore.exe
FirewallRules: [TCP Query User{6B7E9C63-10D5-4CB0-84E8-BF69DE20E54C}D:\games\nvn\neverwinter_en\neverwinter\live\gameclient.exe] => D:\games\nvn\neverwinter_en\neverwinter\live\gameclient.exe
FirewallRules: [UDP Query User{6AF522AD-3BD7-4D21-9C02-6C36A8D0962F}D:\games\nvn\neverwinter_en\neverwinter\live\gameclient.exe] => D:\games\nvn\neverwinter_en\neverwinter\live\gameclient.exe
FirewallRules: [TCP Query User{8090D879-501D-492C-9AC4-035B3D6EB445}D:\dropbox\codevels\devtools\ruby\bin\ruby.exe] => D:\dropbox\codevels\devtools\ruby\bin\ruby.exe
FirewallRules: [UDP Query User{48BFD708-CFE0-4DE5-8E6C-D4A55A3150A6}D:\dropbox\codevels\devtools\ruby\bin\ruby.exe] => D:\dropbox\codevels\devtools\ruby\bin\ruby.exe
FirewallRules: [TCP Query User{9E72E14F-27B2-4263-AB0E-7FA9AF66C314}C:\games\bnet\battle.net\battle.net.8098\battle.net.exe] => C:\games\bnet\battle.net\battle.net.8098\battle.net.exe
FirewallRules: [UDP Query User{38F3EE79-0610-4714-B110-CE8C83738931}C:\games\bnet\battle.net\battle.net.8098\battle.net.exe] => C:\games\bnet\battle.net\battle.net.8098\battle.net.exe
FirewallRules: [{227B1AE6-756D-4AE5-ABB2-F5C0C80EE8DB}] => D:\Games\WarOfWarships\WoWSLauncher.exe
FirewallRules: [{A5249309-25B0-4854-8E65-12A5AFCE3773}] => D:\Games\WarOfWarships\WoWSLauncher.exe
FirewallRules: [{8658C2B7-CE55-405D-B98F-CE5F0F763F22}] => D:\Games\WarOfWarships\worldofwarships.exe
FirewallRules: [{02624C73-AB1A-423D-90DB-9FCA4A3590AC}] => D:\Games\WarOfWarships\worldofwarships.exe
FirewallRules: [{AE7E9574-EE7C-4F3D-A31E-FD054A86D1F4}] => D:\Games\World_of_Warships\WoWSLauncher.exe
FirewallRules: [{921A918C-1BD4-4350-AB96-9B3AA74C4ED8}] => D:\Games\World_of_Warships\WoWSLauncher.exe
FirewallRules: [{4A072A2E-E802-4F75-BA90-888095E91412}] => D:\Games\World_of_Warships\worldofwarships.exe
FirewallRules: [{C007EA6B-6A05-4BF5-B539-CE87021313F8}] => D:\Games\World_of_Warships\worldofwarships.exe
FirewallRules: [TCP Query User{8EC3D2C6-0BF9-47DB-94E2-55844605C48E}C:\games\starcraft ii\versions\base47185\sc2_x64.exe] => C:\games\starcraft ii\versions\base47185\sc2_x64.exe
FirewallRules: [UDP Query User{EE1E0DFD-BCD0-4126-95B6-97BDF32AFB2E}C:\games\starcraft ii\versions\base47185\sc2_x64.exe] => C:\games\starcraft ii\versions\base47185\sc2_x64.exe
FirewallRules: [TCP Query User{A668036C-63AD-41E1-A929-42BEAE18F1E9}C:\games\firewatch\firewatch.exe] => C:\games\firewatch\firewatch.exe
FirewallRules: [UDP Query User{D8835FC2-EAF4-49EF-A5AE-D24F1DC491F0}C:\games\firewatch\firewatch.exe] => C:\games\firewatch\firewatch.exe
FirewallRules: [{87896745-D720-466A-B6AD-5AD0CFF0670F}] => C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{91779B20-534F-4512-ACBC-14A0A900192A}] => C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{A4928EC1-E953-4BC1-ACC8-867E041C04CB}] => C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{F36E27E8-AE86-4BC6-A74A-41F1CB4C1700}] => C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [TCP Query User{916ACD7D-EC39-46AF-97CC-9D63C12E63E7}D:\program files (x86)\origin games\battlefield 4\bf4.exe] => D:\program files (x86)\origin games\battlefield 4\bf4.exe
FirewallRules: [UDP Query User{FB1E3706-A821-45E9-A663-5C188787848E}D:\program files (x86)\origin games\battlefield 4\bf4.exe] => D:\program files (x86)\origin games\battlefield 4\bf4.exe
FirewallRules: [TCP Query User{9495A682-DB86-457C-AB60-5BE82ACE7875}D:\games\maxpayne3\maxpayne3.exe] => D:\games\maxpayne3\maxpayne3.exe
FirewallRules: [UDP Query User{C4432B8D-3AF8-4AEF-B5BC-269D90925057}D:\games\maxpayne3\maxpayne3.exe] => D:\games\maxpayne3\maxpayne3.exe
FirewallRules: [{FDD28A5E-9804-4467-858A-56F0E6D0602D}] => D:\Apps\MSOffice2013\Office15\lync.exe
FirewallRules: [{FAB76CBF-EC48-45FF-A674-E1B23366A4F4}] => D:\Apps\MSOffice2013\Office15\lync.exe
FirewallRules: [{EC2BFFFB-1F24-455A-9C4C-77637CF3AD13}] => D:\Apps\MSOffice2013\Office15\UcMapi.exe
FirewallRules: [{F6B72990-3617-4D12-A0C0-75FDDACBA21A}] => D:\Apps\MSOffice2013\Office15\UcMapi.exe
FirewallRules: [{37DEDD1D-118B-40E8-8CA8-4CEA8667EC8A}] => D:\Apps\QuikGoPro\GoPro Desktop App\Quik.exe
FirewallRules: [{D6301CFB-547D-44A8-8220-1E9E6D0D893B}] => D:\Apps\QuikGoPro\GoPro Desktop App\GoProMsgBus.exe
FirewallRules: [{17EBB74E-6A0D-4A37-A57F-14AA9E4DCC8F}] => D:\Apps\QuikGoPro\GoPro Desktop App\GoProIDService.exe
FirewallRules: [{4D707E83-EF2D-4232-BEB5-32D35157699D}] => D:\Apps\QuikGoPro\GoPro Desktop App\GoProLauncher.exe
FirewallRules: [{00D3F097-A12E-4433-9502-F1B98F7666B5}] => D:\Apps\Opera\42.0.2393.137\opera.exe
FirewallRules: [{778D2218-4E88-408E-8CC0-11126ED9121D}] => D:\Apps\Opera\42.0.2393.517\opera.exe
FirewallRules: [{11D8B3BB-352C-4212-B0A1-83A05BAC7433}] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Restore Points =========================
ATTENTION: System Restore is disabled
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (02/03/2017 05:06:25 PM) (Source: iBTAudioSrv) (EventID: 0) (User: )
Description: Event-ID 0
Error: (02/03/2017 03:49:47 PM) (Source: iBTAudioSrv) (EventID: 0) (User: )
Description: Event-ID 0
Error: (02/03/2017 01:10:40 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT AUTHORITY)
Description: Skipping: Eap method DLL path validation failed. Error: typeId=43, authorId=9, vendorId=0, vendorType=0
Error: (02/03/2017 01:10:40 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT AUTHORITY)
Description: Skipping: Eap method DLL path validation failed. Error: typeId=25, authorId=9, vendorId=0, vendorType=0
Error: (02/03/2017 01:10:40 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT AUTHORITY)
Description: Skipping: Eap method DLL path validation failed. Error: typeId=17, authorId=9, vendorId=0, vendorType=0
Error: (02/03/2017 01:10:40 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT AUTHORITY)
Description: Skipping: Eap method DLL path validation failed. Error: typeId=43, authorId=9, vendorId=0, vendorType=0
Error: (02/03/2017 01:10:40 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT AUTHORITY)
Description: Skipping: Eap method DLL path validation failed. Error: typeId=25, authorId=9, vendorId=0, vendorType=0
Error: (02/03/2017 01:10:40 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT AUTHORITY)
Description: Skipping: Eap method DLL path validation failed. Error: typeId=17, authorId=9, vendorId=0, vendorType=0
Error: (02/01/2017 04:46:53 PM) (Source: iBTAudioSrv) (EventID: 0) (User: )
Description: Event-ID 0
Error: (02/01/2017 07:33:56 AM) (Source: iBTAudioSrv) (EventID: 0) (User: )
Description: Event-ID 0
System errors:
=============
Error: (02/03/2017 05:06:04 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (02/03/2017 04:03:20 PM) (Source: DCOM) (EventID: 10010) (User: NG-NTB)
Description: The server {DABF28BE-F6B4-4E40-8F40-C4FB26F3116C} did not register with DCOM within the required timeout.
Error: (02/03/2017 04:02:40 PM) (Source: DCOM) (EventID: 10010) (User: NG-NTB)
Description: The server {DABF28BE-F6B4-4E40-8F40-C4FB26F3116C} did not register with DCOM within the required timeout.
Error: (02/03/2017 03:53:14 PM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)
Description: The server {784E29F4-5EBE-4279-9948-1E8FE941646D} did not register with DCOM within the required timeout.
Error: (02/03/2017 03:52:08 PM) (Source: DCOM) (EventID: 10010) (User: NG-NTB)
Description: The server {DABF28BE-F6B4-4E40-8F40-C4FB26F3116C} did not register with DCOM within the required timeout.
Error: (02/03/2017 03:51:38 PM) (Source: DCOM) (EventID: 10010) (User: NG-NTB)
Description: The server {DABF28BE-F6B4-4E40-8F40-C4FB26F3116C} did not register with DCOM within the required timeout.
Error: (02/03/2017 03:50:12 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (02/03/2017 03:50:12 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (02/03/2017 03:50:11 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
and APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (02/03/2017 01:10:05 AM) (Source: DCOM) (EventID: 10010) (User: NG-NTB)
Description: The server Windows.Media.Capture.Internal.AppCaptureShell did not register with DCOM within the required timeout.
CodeIntegrity:
===================================
Date: 2017-02-03 17:06:07.101
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-01-31 08:36:59.914
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-01-29 17:45:15.978
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-01-27 06:59:20.015
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-01-13 21:56:06.003
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-12-15 21:10:49.437
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-12-14 15:17:27.314
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-12-08 09:13:47.757
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-11-04 20:31:29.612
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-11-04 20:31:29.584
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-4500U CPU @ 1.80GHz
Percentage of memory in use: 66%
Total physical RAM: 8106.94 MB
Available physical RAM: 2695.11 MB
Total Virtual: 11761.57 MB
Available Virtual: 4668.34 MB
==================== Drives ================================
Drive c: (_Core) (Fixed) (Total:115.71 GB) (Free:3.18 GB) NTFS
Drive d: (_Data) (Fixed) (Total:107.86 GB) (Free:6.15 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 238.5 GB) (Disk ID: 16CEE6F6)
Partition: GPT.
==================== End of Addition.txt ============================
Re: HOSTS soubor s cizími adresami (AdClick virus?)
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 29-01-2017
Ran by NG (administrator) on NG-NTB (03-02-2017 19:17:38)
Running from C:\Users\NG\Downloads
Loaded Profiles: NG (Available Profiles: NG & Visitor)
Platform: Windows 10 Home Version 1607 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Intel Corporation) C:\Windows\System32\ibtsiva.exe
(Intel Corporation) C:\Program Files (x86)\Intel\HPWA\iBTAudioSrv.exe
(Intel Corporation) C:\Windows\SysWOW64\IntelCpHeciSvc.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\CmdServer\SettingsLauncher.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(SAMSUNG Electronics co., LTD.) C:\ProgramData\Samsung\ShutdownEvent.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDTouch.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
() C:\Windows\System32\igfxTray.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\CmdServer\SettingsCmdServer.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\CmdServer\SettingsEventHandler.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
() D:\Apps\QuikGoPro\GoPro Desktop App\GoProDesktopSystemTray.exe
(Flux Software LLC) C:\Users\NG\AppData\Local\FluxSoftware\Flux\flux.exe
(Intel Corporation) C:\Program Files (x86)\Intel\HPWA\iBTAudioMon.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe
(SAMSUNG Electronics co., LTD.) C:\ProgramData\Samsung\ShutdownEvent.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\CCXProcess.exe
(Node.js) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\libs\node.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Gold Click Ltd) C:\Users\NG\AppData\Roaming\ProxyGate\Cloud.exe
(Gold Click Ltd) C:\Users\NG\AppData\Roaming\ProxyGate\PGChk.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OFFICE15\CSISYNCCLIENT.EXE
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\S Agent\CommonAgent.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Samsung Electronics CO., LTD.) C:\ProgramData\Samsung\SamsungSystemConfiguration\SamsungSystemConfiguration.exe
(Samsung Electronics CO., LTD.) C:\ProgramData\Samsung\SamsungSystemConfiguration\SamsungConfigurationMonitor.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Skype Technologies S.A.) D:\Apps\Skype\Phone\Skype.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Dominik Reichl) D:\OneDrive\Sync\Management\KeePass\KeePass.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ====================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [14040296 2015-09-23] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [3242200 2016-11-11] (ELAN Microelectronics Corp.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508128 2016-07-01] (Adobe Systems Incorporated)
HKLM\...\Run: [Launch LCore] => C:\Program Files\Logitech Gaming Software\LCore.exe [15009400 2015-10-15] (Logitech Inc.)
HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [631808 2016-10-24] (Microsoft Corporation)
HKLM\...\Run: [GoPro Tray App] => D:\Apps\QuikGoPro\GoPro Desktop App\GoProDesktopSystemTray.exe [866224 2016-12-02] ()
HKLM-x32\...\Run: [MMReminderService] => d:\Apps\MindjetManager\MMReminderService.exe [42312 2013-09-07] (Mindjet)
HKLM-x32\...\Run: [AdobeCEPServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe [1039240 2013-05-16] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-11] (Elaborate Bytes AG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-06-08] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2383040 2016-10-12] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKU\S-1-5-21-1341208516-2984071467-593012157-1001\...\Run: [Dropbox Update] => C:\Users\NG\AppData\Local\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-05] (Dropbox, Inc.)
HKU\S-1-5-21-1341208516-2984071467-593012157-1001\...\Run: [f.lux] => C:\Users\NG\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2013-10-24] (Flux Software LLC)
HKU\S-1-5-21-1341208516-2984071467-593012157-1001\...\Run: [ProxyGate] => C:\Users\NG\AppData\Roaming\ProxyGate\MainService.exe [1142880 2016-01-10] (Gold Click Ltd) <===== ATTENTION
HKU\S-1-5-21-1341208516-2984071467-593012157-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\windows\Screen_Samsung.scr [28182067 2012-10-09] ()
HKU\S-1-5-18\...\RunOnce: [Application Restart #2] => C:\ProgramData\Samsung\SamsungSystemConfiguration\SamsungConfigurationMonitor.exe [1779008 2014-03-19] (Samsung Electronics CO., LTD.)
HKU\S-1-5-18\...\RunOnce: [Application Restart #1] => C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe [371928 2016-07-17] (Microsoft Corporation)
HKU\S-1-5-18\...\RunOnce: [Application Restart #3] => C:\ProgramData\Samsung\SamsungSystemConfiguration\SamsungConfigurationMonitor.exe [1779008 2014-03-19] (Samsung Electronics CO., LTD.)
HKU\S-1-5-18\...\RunOnce: [Application Restart #0] => C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe [371928 2016-07-17] (Microsoft Corporation)
AppInit_DLLs: C:\Program Files => C:\Program Files [0 2016-12-11] ()
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-06-10] ()
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-06-10] ()
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-06-10] ()
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll [2017-01-19] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll [2017-01-19] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll [2017-01-19] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll [2017-01-19] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll [2017-01-19] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll [2017-01-19] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll [2017-01-19] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll [2017-01-19] (Dropbox, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\iBTAudioMon.lnk [2014-10-26]
ShortcutTarget: iBTAudioMon.lnk -> C:\Program Files (x86)\Intel\HPWA\iBTAudioMon.exe (Intel Corporation)
Startup: C:\Users\NG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk [2015-06-04]
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
Startup: C:\Users\NG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\no_zooｍ_ｃhroｍe.exe.lnk [2016-08-14]
ShortcutTarget: no_zooｍ_ｃhroｍe.exe.lnk -> C:\ProgramData\no_zooｍ_ｃhroｍe.exe.lnk.bat ()
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{e14adefe-a595-4014-9e9d-3d500381ef0c}: [DhcpNameServer] 192.168.2.1
Internet Explorer:
==================
HKU\S-1-5-21-1341208516-2984071467-593012157-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131192272023647558&GUID=C4A8A119-B2FA-4577-A3F9-DF837A28B43B
HKU\S-1-5-21-1341208516-2984071467-593012157-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://samsung13.msn.com/?pc=smjb
SearchScopes: HKU\S-1-5-21-1341208516-2984071467-593012157-1001 -> {A7816E13-C979-4EBD-B1B1-4AD813D1A417} URL =
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> D:\Apps\MSOffice2013\Office15\OCHelper.dll [2016-12-13] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_51\bin\ssv.dll [2015-08-15] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_51\bin\jp2ssv.dll [2015-08-15] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\ssv.dll [2015-08-15] (Oracle Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2015-12-01] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2016-11-15] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\jp2ssv.dll [2015-08-15] (Oracle Corporation)
DPF: HKLM-x32 {538793D5-659C-4639-A56C-A179AD87ED44} hxxps://vpn.vuw.ac.nz/CACHE/stc/2/binaries/vpnweb.cab
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - D:\Apps\MSOffice2013\Office15\MSOSB.DLL [2016-10-11] (Microsoft Corporation)
FireFox:
========
FF DefaultProfile: s7y6ploh.default
FF ProfilePath: C:\Users\NG\AppData\Roaming\Mozilla\Firefox\Profiles\w8gci29x.default [2017-01-28]
FF Extension: (HNetCfg.FwMgr) - C:\Users\NG\AppData\Roaming\Mozilla\Firefox\Profiles\w8gci29x.default\Extensions\{304000B1-6694-6D9C-D59F-B8E397702F4D} [2017-01-28] [not signed]
FF ProfilePath: C:\Users\NG\AppData\Roaming\Profiles\s7y6ploh.default [2016-09-25]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_19_0_0_226.dll [2015-11-04] ()
FF Plugin: @java.com/DTPlugin,version=11.51.2 -> C:\Program Files\Java\jre1.8.0_51\bin\dtplugin\npDeployJava1.dll [2015-08-15] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.51.2 -> C:\Program Files\Java\jre1.8.0_51\bin\plugin2\npjp2.dll [2015-08-15] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> D:\Apps\MSOffice2013\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2016-10-12] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_226.dll [2015-11-04] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2015-04-21] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.68 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2015-04-21] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2015-04-21] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.51.2 -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\dtplugin\npDeployJava1.dll [2015-08-15] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.51.2 -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\plugin2\npjp2.dll [2015-08-15] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-10-18] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-04-01] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2016-12-18] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2016-10-12] (Adobe Systems)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2016-10-18] (Microsoft Corporation)
StartMenuInternet: FIREFOX.EXE - D:\Apps\Firefox\firefox.exe
Chrome:
=======
CHR DefaultProfile: Profile 1
CHR HomePage: Profile 1 -> hxxp://www.google.com/
CHR Session Restore: Profile 1 -> is enabled.
CHR Profile: C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1 [2017-02-03]
CHR Extension: (Prezentace Google) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-08-14]
CHR Extension: (Dokumenty Google) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2016-08-14]
CHR Extension: (Disk Google) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-08-14]
CHR Extension: (Web Developer) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\bfbameneiokkgbdmiekhjnmfkcnldhhm [2016-08-14]
CHR Extension: (YouTube) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-08-14]
CHR Extension: (Honey) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\bmnlcjabgnpnenekpadlanbbkooimhnj [2017-02-03]
CHR Extension: (JSONView) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\chklaanhfefbnpoihckbnefhakgolnmc [2017-01-27]
CHR Extension: (Pushbullet) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\chlffgpmiacpedhhbkiomidkjlcfhogd [2016-10-29]
CHR Extension: (Gmelius for Inbox by Gmail) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\dlbjhjnahgmigifoggidegpakbcjomgg [2016-08-14]
CHR Extension: (Gmail Offline) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ejidjjhkpiempkbhmpbfngldlkglhimk [2016-08-14]
CHR Extension: (Hudba Google Play) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\fahmaaghhglfmonjliepjlchgpgfmobi [2017-02-03]
CHR Extension: (Tabulky Google) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-08-14]
CHR Extension: (Wunderlist - To-do and Task list) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\fjliknjliaohjgjajlgolhijphojjdkc [2016-08-14]
CHR Extension: (Dokumenty Google offline) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-08-14]
CHR Extension: (AdBlock) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2017-01-31]
CHR Extension: (GhostText) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\godiecgffnchndlihlpaajjcplehddca [2016-10-08]
CHR Extension: (Google Play Music) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\icppfcnhkcmnfdhfhphakoifcfokfdhg [2016-08-14]
CHR Extension: (AngularJS Batarang) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ighdmehidhipcmcojjgiloacoafjmpfk [2016-08-14]
CHR Extension: (Grammarly for Chrome) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\kbfnbcaeplbcioakkpcpgfkobkghlhen [2017-02-03]
CHR Extension: (Momentum) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\laookkfknpbbblfpciffpaejjkokdgca [2017-01-03]
CHR Extension: (Mapy Google) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\lneaknkopdijkpnocmklfnjbeapigfbh [2016-08-14]
CHR Extension: (Awesome Screenshot: Screen capture, Annotate) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nlipoenfbbikpbjkfpfillcgkoblgpmj [2016-11-20]
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-01-21]
CHR Extension: (Trello) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\oflhioojkbelepjlnafgmgkkjhojphcg [2016-08-14]
CHR Extension: (ColorPick Eyedropper) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ohcpnigalekghcmgcdcenkpelffpdolg [2016-08-14]
CHR Extension: (Gmail) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-08-14]
CHR Extension: (Chrome Media Router) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-01-09]
CHR Profile: C:\Users\NG\AppData\Local\Google\Chrome\User Data\System Profile [2016-09-25]
Opera:
=======
StartMenuInternet: (HKLM) OperaStable - D:\Apps\Opera\Launcher.exe
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S4 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [744640 2016-10-12] (Adobe Systems Incorporated)
S4 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2218712 2016-12-13] (Adobe Systems, Incorporated)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [129752 2016-11-11] (ELAN Microelectronics Corp.)
S4 GoProDeviceDetectionService; D:\Apps\QuikGoPro\GoPro Desktop App\GoProDeviceDetection.exe [37808 2016-12-02] ()
R2 iBTAudioSrv; C:\Program Files (x86)\Intel\HPWA\iBTAudioSrv.exe [573384 2014-07-25] (Intel Corporation)
R2 igfxCUIService2.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [373744 2017-01-18] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [881152 2015-05-22] (Intel(R) Corporation)
S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [177376 2016-08-12] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [223008 2015-06-24] (Intel Corporation)
S2 Net Driver HPZ12; C:\Windows\System32\HPZinw12.dll [71680 2010-01-19] (Hewlett-Packard) [File not signed]
S2 Pml Driver HPZ12; C:\Windows\System32\HPZipm12.dll [89600 2010-01-19] (Hewlett-Packard) [File not signed]
S4 PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [76152 2016-11-21] ()
S4 PnkBstrA; C:\WINDOWS\SysWOW64\PnkBstrA.exe [76888 2016-11-21] ()
S4 postgresql-x64-9.3; D:\Apps\Postgres\bin\pg_ctl.exe [89088 2014-10-20] (PostgreSQL Global Development Group) [File not signed]
R2 SamsungSystemConfiguration; C:\ProgramData\Samsung\SamsungSystemConfiguration\SamsungSystemConfiguration.exe [23872 2014-03-19] (Samsung Electronics CO., LTD.)
R2 Settings Launcher; C:\Program Files (x86)\Samsung\Settings\CmdServer\SettingsLauncher.exe [1594176 2015-06-24] (Samsung Electronics CO., LTD.)
S2 SkypeUpdate; D:\Apps\Skype\Updater\Updater.exe [327808 2016-03-23] (Skype Technologies)
S4 SWUpdateService; C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe [3296104 2016-10-04] (Samsung Electronics Co., Ltd.)
S3 wampapache64; D:\Apps\Wamp\bin\apache\apache2.4.9\bin\httpd.exe [24576 2014-05-02] (Apache Software Foundation) [File not signed]
S3 wampmysqld64; D:\Apps\Wamp\bin\mysql\mysql5.6.17\bin\mysqld.exe [12942848 2014-05-02] () [File not signed]
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-17] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-17] (Microsoft Corporation)
R2 ibtsiva; %SystemRoot%\system32\ibtsiva [X]
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 ETDSMBus; C:\WINDOWS\system32\DRIVERS\ETDSMBus.sys [32328 2015-09-23] (ELAN Microelectronic Corp.)
R3 ibtusb; C:\WINDOWS\system32\DRIVERS\ibtusb.sys [230656 2016-12-12] (Intel Corporation)
S3 INETMON; C:\windows\System32\Drivers\INETMON.sys [29088 2013-08-08] ()
R3 ISCT; C:\WINDOWS\System32\drivers\ISCTD64.sys [47008 2013-07-31] ()
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-17] ()
R3 NETwNb64; C:\WINDOWS\System32\drivers\Netwbw02.sys [3485696 2016-07-17] (Intel Corporation)
R3 RadioHIDMini; C:\WINDOWS\System32\drivers\RadioHIDMini.sys [23408 2012-07-28] (Windows (R) Win 7 DDK provider)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [895256 2015-06-23] (Realtek )
R3 SensorsAlsDriver; C:\WINDOWS\System32\drivers\WUDFRd.sys [216064 2016-07-17] (Microsoft Corporation)
S1 VBoxNetAdp; C:\WINDOWS\system32\DRIVERS\VBoxNetAdp6.sys [127456 2016-03-05] (Oracle Corporation)
R1 VBoxNetLwf; C:\WINDOWS\system32\DRIVERS\VBoxNetLwf.sys [205784 2016-03-05] (Oracle Corporation)
R1 VBoxUSBMon; C:\WINDOWS\system32\DRIVERS\VBoxUSBMon.sys [127432 2015-09-16] (BigNox Corporation)
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44056 2016-07-17] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [290144 2016-07-17] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-17] (Microsoft Corporation)
R1 XQHDrv; C:\WINDOWS\system32\DRIVERS\XQHDrv.sys [253384 2015-09-16] (BigNox Corporation)
R1 XQHDrv; C:\Windows\SysWOW64\DRIVERS\XQHDrv.sys [253384 2015-09-16] (BigNox Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-02-03 19:17 - 2017-02-03 19:18 - 00027960 _____ C:\Users\NG\Downloads\FRST.txt
2017-02-03 19:17 - 2017-02-03 19:17 - 02420736 _____ (Farbar) C:\Users\NG\Downloads\FRST64.exe
2017-02-03 19:17 - 2017-02-03 19:17 - 00000000 ____D C:\FRST
2017-02-03 01:10 - 2017-02-03 01:10 - 00000000 ____D C:\WINDOWS\Panther
2017-02-01 21:25 - 2017-02-01 21:25 - 00007773 _____ C:\Users\NG\Downloads\logout.htm
2017-02-01 20:21 - 2017-02-01 20:21 - 00133320 _____ C:\Users\NG\Downloads\Travel Voucher - Booking 30247597.pdf
2017-02-01 17:02 - 2017-02-01 17:09 - 305369664 _____ C:\Users\NG\Downloads\Valentine-Card-Templates-(PS).zip
2017-02-01 17:02 - 2017-02-01 17:03 - 07537698 _____ C:\Users\NG\Downloads\Live-Symmetry-for-Adobe-Illustrator.zip
2017-02-01 17:02 - 2017-02-01 17:02 - 00074227 _____ C:\Users\NG\Downloads\Mocking-Script.zip
2017-01-31 08:37 - 2017-02-02 22:18 - 00000000 ____D C:\WINDOWS\LastGood.Tmp
2017-01-28 21:48 - 2017-01-29 19:11 - 00000000 ____D C:\Users\NG\AppData\Local\Ebdtion
2017-01-28 21:47 - 2017-01-29 19:11 - 00000000 ____D C:\Users\NG\AppData\Local\URmedia
2017-01-28 21:47 - 2017-01-28 21:47 - 00000000 ____D C:\Users\NG\AppData\Roaming\ProxyGate
2017-01-27 21:50 - 2017-01-27 21:50 - 00000000 ____D C:\Users\NG\AppData\LocalLow\Playdead
2017-01-27 21:49 - 2017-01-27 21:49 - 00000000 ____D C:\Users\NG\Documents\CPY_SAVES
2017-01-27 21:46 - 2017-01-28 21:46 - 00000000 ____D C:\Users\NG\AppData\Roaming\INSIDE.Build.2016-ALI213
2017-01-27 06:46 - 2017-01-27 06:48 - 00000000 ____D C:\AdwCleaner
2017-01-27 06:46 - 2017-01-27 06:46 - 03988944 _____ C:\Users\NG\Downloads\adwcleaner_6.042.exe
2017-01-26 10:12 - 2017-01-26 10:12 - 00000000 ____D C:\rsit
2017-01-26 10:11 - 2017-01-26 10:11 - 01222144 _____ C:\Users\NG\Downloads\RSITx64.exe
2017-01-25 21:24 - 2017-01-25 21:24 - 00000000 ____D C:\Users\NG\Downloads\Mistrovství-práce-s-DSLR
2017-01-25 18:00 - 2016-12-21 20:08 - 00142848 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2017-01-25 18:00 - 2016-12-21 17:44 - 00120320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2017-01-25 16:17 - 2017-01-25 16:17 - 00144426 _____ C:\Users\NG\Downloads\Visa Outcome and Conditions.pdf
2017-01-24 21:32 - 2017-01-24 22:32 - 860656952 _____ C:\Users\NG\Downloads\Mistrovství-práce-s-DSLR.rar
2017-01-22 00:32 - 2017-01-22 00:32 - 00000000 ____D C:\Users\NG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2017-01-20 00:03 - 2017-01-20 00:11 - 264568664 _____ C:\Users\NG\Downloads\Saprol-Social-Media-Kit-(50-off).zip
2017-01-20 00:03 - 2017-01-20 00:09 - 171163150 _____ C:\Users\NG\Downloads\Wood-Antique-Texture-Backgrounds.zip
2017-01-20 00:03 - 2017-01-20 00:06 - 55918350 _____ C:\Users\NG\Downloads\Green-Mint-paint-brush-strokes.zip
2017-01-20 00:03 - 2017-01-20 00:04 - 09826801 _____ C:\Users\NG\Downloads\Valentines-Day-greeting-cardsbonus.zip
2017-01-20 00:00 - 2017-01-20 00:00 - 00040601 _____ C:\Users\NG\Downloads\Michal_Kleiner_2017-01-20.pdf
2017-01-19 23:51 - 2017-01-19 23:51 - 00033564 _____ C:\Users\NG\Downloads\e-visa.html
2017-01-18 01:52 - 2017-01-18 01:52 - 01027056 _____ C:\WINDOWS\system32\igfxSDK.exe
2017-01-18 01:52 - 2017-01-18 01:52 - 00705048 _____ (Intel Corporation) C:\WINDOWS\system32\MetroIntelGenericUIFramework.dll
2017-01-18 01:52 - 2017-01-18 01:52 - 00448496 _____ (Intel Corporation) C:\WINDOWS\system32\IntelCpHDCPSvc.exe
2017-01-18 01:52 - 2017-01-18 01:52 - 00416280 _____ (Intel Corporation) C:\WINDOWS\system32\IntelOpenCL64.dll
2017-01-18 01:52 - 2017-01-18 01:52 - 00390168 _____ (Intel Corporation) C:\WINDOWS\system32\igfxOSP.dll
2017-01-18 01:52 - 2017-01-18 01:52 - 00318488 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\IntelOpenCL32.dll
2017-01-18 01:52 - 2017-01-18 01:52 - 00301552 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\IntelCpHeciSvc.exe
2017-01-18 01:52 - 2017-01-18 01:52 - 00255000 _____ (Intel Corporation) C:\WINDOWS\system32\igfxDTCM.dll
2017-01-18 01:52 - 2017-01-18 01:52 - 00220184 _____ (Intel Corporation) C:\WINDOWS\system32\igfxCoIn_v4549.dll
2017-01-18 01:52 - 2017-01-18 01:52 - 00111640 _____ ( ) C:\WINDOWS\system32\igfxSDKLibv2_0.dll
2017-01-18 01:52 - 2017-01-18 01:52 - 00103960 _____ (Khronos Group) C:\WINDOWS\SysWOW64\Intel_OpenCL_ICD32.dll
2017-01-18 01:52 - 2017-01-18 01:52 - 00100888 _____ ( ) C:\WINDOWS\system32\igfxSDKLib.dll
2017-01-18 01:52 - 2017-01-18 01:52 - 00099864 _____ (Khronos Group) C:\WINDOWS\system32\Intel_OpenCL_ICD64.dll
2017-01-18 01:52 - 2017-01-18 01:52 - 00095256 _____ ( ) C:\WINDOWS\system32\igfxDHLibv2_0.dll
2017-01-18 01:52 - 2017-01-18 01:52 - 00084504 _____ ( ) C:\WINDOWS\system32\igfxDHLib.dll
2017-01-18 01:52 - 2017-01-18 01:52 - 00029208 _____ ( ) C:\WINDOWS\system32\igfxDILibv2_0.dll
2017-01-18 01:52 - 2017-01-18 01:52 - 00029208 _____ ( ) C:\WINDOWS\system32\igfxDILib.dll
2017-01-18 01:52 - 2017-01-18 01:52 - 00027672 _____ ( ) C:\WINDOWS\system32\igfxEMLibv2_0.dll
2017-01-18 01:52 - 2017-01-18 01:52 - 00027672 _____ ( ) C:\WINDOWS\system32\igfxEMLib.dll
2017-01-18 01:52 - 2017-01-18 01:52 - 00022552 _____ ( ) C:\WINDOWS\system32\igfxLHMLibv2_0.dll
2017-01-18 01:52 - 2017-01-18 01:52 - 00022552 _____ ( ) C:\WINDOWS\system32\igfxLHMLib.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 39863912 _____ (Intel Corporation) C:\WINDOWS\system32\igdumdim64.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 34825544 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igd11dxva32.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 11753496 _____ (Intel Corporation) C:\WINDOWS\system32\ig75icd64.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 08738328 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\ig75icd32.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 05688856 _____ (Intel Corporation) C:\WINDOWS\system32\igdmcl64.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 05262872 _____ (Intel Corporation) C:\WINDOWS\system32\GfxResources.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 04928024 _____ (Intel Corporation) C:\WINDOWS\system32\igdrcl64.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 04364312 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdrcl32.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 04270720 _____ (Intel Corporation) C:\WINDOWS\system32\igd12umd64.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 04239744 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igd12umd32.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 03971608 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdmcl32.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 02393208 _____ (Intel Corporation) C:\WINDOWS\system32\igdmd64.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 01858680 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdmd32.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 01816760 _____ (Intel Corporation) C:\WINDOWS\system32\iglhsip64.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 01814104 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\iglhsip32.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 01590808 _____ (Intel Corporation) C:\WINDOWS\system32\igfxcmjit64.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 01178648 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igfxcmjit32.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 00968176 _____ (Intel Corporation) C:\WINDOWS\system32\Gfxv4_0.exe
2017-01-18 01:51 - 2017-01-18 01:51 - 00964592 _____ (Intel Corporation) C:\WINDOWS\system32\Gfxv2_0.exe
2017-01-18 01:51 - 2017-01-18 01:51 - 00466928 _____ (Intel Corporation) C:\WINDOWS\system32\GfxUIEx.exe
2017-01-18 01:51 - 2017-01-18 01:51 - 00439320 _____ (Intel Corporation) C:\WINDOWS\system32\igdbcl64.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 00388632 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdbcl32.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 00273432 _____ C:\WINDOWS\system32\igfxCPL.cpl
2017-01-18 01:51 - 2017-01-18 01:51 - 00266264 _____ (Intel Corporation) C:\WINDOWS\system32\igdfcl64.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 00242200 _____ (Intel Corporation) C:\WINDOWS\system32\iglhcp64.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 00231920 _____ (Intel Corporation) C:\WINDOWS\system32\DPTopologyAppv2_0.exe
2017-01-18 01:51 - 2017-01-18 01:51 - 00225304 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdfcl32.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 00223288 _____ (Intel Corporation) C:\WINDOWS\system32\igdde64.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 00205400 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\iglhcp32.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 00193048 _____ (Intel Corporation) C:\WINDOWS\system32\igdail64.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 00184024 _____ (Intel Corporation) C:\WINDOWS\system32\igfxcmrt64.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 00183000 _____ (Intel Corporation) C:\WINDOWS\system32\igfx11cmrt64.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 00181880 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdde32.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 00173592 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdail32.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 00160312 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igfxcmrt32.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 00160312 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igfx11cmrt32.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 00103448 _____ C:\WINDOWS\system32\igfxCUIServicePS.dll
2017-01-18 01:50 - 2017-01-18 01:50 - 29101592 _____ (Intel Corporation) C:\WINDOWS\system32\common_clang64.dll
2017-01-18 01:50 - 2017-01-18 01:50 - 19861528 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\common_clang32.dll
2017-01-18 01:50 - 2017-01-18 01:50 - 15488968 _____ (Intel Corporation) C:\WINDOWS\system32\igc64.dll
2017-01-18 01:50 - 2017-01-18 01:50 - 13483240 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igc32.dll
2017-01-18 01:50 - 2017-01-18 01:50 - 13056584 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igd10iumd32.dll
2017-01-18 01:50 - 2017-01-18 01:50 - 00312344 _____ (Intel Corporation) C:\WINDOWS\system32\igd10idpp64.dll
2017-01-18 01:50 - 2017-01-18 01:50 - 00297208 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igd10idpp32.dll
2017-01-18 01:50 - 2017-01-18 01:50 - 00232432 _____ (Intel Corporation) C:\WINDOWS\system32\DPTopologyApp.exe
2017-01-18 01:50 - 2017-01-18 01:50 - 00175088 _____ (Intel Corporation) C:\WINDOWS\system32\difx64.exe
2017-01-17 20:44 - 2017-01-17 20:44 - 00831685 _____ C:\WINDOWS\system32\DisplayAudiox64.cab
2017-01-17 20:44 - 2017-01-17 20:44 - 00004862 _____ C:\WINDOWS\system32\iglhxs64.vp
2017-01-13 19:33 - 2017-01-13 19:33 - 00270726 _____ C:\Users\NG\Downloads\INZ 1113 Employer Supplementary Form_April 2016_FA_Web.pdf
2017-01-13 19:16 - 2017-01-13 19:41 - 00000000 ____D C:\Users\NG\Downloads\Essentials Work Visa II
2017-01-12 21:32 - 2017-01-12 21:32 - 00127084 _____ C:\Users\NG\Downloads\auction-1232279002.htm
2017-01-12 20:27 - 2016-12-21 20:43 - 04130440 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2017-01-12 20:27 - 2016-12-21 20:43 - 01454504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetsrc.dll
2017-01-12 20:27 - 2016-12-21 20:43 - 01071736 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetcore.dll
2017-01-12 20:27 - 2016-12-21 20:42 - 01988560 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2017-01-12 20:27 - 2016-12-21 20:42 - 01702392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll
2017-01-12 20:27 - 2016-12-21 20:42 - 01300600 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll
2017-01-12 20:27 - 2016-12-21 20:08 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpencom.dll
2017-01-12 20:27 - 2016-12-21 20:06 - 06285312 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2017-01-12 20:27 - 2016-12-21 19:56 - 00936960 _____ (Microsoft Corporation) C:\WINDOWS\system32\MCRecvSrc.dll
2017-01-12 20:27 - 2016-12-21 19:53 - 04474368 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll
2017-01-12 20:27 - 2016-12-21 19:51 - 08075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2017-01-12 20:27 - 2016-12-21 19:51 - 05611008 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1.dll
2017-01-12 20:27 - 2016-12-21 18:09 - 00263472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll
2017-01-12 20:27 - 2016-12-21 17:40 - 00557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StoreAgent.dll
2017-01-12 20:27 - 2016-12-21 17:40 - 00180224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe
2017-01-12 20:27 - 2016-12-21 17:39 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgentUserBroker.exe
2017-01-12 20:27 - 2016-12-21 17:22 - 01883648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll
2017-01-12 20:27 - 2016-12-14 18:41 - 01235296 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2017-01-12 20:27 - 2016-12-14 17:48 - 01631232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll
2017-01-12 20:27 - 2016-12-14 17:38 - 17188864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2017-01-12 20:27 - 2016-12-14 17:23 - 03134976 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll
2017-01-12 20:26 - 2016-12-21 21:08 - 00245600 _____ (Microsoft Corporation) C:\WINDOWS\system32\offlinesam.dll
2017-01-12 20:26 - 2016-12-21 21:08 - 00136032 _____ (Microsoft Corporation) C:\WINDOWS\system32\ImplatSetup.dll
2017-01-12 20:26 - 2016-12-21 21:04 - 07816032 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2017-01-12 20:26 - 2016-12-21 20:49 - 00328008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll
2017-01-12 20:26 - 2016-12-21 20:46 - 00624048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2017-01-12 20:26 - 2016-12-21 20:43 - 00092512 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2017-01-12 20:26 - 2016-12-21 20:42 - 22224480 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2017-01-12 20:26 - 2016-12-21 20:41 - 01600632 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2017-01-12 20:26 - 2016-12-21 20:37 - 00455520 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe
2017-01-12 20:26 - 2016-12-21 20:15 - 22563840 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2017-01-12 20:26 - 2016-12-21 20:14 - 00043008 _____ (Microsoft Corporation) C:\WINDOWS\system32\LaunchWinApp.exe
2017-01-12 20:26 - 2016-12-21 20:09 - 00368640 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneBackupHandler.dll
2017-01-12 20:26 - 2016-12-21 20:09 - 00363520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BioFeedback.dll
2017-01-12 20:26 - 2016-12-21 20:08 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BlockedShutdown.dll
2017-01-12 20:26 - 2016-12-21 20:08 - 00289792 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeveloperOptionsSettingsHandlers.dll
2017-01-12 20:26 - 2016-12-21 20:08 - 00211968 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe
2017-01-12 20:26 - 2016-12-21 20:07 - 00748544 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll
2017-01-12 20:26 - 2016-12-21 20:06 - 00310784 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncSettings.dll
2017-01-12 20:26 - 2016-12-21 20:06 - 00260608 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgentUserBroker.exe
2017-01-12 20:26 - 2016-12-21 20:06 - 00147456 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsrv.dll
2017-01-12 20:26 - 2016-12-21 20:05 - 00425984 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadcloudap.dll
2017-01-12 20:26 - 2016-12-21 20:05 - 00261632 _____ (Microsoft Corporation) C:\WINDOWS\system32\indexeddbserver.dll
2017-01-12 20:26 - 2016-12-21 20:05 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll
2017-01-12 20:26 - 2016-12-21 20:01 - 09131008 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2017-01-12 20:26 - 2016-12-21 20:00 - 00440320 _____ (Microsoft Corporation) C:\WINDOWS\system32\fhcfg.dll
2017-01-12 20:26 - 2016-12-21 19:59 - 01908224 _____ (Microsoft Corporation) C:\WINDOWS\system32\AzureSettingSyncProvider.dll
2017-01-12 20:26 - 2016-12-21 19:59 - 00883712 _____ (Microsoft Corporation) C:\WINDOWS\system32\samsrv.dll
2017-01-12 20:26 - 2016-12-21 19:58 - 23678464 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2017-01-12 20:26 - 2016-12-21 19:57 - 00462336 _____ (Microsoft Corporation) C:\WINDOWS\system32\fhsettingsprovider.dll
2017-01-12 20:26 - 2016-12-21 19:56 - 00947712 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVP9DEC.dll
2017-01-12 20:26 - 2016-12-21 19:55 - 08129536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2017-01-12 20:26 - 2016-12-21 19:55 - 04749312 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2017-01-12 20:26 - 2016-12-21 19:54 - 05511680 _____ (Microsoft Corporation) C:\WINDOWS\system32\aclui.dll
2017-01-12 20:26 - 2016-12-21 19:53 - 06664192 _____ (Microsoft Corporation) C:\WINDOWS\system32\mspaint.exe
2017-01-12 20:26 - 2016-12-21 19:50 - 01490432 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2017-01-12 20:26 - 2016-12-21 19:49 - 04149248 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2017-01-12 20:26 - 2016-12-21 19:49 - 02691072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll
2017-01-12 20:26 - 2016-12-21 19:49 - 01062912 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
2017-01-12 20:26 - 2016-12-21 19:47 - 01121280 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadtb.dll
2017-01-12 20:26 - 2016-12-21 18:59 - 00218976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\offlinesam.dll
2017-01-12 20:26 - 2016-12-21 18:02 - 03892864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2017-01-12 20:26 - 2016-12-21 18:02 - 01852720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2017-01-12 20:26 - 2016-12-21 18:02 - 01360464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetsrc.dll
2017-01-12 20:26 - 2016-12-21 18:02 - 01277344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll
2017-01-12 20:26 - 2016-12-21 18:02 - 01201872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll
2017-01-12 20:26 - 2016-12-21 18:02 - 00980832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetcore.dll
2017-01-12 20:26 - 2016-12-21 18:01 - 20969928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2017-01-12 20:26 - 2016-12-21 17:46 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LaunchWinApp.exe
2017-01-12 20:26 - 2016-12-21 17:43 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BlockedShutdown.dll
2017-01-12 20:26 - 2016-12-21 17:41 - 00253952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BioFeedback.dll
2017-01-12 20:26 - 2016-12-21 17:41 - 00231936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll
2017-01-12 20:26 - 2016-12-21 17:40 - 00318976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpencom.dll
2017-01-12 20:26 - 2016-12-21 17:40 - 00237056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SyncSettings.dll
2017-01-12 20:26 - 2016-12-21 17:39 - 01300480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVPXENC.dll
2017-01-12 20:26 - 2016-12-21 17:38 - 00866816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Cred.dll
2017-01-12 20:26 - 2016-12-21 17:35 - 04612608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2017-01-12 20:26 - 2016-12-21 17:35 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\indexeddbserver.dll
2017-01-12 20:26 - 2016-12-21 17:34 - 07626752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2017-01-12 20:26 - 2016-12-21 17:33 - 19413504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2017-01-12 20:26 - 2016-12-21 17:32 - 19417600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2017-01-12 20:26 - 2016-12-21 17:30 - 05398016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aclui.dll
2017-01-12 20:26 - 2016-12-21 17:30 - 01255936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AzureSettingSyncProvider.dll
2017-01-12 20:26 - 2016-12-21 17:27 - 00640000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MCRecvSrc.dll
2017-01-12 20:26 - 2016-12-21 17:26 - 01155072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVP9DEC.dll
2017-01-12 20:26 - 2016-12-21 17:25 - 07469056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2017-01-12 20:26 - 2016-12-21 17:25 - 06474752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mspaint.exe
2017-01-12 20:26 - 2016-12-21 17:24 - 06044160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2017-01-12 20:26 - 2016-12-14 18:41 - 00590960 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2017-01-12 20:26 - 2016-12-14 18:34 - 02482280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll
2017-01-12 20:26 - 2016-12-14 18:33 - 01356864 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipUp.exe
2017-01-12 20:26 - 2016-12-14 18:23 - 00404832 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2017-01-12 20:26 - 2016-12-14 18:21 - 02206496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2vdec.dll
2017-01-12 20:26 - 2016-12-14 18:19 - 00584544 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2017-01-12 20:26 - 2016-12-14 18:18 - 00715104 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2017-01-12 20:26 - 2016-12-14 18:18 - 00335712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys
2017-01-12 20:26 - 2016-12-14 18:17 - 00319288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll
2017-01-12 20:26 - 2016-12-14 18:14 - 01694712 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmde.dll
2017-01-12 20:26 - 2016-12-14 18:14 - 00418952 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2017-01-12 20:26 - 2016-12-14 18:14 - 00089416 _____ (Microsoft Corporation) C:\WINDOWS\system32\remoteaudioendpoint.dll
2017-01-12 20:26 - 2016-12-14 18:01 - 01557808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll
2017-01-12 20:26 - 2016-12-14 18:01 - 00382784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2017-01-12 20:26 - 2016-12-14 18:01 - 00076984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\remoteaudioendpoint.dll
2017-01-12 20:26 - 2016-12-14 17:46 - 01631232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Resources.dll
2017-01-12 20:26 - 2016-12-14 17:46 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2017-01-12 20:26 - 2016-12-14 17:43 - 00201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\ScDeviceEnum.dll
2017-01-12 20:26 - 2016-12-14 17:42 - 00352768 _____ (Microsoft Corporation) C:\WINDOWS\system32\cloudAP.dll
2017-01-12 20:26 - 2016-12-14 17:42 - 00236544 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSCard.dll
2017-01-12 20:26 - 2016-12-14 17:42 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.UI.Logon.ProxyStub.dll
2017-01-12 20:26 - 2016-12-14 17:42 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinSCard.dll
2017-01-12 20:26 - 2016-12-14 17:41 - 00223744 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2017-01-12 20:26 - 2016-12-14 17:40 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\system32\domgmt.dll
2017-01-12 20:26 - 2016-12-14 17:40 - 00231424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudBackupSettings.dll
2017-01-12 20:26 - 2016-12-14 17:40 - 00193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\certprop.dll
2017-01-12 20:26 - 2016-12-14 17:39 - 00837632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wbiosrvc.dll
2017-01-12 20:26 - 2016-12-14 17:39 - 00290816 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll
2017-01-12 20:26 - 2016-12-14 17:39 - 00257024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.CredDialogController.dll
2017-01-12 20:26 - 2016-12-14 17:38 - 13869056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2017-01-12 20:26 - 2016-12-14 17:38 - 00295424 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudBackupSettings.dll
2017-01-12 20:26 - 2016-12-14 17:38 - 00213504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.CredDialogController.dll
2017-01-12 20:26 - 2016-12-14 17:37 - 00090112 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatepolicy.dll
2017-01-12 20:26 - 2016-12-14 17:36 - 01002496 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll
2017-01-12 20:26 - 2016-12-14 17:36 - 00539648 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll
2017-01-12 20:26 - 2016-12-14 17:36 - 00074752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\updatepolicy.dll
2017-01-12 20:26 - 2016-12-14 17:35 - 00755712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2017-01-12 20:26 - 2016-12-14 17:35 - 00712192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2017-01-12 20:26 - 2016-12-14 17:35 - 00600576 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptui.dll
2017-01-12 20:26 - 2016-12-14 17:35 - 00553984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptui.dll
2017-01-12 20:26 - 2016-12-14 17:32 - 00497152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LogonController.dll
2017-01-12 20:26 - 2016-12-14 17:26 - 00932864 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2017-01-12 20:26 - 2016-12-14 17:26 - 00869888 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2017-01-12 20:26 - 2016-12-14 17:25 - 02009600 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRHInproc.dll
2017-01-12 20:26 - 2016-12-14 17:24 - 01005568 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3D12.dll
2017-01-12 20:26 - 2016-12-14 17:24 - 00673792 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2017-01-12 20:26 - 2016-12-14 17:23 - 01231872 _____ (Microsoft Corporation) C:\WINDOWS\system32\dosvc.dll
2017-01-12 20:26 - 2016-12-14 17:22 - 02748416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll
2017-01-12 20:26 - 2016-12-14 17:22 - 02317824 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2017-01-12 20:26 - 2016-12-14 17:22 - 01513472 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2017-01-12 20:26 - 2016-12-14 17:22 - 00391168 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll
2017-01-12 20:26 - 2016-12-14 17:21 - 03616768 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2017-01-12 20:26 - 2016-11-03 01:01 - 00484584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2017-01-12 20:26 - 2016-11-03 00:00 - 00534096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2017-01-12 20:26 - 2016-11-02 23:28 - 00324608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll
2017-01-12 20:26 - 2016-11-02 23:22 - 00337920 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2017-01-12 20:26 - 2016-11-02 23:21 - 00942080 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2017-01-12 20:26 - 2016-08-02 17:30 - 00822784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
2017-01-12 20:25 - 2016-12-21 20:42 - 00241504 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHost.dll
2017-01-12 20:25 - 2016-12-21 20:13 - 00119808 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCsp.dll
2017-01-12 20:25 - 2016-12-21 20:12 - 00083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProvPluginEng.dll
2017-01-12 20:25 - 2016-12-21 20:10 - 00234496 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCore.dll
2017-01-12 20:25 - 2016-12-21 20:08 - 01292288 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVPXENC.dll
2017-01-12 20:25 - 2016-12-21 20:08 - 00349184 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll
2017-01-12 20:25 - 2016-12-21 19:53 - 01692672 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2017-01-12 20:25 - 2016-12-21 19:51 - 02275840 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2017-01-12 20:25 - 2016-12-21 17:24 - 05061120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll
2017-01-12 20:25 - 2016-12-21 17:24 - 03733504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll
2017-01-12 20:25 - 2016-12-21 17:24 - 00886272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aadtb.dll
2017-01-12 20:25 - 2016-12-21 17:22 - 00860672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll
2017-01-12 20:25 - 2016-12-14 18:08 - 00341344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2017-01-12 20:25 - 2016-12-14 18:06 - 00509792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2017-01-12 20:25 - 2016-12-14 17:45 - 00147968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32k.sys
2017-01-12 20:25 - 2016-12-14 17:40 - 00266752 _____ (Microsoft Corporation) C:\WINDOWS\system32\ConsoleLogon.dll
2017-01-12 20:25 - 2016-12-14 17:40 - 00104448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.UI.Logon.ProxyStub.dll
2017-01-12 20:25 - 2016-12-14 17:32 - 00806400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3D12.dll
2017-01-12 20:25 - 2016-12-14 17:22 - 02998272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2017-01-12 20:25 - 2016-12-14 17:22 - 00707584 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll
2017-01-10 18:17 - 2017-01-10 18:17 - 00004686 _____ C:\Users\NG\Downloads\The-Bromley-Collection-LR5-Presets.zip
2017-01-10 18:16 - 2017-01-10 18:18 - 62532375 _____ C:\Users\NG\Downloads\Sweet-Little-Hand-Drawn-Elements.zip
2017-01-10 18:16 - 2017-01-10 18:16 - 00257932 _____ C:\Users\NG\Downloads\Naive-Deco-Sans-Font-Pack.zip
2017-01-04 13:22 - 2017-01-04 13:24 - 26792177 _____ C:\Users\NG\Downloads\SEO-Line-Art-Icons.zip
2017-01-04 13:21 - 2017-01-04 13:47 - 450866277 _____ C:\Users\NG\Downloads\The-Designer-Backpack-Photo-Bundle.zip
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-02-03 19:14 - 2015-03-23 09:53 - 00000000 ____D C:\Users\NG\AppData\Roaming\Skype
2017-02-03 17:06 - 2016-10-23 08:50 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2017-02-03 15:54 - 2015-07-31 11:19 - 01193294 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-02-03 15:50 - 2016-10-23 08:52 - 00000000 ____D C:\Users\NG
2017-02-03 15:50 - 2016-10-23 08:50 - 00000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2017-02-03 15:50 - 2014-10-26 00:42 - 00000000 __SHD C:\Users\NG\IntelGraphicsProfiles
2017-02-03 01:10 - 2016-10-23 09:01 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-02-03 01:10 - 2016-07-16 19:04 - 01310720 _____ C:\WINDOWS\system32\config\BBI
2017-02-02 22:18 - 2016-07-17 00:45 - 00000000 ____D C:\WINDOWS\INF
2017-02-02 19:05 - 2016-07-17 00:47 - 00000000 ___HD C:\Program Files\WindowsApps
2017-02-02 19:05 - 2016-07-17 00:47 - 00000000 ____D C:\WINDOWS\AppReadiness
2017-02-02 19:04 - 2014-10-24 18:10 - 00000000 ____D C:\Users\NG\AppData\Local\Adobe
2017-01-31 09:58 - 2016-07-17 00:47 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2017-01-31 08:38 - 2016-10-23 08:50 - 00000200 _____ C:\WINDOWS\system32\{EC94D02F-D200-4428-9531-05AF7F9799CB}.bat
2017-01-29 19:18 - 2016-12-22 21:59 - 00000789 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera 42.lnk
2017-01-29 19:18 - 2016-10-23 09:01 - 00003922 _____ C:\WINDOWS\System32\Tasks\Opera scheduled Autoupdate 1474786425
2017-01-28 13:41 - 2014-10-26 01:01 - 00000000 ____D C:\Users\NG\AppData\Local\ElevatedDiagnostics
2017-01-27 06:49 - 2016-10-23 08:50 - 05042528 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2017-01-26 10:31 - 2015-08-15 16:26 - 00000000 ____D C:\Program Files\trend micro
2017-01-26 09:53 - 2014-11-10 00:36 - 00000000 ____D C:\Users\NG\AppData\Roaming\npm-cache
2017-01-25 21:22 - 2016-07-17 00:36 - 00000000 ____D C:\WINDOWS\CbsTemp
2017-01-22 17:30 - 2014-10-27 16:32 - 00000000 ____D C:\Users\NG\AppData\Roaming\uTorrent
2017-01-22 00:32 - 2014-10-26 00:03 - 00000000 ____D C:\Users\NG\AppData\Roaming\Dropbox
2017-01-19 19:41 - 2016-12-13 20:33 - 00003266 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task v2
2017-01-19 19:41 - 2015-07-31 11:26 - 00002359 _____ C:\Users\NG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2017-01-18 01:52 - 2016-10-23 08:50 - 00103960 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.DLL
2017-01-18 01:52 - 2016-10-23 08:50 - 00099864 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.DLL
2017-01-18 01:52 - 2016-07-20 01:12 - 02142232 _____ (Intel Corporation) C:\WINDOWS\system32\igfxLHM.dll
2017-01-18 01:52 - 2016-07-20 01:12 - 00756760 _____ (Intel Corporation) C:\WINDOWS\system32\igfxDH.dll
2017-01-18 01:52 - 2016-07-20 01:12 - 00399384 _____ (Intel Corporation) C:\WINDOWS\system32\igfxDI.dll
2017-01-18 01:52 - 2016-07-20 01:12 - 00354800 _____ (Intel Corporation) C:\WINDOWS\system32\igfxEM.exe
2017-01-18 01:52 - 2016-07-20 01:12 - 00268784 _____ (Intel Corporation) C:\WINDOWS\system32\igfxHK.exe
2017-01-18 01:52 - 2016-07-20 01:12 - 00237040 _____ (Intel Corporation) C:\WINDOWS\system32\igfxext.exe
2017-01-18 01:52 - 2016-07-20 01:12 - 00052760 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igfxexps32.dll
2017-01-18 01:52 - 2016-07-20 01:05 - 00401904 _____ C:\WINDOWS\system32\igfxTray.exe
2017-01-18 01:51 - 2016-07-20 01:19 - 06696864 _____ (Intel Corporation) C:\WINDOWS\system32\igdusc64.dll
2017-01-18 01:51 - 2016-07-20 01:19 - 05140512 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdusc32.dll
2017-01-18 01:51 - 2016-07-20 01:19 - 00055288 _____ (Intel Corporation) C:\WINDOWS\system32\igfxexps.dll
2017-01-18 01:51 - 2016-07-20 01:18 - 38903944 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdumdim32.dll
2017-01-18 01:51 - 2016-07-20 01:18 - 33479912 _____ (Intel Corporation) C:\WINDOWS\system32\igd11dxva64.dll
2017-01-18 01:51 - 2016-07-20 01:12 - 00373744 _____ (Intel Corporation) C:\WINDOWS\system32\igfxCUIService.exe
2017-01-18 01:51 - 2016-07-20 01:11 - 07969776 _____ (Intel Corporation) C:\WINDOWS\system32\Drivers\igdkmd64.sys
2017-01-18 01:50 - 2016-07-20 01:17 - 16446376 _____ (Intel Corporation) C:\WINDOWS\system32\igd10iumd64.dll
2017-01-16 16:19 - 2016-07-17 00:47 - 00000000 ____D C:\WINDOWS\system32\NDF
2017-01-14 11:36 - 2016-10-23 09:01 - 00003834 _____ C:\WINDOWS\System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473
2017-01-14 11:31 - 2014-10-24 18:08 - 00000000 __RHD C:\Users\Public\AccountPictures
2017-01-13 22:01 - 2016-07-17 00:47 - 00000000 ____D C:\WINDOWS\rescache
2017-01-13 21:20 - 2016-07-17 00:47 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2017-01-13 21:20 - 2016-07-17 00:47 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2017-01-13 21:20 - 2016-07-17 00:47 - 00000000 ____D C:\WINDOWS\system32\oobe
2017-01-13 21:20 - 2016-07-17 00:47 - 00000000 ____D C:\WINDOWS\ShellExperiences
2017-01-13 21:20 - 2016-07-17 00:47 - 00000000 ____D C:\WINDOWS\Provisioning
2017-01-13 19:13 - 2015-07-30 20:20 - 00002487 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2017-01-13 19:12 - 2016-10-23 09:01 - 00004562 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2017-01-12 21:24 - 2016-11-29 05:44 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2017-01-12 21:22 - 2014-10-25 23:28 - 00000000 ____D C:\WINDOWS\system32\MRT
2017-01-12 21:13 - 2014-10-25 23:28 - 135657872 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
==================== Files in the root of some directories =======
2014-10-24 18:10 - 2014-10-24 18:11 - 0001024 _____ () C:\Users\NG\AppData\Roaming\AbsoluteReminder.xml
2016-08-14 11:57 - 2016-08-12 15:48 - 0036423 ___SH () C:\Users\NG\AppData\Roaming\DUDhFYiGKNCXHXTDEOT
2016-08-14 11:57 - 2016-08-12 15:48 - 0452624 ___SH () C:\Users\NG\AppData\Roaming\KhMVdSgDETVh
2014-12-13 09:28 - 2015-11-28 20:31 - 0000600 _____ () C:\Users\NG\AppData\Roaming\winscp.rnd
2016-08-14 11:57 - 2016-08-12 15:48 - 0936960 ___SH () C:\Users\NG\AppData\Roaming\ZfgTgZcFLQKGHMMDOQEQf.cmd
2014-11-08 09:24 - 2016-10-01 16:38 - 0001456 _____ () C:\Users\NG\AppData\Local\Adobe Save for Web 13.0 Prefs
2014-11-28 01:53 - 2016-04-11 11:12 - 0000600 _____ () C:\Users\NG\AppData\Local\PUTTY.RND
2014-11-08 06:46 - 2015-06-03 23:11 - 0007601 _____ () C:\Users\NG\AppData\Local\resmon.resmoncfg
2016-10-23 08:51 - 2016-10-23 08:51 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2013-11-18 15:23 - 2013-02-19 20:34 - 2064264 _____ (Samsung Electronics) C:\ProgramData\MakeMarkerFile.exe
2013-11-18 15:23 - 2013-01-13 03:51 - 0003004 _____ () C:\ProgramData\MakeMarkerFile.xml
2016-08-14 11:59 - 2016-09-25 11:41 - 0000000 _____ () C:\ProgramData\no_zooｍ_ｃhroｍe.exe.lnk.bat
Files to move or delete:
====================
C:\Users\NG\AppData\Roaming\ProxyGate\MainService.exe
C:\ProgramData\no_zooｍ_ｃhroｍe.exe.lnk.bat
Some files in TEMP:
====================
2016-12-21 07:03 - 2017-01-19 19:47 - 6699008 _____ () C:\Users\NG\AppData\Local\Temp\SkypeSetup.exe
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2017-02-01 17:07
==================== End of FRST.txt ============================
Ran by NG (administrator) on NG-NTB (03-02-2017 19:17:38)
Running from C:\Users\NG\Downloads
Loaded Profiles: NG (Available Profiles: NG & Visitor)
Platform: Windows 10 Home Version 1607 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Intel Corporation) C:\Windows\System32\ibtsiva.exe
(Intel Corporation) C:\Program Files (x86)\Intel\HPWA\iBTAudioSrv.exe
(Intel Corporation) C:\Windows\SysWOW64\IntelCpHeciSvc.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\CmdServer\SettingsLauncher.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(SAMSUNG Electronics co., LTD.) C:\ProgramData\Samsung\ShutdownEvent.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDTouch.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
() C:\Windows\System32\igfxTray.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\CmdServer\SettingsCmdServer.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\CmdServer\SettingsEventHandler.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
() D:\Apps\QuikGoPro\GoPro Desktop App\GoProDesktopSystemTray.exe
(Flux Software LLC) C:\Users\NG\AppData\Local\FluxSoftware\Flux\flux.exe
(Intel Corporation) C:\Program Files (x86)\Intel\HPWA\iBTAudioMon.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe
(SAMSUNG Electronics co., LTD.) C:\ProgramData\Samsung\ShutdownEvent.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\CCXProcess.exe
(Node.js) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\libs\node.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Gold Click Ltd) C:\Users\NG\AppData\Roaming\ProxyGate\Cloud.exe
(Gold Click Ltd) C:\Users\NG\AppData\Roaming\ProxyGate\PGChk.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OFFICE15\CSISYNCCLIENT.EXE
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\S Agent\CommonAgent.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Samsung Electronics CO., LTD.) C:\ProgramData\Samsung\SamsungSystemConfiguration\SamsungSystemConfiguration.exe
(Samsung Electronics CO., LTD.) C:\ProgramData\Samsung\SamsungSystemConfiguration\SamsungConfigurationMonitor.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Skype Technologies S.A.) D:\Apps\Skype\Phone\Skype.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Dominik Reichl) D:\OneDrive\Sync\Management\KeePass\KeePass.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ====================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [14040296 2015-09-23] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [3242200 2016-11-11] (ELAN Microelectronics Corp.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508128 2016-07-01] (Adobe Systems Incorporated)
HKLM\...\Run: [Launch LCore] => C:\Program Files\Logitech Gaming Software\LCore.exe [15009400 2015-10-15] (Logitech Inc.)
HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [631808 2016-10-24] (Microsoft Corporation)
HKLM\...\Run: [GoPro Tray App] => D:\Apps\QuikGoPro\GoPro Desktop App\GoProDesktopSystemTray.exe [866224 2016-12-02] ()
HKLM-x32\...\Run: [MMReminderService] => d:\Apps\MindjetManager\MMReminderService.exe [42312 2013-09-07] (Mindjet)
HKLM-x32\...\Run: [AdobeCEPServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe [1039240 2013-05-16] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-11] (Elaborate Bytes AG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-06-08] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2383040 2016-10-12] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKU\S-1-5-21-1341208516-2984071467-593012157-1001\...\Run: [Dropbox Update] => C:\Users\NG\AppData\Local\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-05] (Dropbox, Inc.)
HKU\S-1-5-21-1341208516-2984071467-593012157-1001\...\Run: [f.lux] => C:\Users\NG\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2013-10-24] (Flux Software LLC)
HKU\S-1-5-21-1341208516-2984071467-593012157-1001\...\Run: [ProxyGate] => C:\Users\NG\AppData\Roaming\ProxyGate\MainService.exe [1142880 2016-01-10] (Gold Click Ltd) <===== ATTENTION
HKU\S-1-5-21-1341208516-2984071467-593012157-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\windows\Screen_Samsung.scr [28182067 2012-10-09] ()
HKU\S-1-5-18\...\RunOnce: [Application Restart #2] => C:\ProgramData\Samsung\SamsungSystemConfiguration\SamsungConfigurationMonitor.exe [1779008 2014-03-19] (Samsung Electronics CO., LTD.)
HKU\S-1-5-18\...\RunOnce: [Application Restart #1] => C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe [371928 2016-07-17] (Microsoft Corporation)
HKU\S-1-5-18\...\RunOnce: [Application Restart #3] => C:\ProgramData\Samsung\SamsungSystemConfiguration\SamsungConfigurationMonitor.exe [1779008 2014-03-19] (Samsung Electronics CO., LTD.)
HKU\S-1-5-18\...\RunOnce: [Application Restart #0] => C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe [371928 2016-07-17] (Microsoft Corporation)
AppInit_DLLs: C:\Program Files => C:\Program Files [0 2016-12-11] ()
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-06-10] ()
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-06-10] ()
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-06-10] ()
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll [2017-01-19] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll [2017-01-19] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll [2017-01-19] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll [2017-01-19] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll [2017-01-19] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll [2017-01-19] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll [2017-01-19] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\NG\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll [2017-01-19] (Dropbox, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\iBTAudioMon.lnk [2014-10-26]
ShortcutTarget: iBTAudioMon.lnk -> C:\Program Files (x86)\Intel\HPWA\iBTAudioMon.exe (Intel Corporation)
Startup: C:\Users\NG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk [2015-06-04]
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
Startup: C:\Users\NG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\no_zooｍ_ｃhroｍe.exe.lnk [2016-08-14]
ShortcutTarget: no_zooｍ_ｃhroｍe.exe.lnk -> C:\ProgramData\no_zooｍ_ｃhroｍe.exe.lnk.bat ()
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{e14adefe-a595-4014-9e9d-3d500381ef0c}: [DhcpNameServer] 192.168.2.1
Internet Explorer:
==================
HKU\S-1-5-21-1341208516-2984071467-593012157-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131192272023647558&GUID=C4A8A119-B2FA-4577-A3F9-DF837A28B43B
HKU\S-1-5-21-1341208516-2984071467-593012157-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://samsung13.msn.com/?pc=smjb
SearchScopes: HKU\S-1-5-21-1341208516-2984071467-593012157-1001 -> {A7816E13-C979-4EBD-B1B1-4AD813D1A417} URL =
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> D:\Apps\MSOffice2013\Office15\OCHelper.dll [2016-12-13] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_51\bin\ssv.dll [2015-08-15] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_51\bin\jp2ssv.dll [2015-08-15] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\ssv.dll [2015-08-15] (Oracle Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2015-12-01] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2016-11-15] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\jp2ssv.dll [2015-08-15] (Oracle Corporation)
DPF: HKLM-x32 {538793D5-659C-4639-A56C-A179AD87ED44} hxxps://vpn.vuw.ac.nz/CACHE/stc/2/binaries/vpnweb.cab
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - D:\Apps\MSOffice2013\Office15\MSOSB.DLL [2016-10-11] (Microsoft Corporation)
FireFox:
========
FF DefaultProfile: s7y6ploh.default
FF ProfilePath: C:\Users\NG\AppData\Roaming\Mozilla\Firefox\Profiles\w8gci29x.default [2017-01-28]
FF Extension: (HNetCfg.FwMgr) - C:\Users\NG\AppData\Roaming\Mozilla\Firefox\Profiles\w8gci29x.default\Extensions\{304000B1-6694-6D9C-D59F-B8E397702F4D} [2017-01-28] [not signed]
FF ProfilePath: C:\Users\NG\AppData\Roaming\Profiles\s7y6ploh.default [2016-09-25]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_19_0_0_226.dll [2015-11-04] ()
FF Plugin: @java.com/DTPlugin,version=11.51.2 -> C:\Program Files\Java\jre1.8.0_51\bin\dtplugin\npDeployJava1.dll [2015-08-15] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.51.2 -> C:\Program Files\Java\jre1.8.0_51\bin\plugin2\npjp2.dll [2015-08-15] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> D:\Apps\MSOffice2013\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2016-10-12] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_226.dll [2015-11-04] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2015-04-21] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.68 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2015-04-21] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2015-04-21] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.51.2 -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\dtplugin\npDeployJava1.dll [2015-08-15] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.51.2 -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\plugin2\npjp2.dll [2015-08-15] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-10-18] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-04-01] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2016-12-18] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2016-10-12] (Adobe Systems)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2016-10-18] (Microsoft Corporation)
StartMenuInternet: FIREFOX.EXE - D:\Apps\Firefox\firefox.exe
Chrome:
=======
CHR DefaultProfile: Profile 1
CHR HomePage: Profile 1 -> hxxp://www.google.com/
CHR Session Restore: Profile 1 -> is enabled.
CHR Profile: C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1 [2017-02-03]
CHR Extension: (Prezentace Google) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-08-14]
CHR Extension: (Dokumenty Google) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2016-08-14]
CHR Extension: (Disk Google) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-08-14]
CHR Extension: (Web Developer) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\bfbameneiokkgbdmiekhjnmfkcnldhhm [2016-08-14]
CHR Extension: (YouTube) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-08-14]
CHR Extension: (Honey) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\bmnlcjabgnpnenekpadlanbbkooimhnj [2017-02-03]
CHR Extension: (JSONView) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\chklaanhfefbnpoihckbnefhakgolnmc [2017-01-27]
CHR Extension: (Pushbullet) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\chlffgpmiacpedhhbkiomidkjlcfhogd [2016-10-29]
CHR Extension: (Gmelius for Inbox by Gmail) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\dlbjhjnahgmigifoggidegpakbcjomgg [2016-08-14]
CHR Extension: (Gmail Offline) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ejidjjhkpiempkbhmpbfngldlkglhimk [2016-08-14]
CHR Extension: (Hudba Google Play) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\fahmaaghhglfmonjliepjlchgpgfmobi [2017-02-03]
CHR Extension: (Tabulky Google) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-08-14]
CHR Extension: (Wunderlist - To-do and Task list) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\fjliknjliaohjgjajlgolhijphojjdkc [2016-08-14]
CHR Extension: (Dokumenty Google offline) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-08-14]
CHR Extension: (AdBlock) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2017-01-31]
CHR Extension: (GhostText) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\godiecgffnchndlihlpaajjcplehddca [2016-10-08]
CHR Extension: (Google Play Music) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\icppfcnhkcmnfdhfhphakoifcfokfdhg [2016-08-14]
CHR Extension: (AngularJS Batarang) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ighdmehidhipcmcojjgiloacoafjmpfk [2016-08-14]
CHR Extension: (Grammarly for Chrome) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\kbfnbcaeplbcioakkpcpgfkobkghlhen [2017-02-03]
CHR Extension: (Momentum) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\laookkfknpbbblfpciffpaejjkokdgca [2017-01-03]
CHR Extension: (Mapy Google) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\lneaknkopdijkpnocmklfnjbeapigfbh [2016-08-14]
CHR Extension: (Awesome Screenshot: Screen capture, Annotate) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nlipoenfbbikpbjkfpfillcgkoblgpmj [2016-11-20]
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-01-21]
CHR Extension: (Trello) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\oflhioojkbelepjlnafgmgkkjhojphcg [2016-08-14]
CHR Extension: (ColorPick Eyedropper) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ohcpnigalekghcmgcdcenkpelffpdolg [2016-08-14]
CHR Extension: (Gmail) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-08-14]
CHR Extension: (Chrome Media Router) - C:\Users\NG\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-01-09]
CHR Profile: C:\Users\NG\AppData\Local\Google\Chrome\User Data\System Profile [2016-09-25]
Opera:
=======
StartMenuInternet: (HKLM) OperaStable - D:\Apps\Opera\Launcher.exe
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S4 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [744640 2016-10-12] (Adobe Systems Incorporated)
S4 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2218712 2016-12-13] (Adobe Systems, Incorporated)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [129752 2016-11-11] (ELAN Microelectronics Corp.)
S4 GoProDeviceDetectionService; D:\Apps\QuikGoPro\GoPro Desktop App\GoProDeviceDetection.exe [37808 2016-12-02] ()
R2 iBTAudioSrv; C:\Program Files (x86)\Intel\HPWA\iBTAudioSrv.exe [573384 2014-07-25] (Intel Corporation)
R2 igfxCUIService2.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [373744 2017-01-18] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [881152 2015-05-22] (Intel(R) Corporation)
S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [177376 2016-08-12] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [223008 2015-06-24] (Intel Corporation)
S2 Net Driver HPZ12; C:\Windows\System32\HPZinw12.dll [71680 2010-01-19] (Hewlett-Packard) [File not signed]
S2 Pml Driver HPZ12; C:\Windows\System32\HPZipm12.dll [89600 2010-01-19] (Hewlett-Packard) [File not signed]
S4 PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [76152 2016-11-21] ()
S4 PnkBstrA; C:\WINDOWS\SysWOW64\PnkBstrA.exe [76888 2016-11-21] ()
S4 postgresql-x64-9.3; D:\Apps\Postgres\bin\pg_ctl.exe [89088 2014-10-20] (PostgreSQL Global Development Group) [File not signed]
R2 SamsungSystemConfiguration; C:\ProgramData\Samsung\SamsungSystemConfiguration\SamsungSystemConfiguration.exe [23872 2014-03-19] (Samsung Electronics CO., LTD.)
R2 Settings Launcher; C:\Program Files (x86)\Samsung\Settings\CmdServer\SettingsLauncher.exe [1594176 2015-06-24] (Samsung Electronics CO., LTD.)
S2 SkypeUpdate; D:\Apps\Skype\Updater\Updater.exe [327808 2016-03-23] (Skype Technologies)
S4 SWUpdateService; C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe [3296104 2016-10-04] (Samsung Electronics Co., Ltd.)
S3 wampapache64; D:\Apps\Wamp\bin\apache\apache2.4.9\bin\httpd.exe [24576 2014-05-02] (Apache Software Foundation) [File not signed]
S3 wampmysqld64; D:\Apps\Wamp\bin\mysql\mysql5.6.17\bin\mysqld.exe [12942848 2014-05-02] () [File not signed]
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-17] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-17] (Microsoft Corporation)
R2 ibtsiva; %SystemRoot%\system32\ibtsiva [X]
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 ETDSMBus; C:\WINDOWS\system32\DRIVERS\ETDSMBus.sys [32328 2015-09-23] (ELAN Microelectronic Corp.)
R3 ibtusb; C:\WINDOWS\system32\DRIVERS\ibtusb.sys [230656 2016-12-12] (Intel Corporation)
S3 INETMON; C:\windows\System32\Drivers\INETMON.sys [29088 2013-08-08] ()
R3 ISCT; C:\WINDOWS\System32\drivers\ISCTD64.sys [47008 2013-07-31] ()
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-17] ()
R3 NETwNb64; C:\WINDOWS\System32\drivers\Netwbw02.sys [3485696 2016-07-17] (Intel Corporation)
R3 RadioHIDMini; C:\WINDOWS\System32\drivers\RadioHIDMini.sys [23408 2012-07-28] (Windows (R) Win 7 DDK provider)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [895256 2015-06-23] (Realtek )
R3 SensorsAlsDriver; C:\WINDOWS\System32\drivers\WUDFRd.sys [216064 2016-07-17] (Microsoft Corporation)
S1 VBoxNetAdp; C:\WINDOWS\system32\DRIVERS\VBoxNetAdp6.sys [127456 2016-03-05] (Oracle Corporation)
R1 VBoxNetLwf; C:\WINDOWS\system32\DRIVERS\VBoxNetLwf.sys [205784 2016-03-05] (Oracle Corporation)
R1 VBoxUSBMon; C:\WINDOWS\system32\DRIVERS\VBoxUSBMon.sys [127432 2015-09-16] (BigNox Corporation)
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44056 2016-07-17] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [290144 2016-07-17] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-17] (Microsoft Corporation)
R1 XQHDrv; C:\WINDOWS\system32\DRIVERS\XQHDrv.sys [253384 2015-09-16] (BigNox Corporation)
R1 XQHDrv; C:\Windows\SysWOW64\DRIVERS\XQHDrv.sys [253384 2015-09-16] (BigNox Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-02-03 19:17 - 2017-02-03 19:18 - 00027960 _____ C:\Users\NG\Downloads\FRST.txt
2017-02-03 19:17 - 2017-02-03 19:17 - 02420736 _____ (Farbar) C:\Users\NG\Downloads\FRST64.exe
2017-02-03 19:17 - 2017-02-03 19:17 - 00000000 ____D C:\FRST
2017-02-03 01:10 - 2017-02-03 01:10 - 00000000 ____D C:\WINDOWS\Panther
2017-02-01 21:25 - 2017-02-01 21:25 - 00007773 _____ C:\Users\NG\Downloads\logout.htm
2017-02-01 20:21 - 2017-02-01 20:21 - 00133320 _____ C:\Users\NG\Downloads\Travel Voucher - Booking 30247597.pdf
2017-02-01 17:02 - 2017-02-01 17:09 - 305369664 _____ C:\Users\NG\Downloads\Valentine-Card-Templates-(PS).zip
2017-02-01 17:02 - 2017-02-01 17:03 - 07537698 _____ C:\Users\NG\Downloads\Live-Symmetry-for-Adobe-Illustrator.zip
2017-02-01 17:02 - 2017-02-01 17:02 - 00074227 _____ C:\Users\NG\Downloads\Mocking-Script.zip
2017-01-31 08:37 - 2017-02-02 22:18 - 00000000 ____D C:\WINDOWS\LastGood.Tmp
2017-01-28 21:48 - 2017-01-29 19:11 - 00000000 ____D C:\Users\NG\AppData\Local\Ebdtion
2017-01-28 21:47 - 2017-01-29 19:11 - 00000000 ____D C:\Users\NG\AppData\Local\URmedia
2017-01-28 21:47 - 2017-01-28 21:47 - 00000000 ____D C:\Users\NG\AppData\Roaming\ProxyGate
2017-01-27 21:50 - 2017-01-27 21:50 - 00000000 ____D C:\Users\NG\AppData\LocalLow\Playdead
2017-01-27 21:49 - 2017-01-27 21:49 - 00000000 ____D C:\Users\NG\Documents\CPY_SAVES
2017-01-27 21:46 - 2017-01-28 21:46 - 00000000 ____D C:\Users\NG\AppData\Roaming\INSIDE.Build.2016-ALI213
2017-01-27 06:46 - 2017-01-27 06:48 - 00000000 ____D C:\AdwCleaner
2017-01-27 06:46 - 2017-01-27 06:46 - 03988944 _____ C:\Users\NG\Downloads\adwcleaner_6.042.exe
2017-01-26 10:12 - 2017-01-26 10:12 - 00000000 ____D C:\rsit
2017-01-26 10:11 - 2017-01-26 10:11 - 01222144 _____ C:\Users\NG\Downloads\RSITx64.exe
2017-01-25 21:24 - 2017-01-25 21:24 - 00000000 ____D C:\Users\NG\Downloads\Mistrovství-práce-s-DSLR
2017-01-25 18:00 - 2016-12-21 20:08 - 00142848 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2017-01-25 18:00 - 2016-12-21 17:44 - 00120320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2017-01-25 16:17 - 2017-01-25 16:17 - 00144426 _____ C:\Users\NG\Downloads\Visa Outcome and Conditions.pdf
2017-01-24 21:32 - 2017-01-24 22:32 - 860656952 _____ C:\Users\NG\Downloads\Mistrovství-práce-s-DSLR.rar
2017-01-22 00:32 - 2017-01-22 00:32 - 00000000 ____D C:\Users\NG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2017-01-20 00:03 - 2017-01-20 00:11 - 264568664 _____ C:\Users\NG\Downloads\Saprol-Social-Media-Kit-(50-off).zip
2017-01-20 00:03 - 2017-01-20 00:09 - 171163150 _____ C:\Users\NG\Downloads\Wood-Antique-Texture-Backgrounds.zip
2017-01-20 00:03 - 2017-01-20 00:06 - 55918350 _____ C:\Users\NG\Downloads\Green-Mint-paint-brush-strokes.zip
2017-01-20 00:03 - 2017-01-20 00:04 - 09826801 _____ C:\Users\NG\Downloads\Valentines-Day-greeting-cardsbonus.zip
2017-01-20 00:00 - 2017-01-20 00:00 - 00040601 _____ C:\Users\NG\Downloads\Michal_Kleiner_2017-01-20.pdf
2017-01-19 23:51 - 2017-01-19 23:51 - 00033564 _____ C:\Users\NG\Downloads\e-visa.html
2017-01-18 01:52 - 2017-01-18 01:52 - 01027056 _____ C:\WINDOWS\system32\igfxSDK.exe
2017-01-18 01:52 - 2017-01-18 01:52 - 00705048 _____ (Intel Corporation) C:\WINDOWS\system32\MetroIntelGenericUIFramework.dll
2017-01-18 01:52 - 2017-01-18 01:52 - 00448496 _____ (Intel Corporation) C:\WINDOWS\system32\IntelCpHDCPSvc.exe
2017-01-18 01:52 - 2017-01-18 01:52 - 00416280 _____ (Intel Corporation) C:\WINDOWS\system32\IntelOpenCL64.dll
2017-01-18 01:52 - 2017-01-18 01:52 - 00390168 _____ (Intel Corporation) C:\WINDOWS\system32\igfxOSP.dll
2017-01-18 01:52 - 2017-01-18 01:52 - 00318488 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\IntelOpenCL32.dll
2017-01-18 01:52 - 2017-01-18 01:52 - 00301552 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\IntelCpHeciSvc.exe
2017-01-18 01:52 - 2017-01-18 01:52 - 00255000 _____ (Intel Corporation) C:\WINDOWS\system32\igfxDTCM.dll
2017-01-18 01:52 - 2017-01-18 01:52 - 00220184 _____ (Intel Corporation) C:\WINDOWS\system32\igfxCoIn_v4549.dll
2017-01-18 01:52 - 2017-01-18 01:52 - 00111640 _____ ( ) C:\WINDOWS\system32\igfxSDKLibv2_0.dll
2017-01-18 01:52 - 2017-01-18 01:52 - 00103960 _____ (Khronos Group) C:\WINDOWS\SysWOW64\Intel_OpenCL_ICD32.dll
2017-01-18 01:52 - 2017-01-18 01:52 - 00100888 _____ ( ) C:\WINDOWS\system32\igfxSDKLib.dll
2017-01-18 01:52 - 2017-01-18 01:52 - 00099864 _____ (Khronos Group) C:\WINDOWS\system32\Intel_OpenCL_ICD64.dll
2017-01-18 01:52 - 2017-01-18 01:52 - 00095256 _____ ( ) C:\WINDOWS\system32\igfxDHLibv2_0.dll
2017-01-18 01:52 - 2017-01-18 01:52 - 00084504 _____ ( ) C:\WINDOWS\system32\igfxDHLib.dll
2017-01-18 01:52 - 2017-01-18 01:52 - 00029208 _____ ( ) C:\WINDOWS\system32\igfxDILibv2_0.dll
2017-01-18 01:52 - 2017-01-18 01:52 - 00029208 _____ ( ) C:\WINDOWS\system32\igfxDILib.dll
2017-01-18 01:52 - 2017-01-18 01:52 - 00027672 _____ ( ) C:\WINDOWS\system32\igfxEMLibv2_0.dll
2017-01-18 01:52 - 2017-01-18 01:52 - 00027672 _____ ( ) C:\WINDOWS\system32\igfxEMLib.dll
2017-01-18 01:52 - 2017-01-18 01:52 - 00022552 _____ ( ) C:\WINDOWS\system32\igfxLHMLibv2_0.dll
2017-01-18 01:52 - 2017-01-18 01:52 - 00022552 _____ ( ) C:\WINDOWS\system32\igfxLHMLib.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 39863912 _____ (Intel Corporation) C:\WINDOWS\system32\igdumdim64.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 34825544 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igd11dxva32.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 11753496 _____ (Intel Corporation) C:\WINDOWS\system32\ig75icd64.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 08738328 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\ig75icd32.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 05688856 _____ (Intel Corporation) C:\WINDOWS\system32\igdmcl64.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 05262872 _____ (Intel Corporation) C:\WINDOWS\system32\GfxResources.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 04928024 _____ (Intel Corporation) C:\WINDOWS\system32\igdrcl64.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 04364312 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdrcl32.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 04270720 _____ (Intel Corporation) C:\WINDOWS\system32\igd12umd64.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 04239744 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igd12umd32.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 03971608 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdmcl32.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 02393208 _____ (Intel Corporation) C:\WINDOWS\system32\igdmd64.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 01858680 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdmd32.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 01816760 _____ (Intel Corporation) C:\WINDOWS\system32\iglhsip64.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 01814104 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\iglhsip32.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 01590808 _____ (Intel Corporation) C:\WINDOWS\system32\igfxcmjit64.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 01178648 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igfxcmjit32.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 00968176 _____ (Intel Corporation) C:\WINDOWS\system32\Gfxv4_0.exe
2017-01-18 01:51 - 2017-01-18 01:51 - 00964592 _____ (Intel Corporation) C:\WINDOWS\system32\Gfxv2_0.exe
2017-01-18 01:51 - 2017-01-18 01:51 - 00466928 _____ (Intel Corporation) C:\WINDOWS\system32\GfxUIEx.exe
2017-01-18 01:51 - 2017-01-18 01:51 - 00439320 _____ (Intel Corporation) C:\WINDOWS\system32\igdbcl64.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 00388632 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdbcl32.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 00273432 _____ C:\WINDOWS\system32\igfxCPL.cpl
2017-01-18 01:51 - 2017-01-18 01:51 - 00266264 _____ (Intel Corporation) C:\WINDOWS\system32\igdfcl64.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 00242200 _____ (Intel Corporation) C:\WINDOWS\system32\iglhcp64.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 00231920 _____ (Intel Corporation) C:\WINDOWS\system32\DPTopologyAppv2_0.exe
2017-01-18 01:51 - 2017-01-18 01:51 - 00225304 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdfcl32.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 00223288 _____ (Intel Corporation) C:\WINDOWS\system32\igdde64.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 00205400 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\iglhcp32.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 00193048 _____ (Intel Corporation) C:\WINDOWS\system32\igdail64.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 00184024 _____ (Intel Corporation) C:\WINDOWS\system32\igfxcmrt64.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 00183000 _____ (Intel Corporation) C:\WINDOWS\system32\igfx11cmrt64.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 00181880 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdde32.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 00173592 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdail32.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 00160312 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igfxcmrt32.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 00160312 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igfx11cmrt32.dll
2017-01-18 01:51 - 2017-01-18 01:51 - 00103448 _____ C:\WINDOWS\system32\igfxCUIServicePS.dll
2017-01-18 01:50 - 2017-01-18 01:50 - 29101592 _____ (Intel Corporation) C:\WINDOWS\system32\common_clang64.dll
2017-01-18 01:50 - 2017-01-18 01:50 - 19861528 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\common_clang32.dll
2017-01-18 01:50 - 2017-01-18 01:50 - 15488968 _____ (Intel Corporation) C:\WINDOWS\system32\igc64.dll
2017-01-18 01:50 - 2017-01-18 01:50 - 13483240 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igc32.dll
2017-01-18 01:50 - 2017-01-18 01:50 - 13056584 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igd10iumd32.dll
2017-01-18 01:50 - 2017-01-18 01:50 - 00312344 _____ (Intel Corporation) C:\WINDOWS\system32\igd10idpp64.dll
2017-01-18 01:50 - 2017-01-18 01:50 - 00297208 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igd10idpp32.dll
2017-01-18 01:50 - 2017-01-18 01:50 - 00232432 _____ (Intel Corporation) C:\WINDOWS\system32\DPTopologyApp.exe
2017-01-18 01:50 - 2017-01-18 01:50 - 00175088 _____ (Intel Corporation) C:\WINDOWS\system32\difx64.exe
2017-01-17 20:44 - 2017-01-17 20:44 - 00831685 _____ C:\WINDOWS\system32\DisplayAudiox64.cab
2017-01-17 20:44 - 2017-01-17 20:44 - 00004862 _____ C:\WINDOWS\system32\iglhxs64.vp
2017-01-13 19:33 - 2017-01-13 19:33 - 00270726 _____ C:\Users\NG\Downloads\INZ 1113 Employer Supplementary Form_April 2016_FA_Web.pdf
2017-01-13 19:16 - 2017-01-13 19:41 - 00000000 ____D C:\Users\NG\Downloads\Essentials Work Visa II
2017-01-12 21:32 - 2017-01-12 21:32 - 00127084 _____ C:\Users\NG\Downloads\auction-1232279002.htm
2017-01-12 20:27 - 2016-12-21 20:43 - 04130440 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2017-01-12 20:27 - 2016-12-21 20:43 - 01454504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetsrc.dll
2017-01-12 20:27 - 2016-12-21 20:43 - 01071736 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetcore.dll
2017-01-12 20:27 - 2016-12-21 20:42 - 01988560 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2017-01-12 20:27 - 2016-12-21 20:42 - 01702392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll
2017-01-12 20:27 - 2016-12-21 20:42 - 01300600 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll
2017-01-12 20:27 - 2016-12-21 20:08 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpencom.dll
2017-01-12 20:27 - 2016-12-21 20:06 - 06285312 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2017-01-12 20:27 - 2016-12-21 19:56 - 00936960 _____ (Microsoft Corporation) C:\WINDOWS\system32\MCRecvSrc.dll
2017-01-12 20:27 - 2016-12-21 19:53 - 04474368 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll
2017-01-12 20:27 - 2016-12-21 19:51 - 08075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2017-01-12 20:27 - 2016-12-21 19:51 - 05611008 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1.dll
2017-01-12 20:27 - 2016-12-21 18:09 - 00263472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll
2017-01-12 20:27 - 2016-12-21 17:40 - 00557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StoreAgent.dll
2017-01-12 20:27 - 2016-12-21 17:40 - 00180224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe
2017-01-12 20:27 - 2016-12-21 17:39 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgentUserBroker.exe
2017-01-12 20:27 - 2016-12-21 17:22 - 01883648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll
2017-01-12 20:27 - 2016-12-14 18:41 - 01235296 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2017-01-12 20:27 - 2016-12-14 17:48 - 01631232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll
2017-01-12 20:27 - 2016-12-14 17:38 - 17188864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2017-01-12 20:27 - 2016-12-14 17:23 - 03134976 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll
2017-01-12 20:26 - 2016-12-21 21:08 - 00245600 _____ (Microsoft Corporation) C:\WINDOWS\system32\offlinesam.dll
2017-01-12 20:26 - 2016-12-21 21:08 - 00136032 _____ (Microsoft Corporation) C:\WINDOWS\system32\ImplatSetup.dll
2017-01-12 20:26 - 2016-12-21 21:04 - 07816032 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2017-01-12 20:26 - 2016-12-21 20:49 - 00328008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll
2017-01-12 20:26 - 2016-12-21 20:46 - 00624048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2017-01-12 20:26 - 2016-12-21 20:43 - 00092512 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2017-01-12 20:26 - 2016-12-21 20:42 - 22224480 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2017-01-12 20:26 - 2016-12-21 20:41 - 01600632 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2017-01-12 20:26 - 2016-12-21 20:37 - 00455520 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe
2017-01-12 20:26 - 2016-12-21 20:15 - 22563840 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2017-01-12 20:26 - 2016-12-21 20:14 - 00043008 _____ (Microsoft Corporation) C:\WINDOWS\system32\LaunchWinApp.exe
2017-01-12 20:26 - 2016-12-21 20:09 - 00368640 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneBackupHandler.dll
2017-01-12 20:26 - 2016-12-21 20:09 - 00363520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BioFeedback.dll
2017-01-12 20:26 - 2016-12-21 20:08 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BlockedShutdown.dll
2017-01-12 20:26 - 2016-12-21 20:08 - 00289792 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeveloperOptionsSettingsHandlers.dll
2017-01-12 20:26 - 2016-12-21 20:08 - 00211968 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe
2017-01-12 20:26 - 2016-12-21 20:07 - 00748544 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll
2017-01-12 20:26 - 2016-12-21 20:06 - 00310784 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncSettings.dll
2017-01-12 20:26 - 2016-12-21 20:06 - 00260608 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgentUserBroker.exe
2017-01-12 20:26 - 2016-12-21 20:06 - 00147456 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsrv.dll
2017-01-12 20:26 - 2016-12-21 20:05 - 00425984 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadcloudap.dll
2017-01-12 20:26 - 2016-12-21 20:05 - 00261632 _____ (Microsoft Corporation) C:\WINDOWS\system32\indexeddbserver.dll
2017-01-12 20:26 - 2016-12-21 20:05 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll
2017-01-12 20:26 - 2016-12-21 20:01 - 09131008 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2017-01-12 20:26 - 2016-12-21 20:00 - 00440320 _____ (Microsoft Corporation) C:\WINDOWS\system32\fhcfg.dll
2017-01-12 20:26 - 2016-12-21 19:59 - 01908224 _____ (Microsoft Corporation) C:\WINDOWS\system32\AzureSettingSyncProvider.dll
2017-01-12 20:26 - 2016-12-21 19:59 - 00883712 _____ (Microsoft Corporation) C:\WINDOWS\system32\samsrv.dll
2017-01-12 20:26 - 2016-12-21 19:58 - 23678464 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2017-01-12 20:26 - 2016-12-21 19:57 - 00462336 _____ (Microsoft Corporation) C:\WINDOWS\system32\fhsettingsprovider.dll
2017-01-12 20:26 - 2016-12-21 19:56 - 00947712 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVP9DEC.dll
2017-01-12 20:26 - 2016-12-21 19:55 - 08129536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2017-01-12 20:26 - 2016-12-21 19:55 - 04749312 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2017-01-12 20:26 - 2016-12-21 19:54 - 05511680 _____ (Microsoft Corporation) C:\WINDOWS\system32\aclui.dll
2017-01-12 20:26 - 2016-12-21 19:53 - 06664192 _____ (Microsoft Corporation) C:\WINDOWS\system32\mspaint.exe
2017-01-12 20:26 - 2016-12-21 19:50 - 01490432 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2017-01-12 20:26 - 2016-12-21 19:49 - 04149248 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2017-01-12 20:26 - 2016-12-21 19:49 - 02691072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll
2017-01-12 20:26 - 2016-12-21 19:49 - 01062912 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
2017-01-12 20:26 - 2016-12-21 19:47 - 01121280 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadtb.dll
2017-01-12 20:26 - 2016-12-21 18:59 - 00218976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\offlinesam.dll
2017-01-12 20:26 - 2016-12-21 18:02 - 03892864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2017-01-12 20:26 - 2016-12-21 18:02 - 01852720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2017-01-12 20:26 - 2016-12-21 18:02 - 01360464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetsrc.dll
2017-01-12 20:26 - 2016-12-21 18:02 - 01277344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll
2017-01-12 20:26 - 2016-12-21 18:02 - 01201872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll
2017-01-12 20:26 - 2016-12-21 18:02 - 00980832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetcore.dll
2017-01-12 20:26 - 2016-12-21 18:01 - 20969928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2017-01-12 20:26 - 2016-12-21 17:46 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LaunchWinApp.exe
2017-01-12 20:26 - 2016-12-21 17:43 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BlockedShutdown.dll
2017-01-12 20:26 - 2016-12-21 17:41 - 00253952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BioFeedback.dll
2017-01-12 20:26 - 2016-12-21 17:41 - 00231936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll
2017-01-12 20:26 - 2016-12-21 17:40 - 00318976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpencom.dll
2017-01-12 20:26 - 2016-12-21 17:40 - 00237056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SyncSettings.dll
2017-01-12 20:26 - 2016-12-21 17:39 - 01300480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVPXENC.dll
2017-01-12 20:26 - 2016-12-21 17:38 - 00866816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Cred.dll
2017-01-12 20:26 - 2016-12-21 17:35 - 04612608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2017-01-12 20:26 - 2016-12-21 17:35 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\indexeddbserver.dll
2017-01-12 20:26 - 2016-12-21 17:34 - 07626752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2017-01-12 20:26 - 2016-12-21 17:33 - 19413504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2017-01-12 20:26 - 2016-12-21 17:32 - 19417600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2017-01-12 20:26 - 2016-12-21 17:30 - 05398016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aclui.dll
2017-01-12 20:26 - 2016-12-21 17:30 - 01255936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AzureSettingSyncProvider.dll
2017-01-12 20:26 - 2016-12-21 17:27 - 00640000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MCRecvSrc.dll
2017-01-12 20:26 - 2016-12-21 17:26 - 01155072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVP9DEC.dll
2017-01-12 20:26 - 2016-12-21 17:25 - 07469056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2017-01-12 20:26 - 2016-12-21 17:25 - 06474752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mspaint.exe
2017-01-12 20:26 - 2016-12-21 17:24 - 06044160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2017-01-12 20:26 - 2016-12-14 18:41 - 00590960 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2017-01-12 20:26 - 2016-12-14 18:34 - 02482280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll
2017-01-12 20:26 - 2016-12-14 18:33 - 01356864 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipUp.exe
2017-01-12 20:26 - 2016-12-14 18:23 - 00404832 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2017-01-12 20:26 - 2016-12-14 18:21 - 02206496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2vdec.dll
2017-01-12 20:26 - 2016-12-14 18:19 - 00584544 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2017-01-12 20:26 - 2016-12-14 18:18 - 00715104 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2017-01-12 20:26 - 2016-12-14 18:18 - 00335712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys
2017-01-12 20:26 - 2016-12-14 18:17 - 00319288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll
2017-01-12 20:26 - 2016-12-14 18:14 - 01694712 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmde.dll
2017-01-12 20:26 - 2016-12-14 18:14 - 00418952 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2017-01-12 20:26 - 2016-12-14 18:14 - 00089416 _____ (Microsoft Corporation) C:\WINDOWS\system32\remoteaudioendpoint.dll
2017-01-12 20:26 - 2016-12-14 18:01 - 01557808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll
2017-01-12 20:26 - 2016-12-14 18:01 - 00382784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2017-01-12 20:26 - 2016-12-14 18:01 - 00076984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\remoteaudioendpoint.dll
2017-01-12 20:26 - 2016-12-14 17:46 - 01631232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Resources.dll
2017-01-12 20:26 - 2016-12-14 17:46 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2017-01-12 20:26 - 2016-12-14 17:43 - 00201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\ScDeviceEnum.dll
2017-01-12 20:26 - 2016-12-14 17:42 - 00352768 _____ (Microsoft Corporation) C:\WINDOWS\system32\cloudAP.dll
2017-01-12 20:26 - 2016-12-14 17:42 - 00236544 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSCard.dll
2017-01-12 20:26 - 2016-12-14 17:42 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.UI.Logon.ProxyStub.dll
2017-01-12 20:26 - 2016-12-14 17:42 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinSCard.dll
2017-01-12 20:26 - 2016-12-14 17:41 - 00223744 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2017-01-12 20:26 - 2016-12-14 17:40 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\system32\domgmt.dll
2017-01-12 20:26 - 2016-12-14 17:40 - 00231424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudBackupSettings.dll
2017-01-12 20:26 - 2016-12-14 17:40 - 00193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\certprop.dll
2017-01-12 20:26 - 2016-12-14 17:39 - 00837632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wbiosrvc.dll
2017-01-12 20:26 - 2016-12-14 17:39 - 00290816 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll
2017-01-12 20:26 - 2016-12-14 17:39 - 00257024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.CredDialogController.dll
2017-01-12 20:26 - 2016-12-14 17:38 - 13869056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2017-01-12 20:26 - 2016-12-14 17:38 - 00295424 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudBackupSettings.dll
2017-01-12 20:26 - 2016-12-14 17:38 - 00213504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.CredDialogController.dll
2017-01-12 20:26 - 2016-12-14 17:37 - 00090112 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatepolicy.dll
2017-01-12 20:26 - 2016-12-14 17:36 - 01002496 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll
2017-01-12 20:26 - 2016-12-14 17:36 - 00539648 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll
2017-01-12 20:26 - 2016-12-14 17:36 - 00074752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\updatepolicy.dll
2017-01-12 20:26 - 2016-12-14 17:35 - 00755712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2017-01-12 20:26 - 2016-12-14 17:35 - 00712192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2017-01-12 20:26 - 2016-12-14 17:35 - 00600576 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptui.dll
2017-01-12 20:26 - 2016-12-14 17:35 - 00553984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptui.dll
2017-01-12 20:26 - 2016-12-14 17:32 - 00497152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LogonController.dll
2017-01-12 20:26 - 2016-12-14 17:26 - 00932864 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2017-01-12 20:26 - 2016-12-14 17:26 - 00869888 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2017-01-12 20:26 - 2016-12-14 17:25 - 02009600 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRHInproc.dll
2017-01-12 20:26 - 2016-12-14 17:24 - 01005568 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3D12.dll
2017-01-12 20:26 - 2016-12-14 17:24 - 00673792 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2017-01-12 20:26 - 2016-12-14 17:23 - 01231872 _____ (Microsoft Corporation) C:\WINDOWS\system32\dosvc.dll
2017-01-12 20:26 - 2016-12-14 17:22 - 02748416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll
2017-01-12 20:26 - 2016-12-14 17:22 - 02317824 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2017-01-12 20:26 - 2016-12-14 17:22 - 01513472 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2017-01-12 20:26 - 2016-12-14 17:22 - 00391168 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll
2017-01-12 20:26 - 2016-12-14 17:21 - 03616768 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2017-01-12 20:26 - 2016-11-03 01:01 - 00484584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2017-01-12 20:26 - 2016-11-03 00:00 - 00534096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2017-01-12 20:26 - 2016-11-02 23:28 - 00324608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll
2017-01-12 20:26 - 2016-11-02 23:22 - 00337920 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2017-01-12 20:26 - 2016-11-02 23:21 - 00942080 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2017-01-12 20:26 - 2016-08-02 17:30 - 00822784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
2017-01-12 20:25 - 2016-12-21 20:42 - 00241504 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHost.dll
2017-01-12 20:25 - 2016-12-21 20:13 - 00119808 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCsp.dll
2017-01-12 20:25 - 2016-12-21 20:12 - 00083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProvPluginEng.dll
2017-01-12 20:25 - 2016-12-21 20:10 - 00234496 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCore.dll
2017-01-12 20:25 - 2016-12-21 20:08 - 01292288 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVPXENC.dll
2017-01-12 20:25 - 2016-12-21 20:08 - 00349184 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll
2017-01-12 20:25 - 2016-12-21 19:53 - 01692672 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2017-01-12 20:25 - 2016-12-21 19:51 - 02275840 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2017-01-12 20:25 - 2016-12-21 17:24 - 05061120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll
2017-01-12 20:25 - 2016-12-21 17:24 - 03733504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll
2017-01-12 20:25 - 2016-12-21 17:24 - 00886272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aadtb.dll
2017-01-12 20:25 - 2016-12-21 17:22 - 00860672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll
2017-01-12 20:25 - 2016-12-14 18:08 - 00341344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2017-01-12 20:25 - 2016-12-14 18:06 - 00509792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2017-01-12 20:25 - 2016-12-14 17:45 - 00147968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32k.sys
2017-01-12 20:25 - 2016-12-14 17:40 - 00266752 _____ (Microsoft Corporation) C:\WINDOWS\system32\ConsoleLogon.dll
2017-01-12 20:25 - 2016-12-14 17:40 - 00104448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.UI.Logon.ProxyStub.dll
2017-01-12 20:25 - 2016-12-14 17:32 - 00806400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3D12.dll
2017-01-12 20:25 - 2016-12-14 17:22 - 02998272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2017-01-12 20:25 - 2016-12-14 17:22 - 00707584 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll
2017-01-10 18:17 - 2017-01-10 18:17 - 00004686 _____ C:\Users\NG\Downloads\The-Bromley-Collection-LR5-Presets.zip
2017-01-10 18:16 - 2017-01-10 18:18 - 62532375 _____ C:\Users\NG\Downloads\Sweet-Little-Hand-Drawn-Elements.zip
2017-01-10 18:16 - 2017-01-10 18:16 - 00257932 _____ C:\Users\NG\Downloads\Naive-Deco-Sans-Font-Pack.zip
2017-01-04 13:22 - 2017-01-04 13:24 - 26792177 _____ C:\Users\NG\Downloads\SEO-Line-Art-Icons.zip
2017-01-04 13:21 - 2017-01-04 13:47 - 450866277 _____ C:\Users\NG\Downloads\The-Designer-Backpack-Photo-Bundle.zip
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-02-03 19:14 - 2015-03-23 09:53 - 00000000 ____D C:\Users\NG\AppData\Roaming\Skype
2017-02-03 17:06 - 2016-10-23 08:50 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2017-02-03 15:54 - 2015-07-31 11:19 - 01193294 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-02-03 15:50 - 2016-10-23 08:52 - 00000000 ____D C:\Users\NG
2017-02-03 15:50 - 2016-10-23 08:50 - 00000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2017-02-03 15:50 - 2014-10-26 00:42 - 00000000 __SHD C:\Users\NG\IntelGraphicsProfiles
2017-02-03 01:10 - 2016-10-23 09:01 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-02-03 01:10 - 2016-07-16 19:04 - 01310720 _____ C:\WINDOWS\system32\config\BBI
2017-02-02 22:18 - 2016-07-17 00:45 - 00000000 ____D C:\WINDOWS\INF
2017-02-02 19:05 - 2016-07-17 00:47 - 00000000 ___HD C:\Program Files\WindowsApps
2017-02-02 19:05 - 2016-07-17 00:47 - 00000000 ____D C:\WINDOWS\AppReadiness
2017-02-02 19:04 - 2014-10-24 18:10 - 00000000 ____D C:\Users\NG\AppData\Local\Adobe
2017-01-31 09:58 - 2016-07-17 00:47 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2017-01-31 08:38 - 2016-10-23 08:50 - 00000200 _____ C:\WINDOWS\system32\{EC94D02F-D200-4428-9531-05AF7F9799CB}.bat
2017-01-29 19:18 - 2016-12-22 21:59 - 00000789 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera 42.lnk
2017-01-29 19:18 - 2016-10-23 09:01 - 00003922 _____ C:\WINDOWS\System32\Tasks\Opera scheduled Autoupdate 1474786425
2017-01-28 13:41 - 2014-10-26 01:01 - 00000000 ____D C:\Users\NG\AppData\Local\ElevatedDiagnostics
2017-01-27 06:49 - 2016-10-23 08:50 - 05042528 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2017-01-26 10:31 - 2015-08-15 16:26 - 00000000 ____D C:\Program Files\trend micro
2017-01-26 09:53 - 2014-11-10 00:36 - 00000000 ____D C:\Users\NG\AppData\Roaming\npm-cache
2017-01-25 21:22 - 2016-07-17 00:36 - 00000000 ____D C:\WINDOWS\CbsTemp
2017-01-22 17:30 - 2014-10-27 16:32 - 00000000 ____D C:\Users\NG\AppData\Roaming\uTorrent
2017-01-22 00:32 - 2014-10-26 00:03 - 00000000 ____D C:\Users\NG\AppData\Roaming\Dropbox
2017-01-19 19:41 - 2016-12-13 20:33 - 00003266 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task v2
2017-01-19 19:41 - 2015-07-31 11:26 - 00002359 _____ C:\Users\NG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2017-01-18 01:52 - 2016-10-23 08:50 - 00103960 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.DLL
2017-01-18 01:52 - 2016-10-23 08:50 - 00099864 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.DLL
2017-01-18 01:52 - 2016-07-20 01:12 - 02142232 _____ (Intel Corporation) C:\WINDOWS\system32\igfxLHM.dll
2017-01-18 01:52 - 2016-07-20 01:12 - 00756760 _____ (Intel Corporation) C:\WINDOWS\system32\igfxDH.dll
2017-01-18 01:52 - 2016-07-20 01:12 - 00399384 _____ (Intel Corporation) C:\WINDOWS\system32\igfxDI.dll
2017-01-18 01:52 - 2016-07-20 01:12 - 00354800 _____ (Intel Corporation) C:\WINDOWS\system32\igfxEM.exe
2017-01-18 01:52 - 2016-07-20 01:12 - 00268784 _____ (Intel Corporation) C:\WINDOWS\system32\igfxHK.exe
2017-01-18 01:52 - 2016-07-20 01:12 - 00237040 _____ (Intel Corporation) C:\WINDOWS\system32\igfxext.exe
2017-01-18 01:52 - 2016-07-20 01:12 - 00052760 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igfxexps32.dll
2017-01-18 01:52 - 2016-07-20 01:05 - 00401904 _____ C:\WINDOWS\system32\igfxTray.exe
2017-01-18 01:51 - 2016-07-20 01:19 - 06696864 _____ (Intel Corporation) C:\WINDOWS\system32\igdusc64.dll
2017-01-18 01:51 - 2016-07-20 01:19 - 05140512 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdusc32.dll
2017-01-18 01:51 - 2016-07-20 01:19 - 00055288 _____ (Intel Corporation) C:\WINDOWS\system32\igfxexps.dll
2017-01-18 01:51 - 2016-07-20 01:18 - 38903944 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdumdim32.dll
2017-01-18 01:51 - 2016-07-20 01:18 - 33479912 _____ (Intel Corporation) C:\WINDOWS\system32\igd11dxva64.dll
2017-01-18 01:51 - 2016-07-20 01:12 - 00373744 _____ (Intel Corporation) C:\WINDOWS\system32\igfxCUIService.exe
2017-01-18 01:51 - 2016-07-20 01:11 - 07969776 _____ (Intel Corporation) C:\WINDOWS\system32\Drivers\igdkmd64.sys
2017-01-18 01:50 - 2016-07-20 01:17 - 16446376 _____ (Intel Corporation) C:\WINDOWS\system32\igd10iumd64.dll
2017-01-16 16:19 - 2016-07-17 00:47 - 00000000 ____D C:\WINDOWS\system32\NDF
2017-01-14 11:36 - 2016-10-23 09:01 - 00003834 _____ C:\WINDOWS\System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473
2017-01-14 11:31 - 2014-10-24 18:08 - 00000000 __RHD C:\Users\Public\AccountPictures
2017-01-13 22:01 - 2016-07-17 00:47 - 00000000 ____D C:\WINDOWS\rescache
2017-01-13 21:20 - 2016-07-17 00:47 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2017-01-13 21:20 - 2016-07-17 00:47 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2017-01-13 21:20 - 2016-07-17 00:47 - 00000000 ____D C:\WINDOWS\system32\oobe
2017-01-13 21:20 - 2016-07-17 00:47 - 00000000 ____D C:\WINDOWS\ShellExperiences
2017-01-13 21:20 - 2016-07-17 00:47 - 00000000 ____D C:\WINDOWS\Provisioning
2017-01-13 19:13 - 2015-07-30 20:20 - 00002487 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2017-01-13 19:12 - 2016-10-23 09:01 - 00004562 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2017-01-12 21:24 - 2016-11-29 05:44 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2017-01-12 21:22 - 2014-10-25 23:28 - 00000000 ____D C:\WINDOWS\system32\MRT
2017-01-12 21:13 - 2014-10-25 23:28 - 135657872 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
==================== Files in the root of some directories =======
2014-10-24 18:10 - 2014-10-24 18:11 - 0001024 _____ () C:\Users\NG\AppData\Roaming\AbsoluteReminder.xml
2016-08-14 11:57 - 2016-08-12 15:48 - 0036423 ___SH () C:\Users\NG\AppData\Roaming\DUDhFYiGKNCXHXTDEOT
2016-08-14 11:57 - 2016-08-12 15:48 - 0452624 ___SH () C:\Users\NG\AppData\Roaming\KhMVdSgDETVh
2014-12-13 09:28 - 2015-11-28 20:31 - 0000600 _____ () C:\Users\NG\AppData\Roaming\winscp.rnd
2016-08-14 11:57 - 2016-08-12 15:48 - 0936960 ___SH () C:\Users\NG\AppData\Roaming\ZfgTgZcFLQKGHMMDOQEQf.cmd
2014-11-08 09:24 - 2016-10-01 16:38 - 0001456 _____ () C:\Users\NG\AppData\Local\Adobe Save for Web 13.0 Prefs
2014-11-28 01:53 - 2016-04-11 11:12 - 0000600 _____ () C:\Users\NG\AppData\Local\PUTTY.RND
2014-11-08 06:46 - 2015-06-03 23:11 - 0007601 _____ () C:\Users\NG\AppData\Local\resmon.resmoncfg
2016-10-23 08:51 - 2016-10-23 08:51 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2013-11-18 15:23 - 2013-02-19 20:34 - 2064264 _____ (Samsung Electronics) C:\ProgramData\MakeMarkerFile.exe
2013-11-18 15:23 - 2013-01-13 03:51 - 0003004 _____ () C:\ProgramData\MakeMarkerFile.xml
2016-08-14 11:59 - 2016-09-25 11:41 - 0000000 _____ () C:\ProgramData\no_zooｍ_ｃhroｍe.exe.lnk.bat
Files to move or delete:
====================
C:\Users\NG\AppData\Roaming\ProxyGate\MainService.exe
C:\ProgramData\no_zooｍ_ｃhroｍe.exe.lnk.bat
Some files in TEMP:
====================
2016-12-21 07:03 - 2017-01-19 19:47 - 6699008 _____ () C:\Users\NG\AppData\Local\Temp\SkypeSetup.exe
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2017-02-01 17:07
==================== End of FRST.txt ============================
-
Rudy
- Site Admin
- Příspěvky: 119671
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: HOSTS soubor s cizími adresami (AdClick virus?)
Otevřte poznámkový blok a zkopírujte do něj:
Uložte do C:\Users\NG\Downloads jako fixlist.txt. Spusťte znovu FRST a klikněte na >Fix<. Po skončení akce se objeví log, který sem zkopírujte.Start
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-06-08] (Oracle Corporation)
HKU\S-1-5-21-1341208516-2984071467-593012157-1001\...\Run: [ProxyGate] => C:\Users\NG\AppData\Roaming\ProxyGate\MainService.exe [1142880 2016-01-10] (Gold Click Ltd) <===== ATTENTION
SearchScopes: HKU\S-1-5-21-1341208516-2984071467-593012157-1001 -> {A7816E13-C979-4EBD-B1B1-4AD813D1A417} URL =
C:\WINDOWS\LastGood.Tmp
C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
C:\WINDOWS\system32\{EC94D02F-D200-4428-9531-05AF7F9799CB}.bat
C:\Users\NG\AppData\Roaming\DUDhFYiGKNCXHXTDEOT
C:\Users\NG\AppData\Roaming\KhMVdSgDETVh
C:\Users\NG\AppData\Roaming\ZfgTgZcFLQKGHMMDOQEQf.cmd
C:\ProgramData\DP45977C.lfl
C:\ProgramData\no_zooｍ_ｃhroｍe.exe.lnk.bat
C:\Users\NG\AppData\Roaming\ProxyGate\MainService.exe
ProxyGate version 3.0.0.1176 (HKU\S-1-5-21-1341208516-2984071467-593012157-1001\...\{1EC095EE-8CA3-43D6-B9F5-0C55B82ED3D7}}_is1) (Version: 3.0.0.1176 - Gold Click Ltd) <==== ATTENTION
Task: {11085776-3D74-4F95-B9C4-29EAC65C7017} - \GenericSettingsHandler\Windows-Credentials\RetrySyncTask_for_S-1-5-21-1341208516-2984071467-593012157-1001 -> No File <==== ATTENTION
Task: {364AFFD1-B7A8-4582-82C2-A1DFF6CFD40E} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {4D6DA131-3277-441A-BE3C-86F300D83E8F} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTIO
Task: {5D6E03D4-E9E3-4E94-9DE7-720C7CB6E105} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {5EC1111D-4EE0-42EC-8230-F5D8D6DF89AE} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {606E0E54-3A32-44B1-9FA6-1641B2B3AB28} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {757BC7B8-DCDA-451E-BAE0-F05857B4C6C0} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {7D43C8A6-8AEE-45A9-A66F-D88DF1793B5A} - \WPD\SqmUpload_S-1-5-21-1341208516-2984071467-593012157-1001 -> No File <==== ATTENTION
Task: {85A67450-CE0C-4B9A-B9B2-EF736DBDF55C} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {909F0605-0D08-4737-8A8A-A28B57A6E3F7} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {A2542B4A-4802-4B12-9900-36884DADEFF9} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {B3B169F8-CEFE-4D0A-89D4-EA80F101CB21} - \WPD\SqmUpload_S-1-5-21-1341208516-2984071467-593012157-1002 -> No File <==== ATTENTION
Task: {BDC9676E-CA63-4493-AAC7-82BA1F4EE43B} - \OfficeSoftwareProtectionPlatform\SvcRestartTask -> No File <==== ATTENTION
Task: {ECC5930B-B688-4B09-9A37-3818D82DA6CB} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {FF308900-46B2-4533-9427-E10A15FB0490} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
AlternateDataStreams: C:\ProgramData\TEMP:054203E4 [302]
ResetHosts:
EmptyTemp:
End
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Přispějete na provoz fóra?