Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

Krádež STEEAM účtu

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Odpovědět
Zpráva
Autor
P3S
Návštěvník
Návštěvník
Příspěvky: 4
Registrován: 27 lis 2008 14:44

Krádež STEEAM účtu

#1 Příspěvek od P3S »

Dobrý den prosím o kontrolu logu došlo u mě ke krádeži účtu (to už jsem vyřešil ) a k pokusu krádeže jiného účtu . Počítač jsem vyčistil MWAVem a nyní posílám log jestli je vše OK

Logfile of random's system information tool 1.10 (written by random/random)
Run by P3S at 2017-09-27 17:13:59
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 68 GB (14%) free of 477 GB
Total RAM: 4054 MB (58% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:14:06, on 27.9.2017
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18792)
Boot mode: Normal

Running processes:
C:\Games\World_of_Tanks\WargamingGameUpdater.exe
C:\Program Files (x86)\Avira\Antivirus\avgnt.exe
C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
C:\Program Files\trend micro\P3S.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKCU\..\Run: [World of Tanks] "C:\Games\World_of_Tanks\WargamingGameUpdater.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Avira Mail Protection (AntiVirMailService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\Antivirus\avmailc7.exe
O23 - Service: Avira Scheduler (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\Antivirus\sched.exe
O23 - Service: Avira Real-Time Protection (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\Antivirus\avguard.exe
O23 - Service: Avira Web Protection (AntiVirWebService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\Antivirus\avwebg7.exe
O23 - Service: Avira Service Host (Avira.ServiceHost) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: Disc Soft Lite Bus Service - Disc Soft Ltd - C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Aktualizace Google (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Aktualizace Google (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 5843 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
"C:\Program Files (x86)\Avira\Antivirus\sched.exe"
atieclxx
taskeng.exe {EFD5F924-7EF7-40AF-9D44-AD047225B52E}
"C:\Windows\system32\Dwm.exe"
"taskhost.exe"
C:\Windows\Explorer.EXE
C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe atlogon
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler.exe"
"C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler64.exe"
"C:\Program Files (x86)\Avira\Antivirus\avguard.exe"
C:\Windows\System32\svchost.exe -k utcsvc
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe"
"C:\Games\World_of_Tanks\WargamingGameUpdater.exe"
"C:\Program Files (x86)\Avira\Antivirus\avshadow.exe" avshadowcontrol0_000004dc
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files (x86)\Avira\Antivirus\avgnt.exe" /min
"C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe" /connectToHost
taskeng.exe {220401CD-F098-4FA9-A3F0-B57DD5B4E095}
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\P3S\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\P3S\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=61.0.3163.100 --initial-client-data=0x80,0x84,0x88,0x7c,0x8c,0x7fef2821988,0x7fef2821948,0x7fef2821958
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=3932 --on-initialized-event-handle=312 --parent-handle=316 /prefetch:6
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1120,5690266867961318021,6861806117431797751,131072 --disable-direct-composition --supports-dual-gpus=false --gpu-driver-bug-workarounds=9,12,13,22,23,24,27,49,84 --disable-gl-extensions="GL_KHR_blend_equation_advanced GL_KHR_blend_equation_advanced_coherent" --gpu-vendor-id=0x1002 --gpu-device-id=0x6613 --gpu-driver-vendor="Advanced Micro Devices, Inc." --gpu-driver-version=22.19.676.4 --gpu-driver-date=9-1-2017 --service-request-channel-token=618E50545B0F003C439C63C32B1388DF --mojo-platform-channel-handle=1184 --ignored=" --type=renderer " /prefetch:2
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,5690266867961318021,6861806117431797751,131072 --service-pipe-token=967A5FFB93F9A80865FC6D664BEEA4EE --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=967A5FFB93F9A80865FC6D664BEEA4EE --renderer-client-id=10 --mojo-platform-channel-handle=2728 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,5690266867961318021,6861806117431797751,131072 --service-pipe-token=7BB28D9859C3F43DF4162268EFA6ED58 --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=7BB28D9859C3F43DF4162268EFA6ED58 --renderer-client-id=4 --mojo-platform-channel-handle=4172 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,5690266867961318021,6861806117431797751,131072 --service-pipe-token=BD91DB80DA79C487DFBCDC5FC5D4C273 --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=BD91DB80DA79C487DFBCDC5FC5D4C273 --renderer-client-id=7 --mojo-platform-channel-handle=5360 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,5690266867961318021,6861806117431797751,131072 --service-pipe-token=16A368B2D7EF275CC5F4C1B8A3564A02 --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=16A368B2D7EF275CC5F4C1B8A3564A02 --renderer-client-id=8 --mojo-platform-channel-handle=6744 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,5690266867961318021,6861806117431797751,131072 --service-pipe-token=AFDA71B965A86843584BA145CA1C524A --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=AFDA71B965A86843584BA145CA1C524A --renderer-client-id=16 --mojo-platform-channel-handle=5156 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,5690266867961318021,6861806117431797751,131072 --service-pipe-token=09E82E1969F9CDA1D842036EBFEF2040 --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=09E82E1969F9CDA1D842036EBFEF2040 --renderer-client-id=9 --mojo-platform-channel-handle=7032 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,5690266867961318021,6861806117431797751,131072 --service-pipe-token=DA21BFE6A67CC4D70EF59A106EFFB716 --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=DA21BFE6A67CC4D70EF59A106EFFB716 --renderer-client-id=6 --mojo-platform-channel-handle=5776 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,5690266867961318021,6861806117431797751,131072 --service-pipe-token=A8B86E267EFB706649626DA330F5F0E0 --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=A8B86E267EFB706649626DA330F5F0E0 --renderer-client-id=5 --mojo-platform-channel-handle=3240 /prefetch:1
taskhost.exe $(Arg0)
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 520 524 532 65536 528

"C:\Users\P3S\Downloads\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Registry dump======

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"World of Tanks"=C:\Games\World_of_Tanks\WargamingGameUpdater.exe [2017-02-28 3135752]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CCleaner Monitoring]
C:\Program Files\CCleaner\CCleaner64.exe /MONITOR []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite Automount]
C:\Program Files\DAEMON Tools Lite\DTAgent.exe [2017-02-07 4701888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VDownloader]
C:\Program Files\VDownloader\Vdownloader4.exe [2017-04-10 13975552]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\World of Tanks]
C:\Games\World_of_Tanks\WargamingGameUpdater.exe [2017-02-28 3135752]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2012-11-12 441344]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=153

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktopChanges"=1
"NoDriveTypeAutoRun"=153

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux2"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2017-09-27 17:14:00 ----D---- C:\Program Files\trend micro
2017-09-27 17:13:59 ----D---- C:\rsit
2017-09-19 15:01:52 ----D---- C:\Program Files (x86)\InstallShield Installation Information
2017-09-19 14:43:59 ----D---- C:\Program Files (x86)\Ubisoft
2017-09-19 09:09:13 ----D---- C:\Users\P3S\AppData\Roaming\FiraxisLive
2017-09-18 22:18:31 ----D---- C:\Program Files (x86)\Electronic Arts
2017-09-18 12:43:11 ----D---- C:\Program Files\FlatOut2
2017-09-17 16:40:31 ----A---- C:\Windows\system32\drivers\trufos.sys
2017-09-17 16:40:25 ----A---- C:\Windows\SYSWOW64\msvcr80.dll
2017-09-17 16:40:24 ----A---- C:\Windows\SYSWOW64\msvcp80.dll
2017-09-17 16:40:23 ----A---- C:\Windows\SYSWOW64\msvcp90.dll
2017-09-17 16:40:22 ----A---- C:\Windows\SYSWOW64\msvcr90.dll
2017-09-17 16:40:21 ----A---- C:\Windows\SYSWOW64\eEmpty.exe
2017-09-17 16:40:14 ----D---- C:\ProgramData\MicroWorld
2017-09-17 08:13:32 ----D---- C:\Program Files (x86)\AMD
2017-09-16 20:07:59 ----D---- C:\Windows\SYSWOW64\Macromed
2017-09-13 07:55:36 ----A---- C:\Windows\system32\mshtml.dll
2017-09-13 07:55:34 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2017-09-13 07:55:34 ----A---- C:\Windows\system32\ieframe.dll
2017-09-13 07:55:32 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2017-09-13 07:55:32 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2017-09-13 07:55:32 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2017-09-13 07:55:32 ----A---- C:\Windows\system32\wininet.dll
2017-09-13 07:55:32 ----A---- C:\Windows\system32\jscript9.dll
2017-09-13 07:55:31 ----A---- C:\Windows\SYSWOW64\wininet.dll
2017-09-13 07:55:31 ----A---- C:\Windows\SYSWOW64\DXPTaskRingtone.dll
2017-09-13 07:55:31 ----A---- C:\Windows\system32\win32k.sys
2017-09-13 07:55:31 ----A---- C:\Windows\system32\shell32.dll
2017-09-13 07:55:31 ----A---- C:\Windows\system32\iertutil.dll
2017-09-13 07:55:31 ----A---- C:\Windows\system32\DXPTaskRingtone.dll
2017-09-13 07:55:30 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2017-09-13 07:55:30 ----A---- C:\Windows\SYSWOW64\shell32.dll
2017-09-13 07:55:30 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2017-09-13 07:55:30 ----A---- C:\Windows\system32\urlmon.dll
2017-09-13 07:55:30 ----A---- C:\Windows\system32\msfeeds.dll
2017-09-13 07:55:30 ----A---- C:\Windows\system32\mmcndmgr.dll
2017-09-13 07:55:30 ----A---- C:\Windows\system32\mmc.exe
2017-09-13 07:55:29 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2017-09-13 07:55:29 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2017-09-13 07:55:29 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2017-09-13 07:55:29 ----A---- C:\Windows\system32\ntoskrnl.exe
2017-09-13 07:55:28 ----A---- C:\Windows\SYSWOW64\mmcndmgr.dll
2017-09-13 07:55:28 ----A---- C:\Windows\SYSWOW64\mmc.exe
2017-09-13 07:55:28 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2017-09-13 07:55:28 ----A---- C:\Windows\system32\win32spl.dll
2017-09-13 07:55:28 ----A---- C:\Windows\system32\localspl.dll
2017-09-13 07:55:28 ----A---- C:\Windows\system32\iedkcs32.dll
2017-09-13 07:55:27 ----A---- C:\Windows\SYSWOW64\Wldap32.dll
2017-09-13 07:55:27 ----A---- C:\Windows\SYSWOW64\win32spl.dll
2017-09-13 07:55:27 ----A---- C:\Windows\SYSWOW64\usp10.dll
2017-09-13 07:55:27 ----A---- C:\Windows\system32\Wldap32.dll
2017-09-13 07:55:27 ----A---- C:\Windows\system32\usp10.dll
2017-09-13 07:55:27 ----A---- C:\Windows\system32\ie4uinit.exe
2017-09-13 07:55:27 ----A---- C:\Windows\system32\drivers\srvnet.sys
2017-09-13 07:55:26 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2017-09-13 07:55:26 ----A---- C:\Windows\system32\ntprint.dll
2017-09-13 07:55:26 ----A---- C:\Windows\system32\nsisvc.dll
2017-09-13 07:55:26 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2017-09-13 07:55:26 ----A---- C:\Windows\system32\mmcshext.dll
2017-09-13 07:55:26 ----A---- C:\Windows\system32\mmcbase.dll
2017-09-13 07:55:26 ----A---- C:\Windows\system32\drivers\netbt.sys
2017-09-13 07:55:26 ----A---- C:\Windows\system32\cic.dll
2017-09-13 07:55:25 ----A---- C:\Windows\SYSWOW64\ntprint.dll
2017-09-13 07:55:25 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2017-09-13 07:55:25 ----A---- C:\Windows\system32\ntdll.dll
2017-09-13 07:55:25 ----A---- C:\Windows\system32\drivers\nsiproxy.sys
2017-09-13 07:55:25 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2017-09-13 07:55:25 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2017-09-13 07:55:24 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2017-09-13 07:55:24 ----A---- C:\Windows\SYSWOW64\msrating.dll
2017-09-13 07:55:24 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2017-09-13 07:55:24 ----A---- C:\Windows\SYSWOW64\mmcshext.dll
2017-09-13 07:55:24 ----A---- C:\Windows\SYSWOW64\mmcbase.dll
2017-09-13 07:55:24 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2017-09-13 07:55:24 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2017-09-13 07:55:24 ----A---- C:\Windows\SYSWOW64\cic.dll
2017-09-13 07:55:24 ----A---- C:\Windows\system32\webcheck.dll
2017-09-13 07:55:24 ----A---- C:\Windows\system32\shdocvw.dll
2017-09-13 07:55:24 ----A---- C:\Windows\system32\msrating.dll
2017-09-13 07:55:24 ----A---- C:\Windows\system32\mshtmled.dll
2017-09-13 07:55:24 ----A---- C:\Windows\system32\dxtrans.dll
2017-09-13 07:55:24 ----A---- C:\Windows\system32\dxtmsft.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\winnsi.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\shdocvw.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\occache.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\nsi.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\jscript.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\inseng.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\ieui.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\certcli.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\winnsi.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\vbscript.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\ole32.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\occache.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\nsi.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\mshtmlmedia.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\MshtmlDac.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\jsproxy.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\jscript9diag.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\jscript.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\inseng.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\ieUnatt.exe
2017-09-13 07:55:23 ----A---- C:\Windows\system32\ieui.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\iesetup.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\iernonce.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\ieetwproxystub.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\ieetwcollector.exe
2017-09-13 07:55:23 ----A---- C:\Windows\system32\certcli.dll
2017-09-13 07:55:22 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2017-09-13 07:55:22 ----A---- C:\Windows\SYSWOW64\ole32.dll
2017-09-13 07:55:22 ----A---- C:\Windows\system32\smss.exe
2017-09-13 07:55:22 ----A---- C:\Windows\system32\rpcss.dll
2017-09-13 07:55:22 ----A---- C:\Windows\system32\rpcrt4.dll
2017-09-13 07:55:22 ----A---- C:\Windows\system32\ntprint.exe
2017-09-13 07:55:22 ----A---- C:\Windows\system32\lsasrv.dll
2017-09-13 07:55:22 ----A---- C:\Windows\system32\kerberos.dll
2017-09-13 07:55:22 ----A---- C:\Windows\system32\ieapfltr.dll
2017-09-13 07:55:22 ----A---- C:\Windows\system32\drivers\srv2.sys
2017-09-13 07:55:22 ----A---- C:\Windows\system32\drivers\srv.sys
2017-09-13 07:55:22 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2017-09-13 07:55:22 ----A---- C:\Windows\system32\advapi32.dll
2017-09-13 07:55:21 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2017-09-13 07:55:21 ----A---- C:\Windows\SYSWOW64\ntprint.exe
2017-09-13 07:55:21 ----A---- C:\Windows\SYSWOW64\netbtugc.exe
2017-09-13 07:55:21 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2017-09-13 07:55:21 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2017-09-13 07:55:21 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2017-09-13 07:55:21 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2017-09-13 07:55:21 ----A---- C:\Windows\SYSWOW64\ExplorerFrame.dll
2017-09-13 07:55:21 ----A---- C:\Windows\SYSWOW64\advapi32.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\wow64win.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\wow64.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\winsrv.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\wdigest.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\TSpkg.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\sspicli.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\srcore.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\schannel.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\netbtugc.exe
2017-09-13 07:55:21 ----A---- C:\Windows\system32\ncrypt.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\msv1_0.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\KernelBase.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\kernel32.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\inetpp.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\ExplorerFrame.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2017-09-13 07:55:21 ----A---- C:\Windows\system32\conhost.exe
2017-09-13 07:55:21 ----A---- C:\Windows\system32\bcrypt.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\wow32.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\srclient.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\schannel.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\setup16.exe
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\secur32.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\rpchttp.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\instnm.exe
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\credssp.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\comcat.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\bcrypt.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\appidapi.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\wpnpinst.exe
2017-09-13 07:55:20 ----A---- C:\Windows\system32\wow64cpu.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\sspisrv.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\srclient.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\setbcdlocale.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\secur32.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\rstrui.exe
2017-09-13 07:55:20 ----A---- C:\Windows\system32\rpchttp.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\ntvdm64.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\lsass.exe
2017-09-13 07:55:20 ----A---- C:\Windows\system32\inetppui.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2017-09-13 07:55:20 ----A---- C:\Windows\system32\drivers\appid.sys
2017-09-13 07:55:20 ----A---- C:\Windows\system32\csrsrv.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\cryptbase.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\credssp.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\comcat.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\auditpol.exe
2017-09-13 07:55:20 ----A---- C:\Windows\system32\appidsvc.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\appidpolicyconverter.exe
2017-09-13 07:55:20 ----A---- C:\Windows\system32\appidcertstorecheck.exe
2017-09-13 07:55:20 ----A---- C:\Windows\system32\appidapi.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\apisetschema.dll
2017-09-13 07:55:19 ----A---- C:\Windows\SYSWOW64\user.exe
2017-09-13 07:55:19 ----A---- C:\Windows\SYSWOW64\oleres.dll
2017-09-13 07:55:19 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2017-09-13 07:55:19 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2017-09-13 07:55:19 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2017-09-13 07:55:19 ----A---- C:\Windows\system32\PrintBrmUi.exe
2017-09-13 07:55:19 ----A---- C:\Windows\system32\oleres.dll
2017-09-13 07:55:19 ----A---- C:\Windows\system32\msobjs.dll
2017-09-13 07:55:19 ----A---- C:\Windows\system32\msaudite.dll
2017-09-13 07:55:19 ----A---- C:\Windows\system32\adtschema.dll
2017-09-10 15:41:39 ----D---- C:\Program Files (x86)\THQ
2017-09-10 15:38:35 ----D---- C:\Users\P3S\AppData\Roaming\OpenOffice
2017-09-10 15:37:43 ----D---- C:\Program Files (x86)\OpenOffice 4
2017-09-08 11:54:21 ----D---- C:\ProgramData\Age of Empires II HD - Slovencina
2017-09-08 11:28:44 ----D---- C:\Program Files (x86)\Age of Empires II HD
2017-09-05 12:58:32 ----A---- C:\Windows\SYSWOW64\amdihk32.dll
2017-09-05 12:58:30 ----A---- C:\Windows\system32\amdihk64.dll
2017-09-03 19:37:28 ----D---- C:\Users\P3S\AppData\Roaming\MPC-HC
2017-09-02 02:31:46 ----A---- C:\Windows\SYSWOW64\atiuxpag.dll
2017-09-02 02:31:40 ----A---- C:\Windows\SYSWOW64\atiumdag.dll
2017-09-02 02:31:36 ----A---- C:\Windows\system32\atiumd64.dll
2017-09-02 02:31:34 ----A---- C:\Windows\SYSWOW64\atiu9pag.dll
2017-09-02 02:31:34 ----A---- C:\Windows\system32\atiu9p64.dll
2017-09-02 02:31:16 ----A---- C:\Windows\SYSWOW64\atidxx32.dll
2017-09-02 02:31:16 ----A---- C:\Windows\system32\GameManager64.dll
2017-09-02 02:31:14 ----A---- C:\Windows\SYSWOW64\GameManager32.dll
2017-09-02 02:31:12 ----A---- C:\Windows\system32\dgtrayicon.exe
2017-09-02 02:31:10 ----A---- C:\Windows\SYSWOW64\aticfx32.dll
2017-09-02 02:31:08 ----A---- C:\Windows\SYSWOW64\detoured.dll
2017-09-02 02:31:00 ----A---- C:\Windows\system32\atitmm64.dll
2017-09-02 02:30:58 ----A---- C:\Windows\system32\atimuixx.dll
2017-09-02 02:30:56 ----A---- C:\Windows\system32\RapidFireServer64.dll
2017-09-02 02:30:56 ----A---- C:\Windows\system32\drivers\atikmpag.sys
2017-09-02 02:30:54 ----A---- C:\Windows\SYSWOW64\RapidFireServer.dll
2017-09-02 02:30:54 ----A---- C:\Windows\SYSWOW64\atiglpxx.dll
2017-09-02 02:30:54 ----A---- C:\Windows\system32\atiglpxx.dll
2017-09-02 02:30:52 ----A---- C:\Windows\SYSWOW64\atigktxx.dll
2017-09-02 02:30:52 ----A---- C:\Windows\system32\Rapidfire64.dll
2017-09-02 02:30:50 ----A---- C:\Windows\SYSWOW64\Rapidfire.dll
2017-09-02 02:30:48 ----A---- C:\Windows\system32\mantleaxl64.dll
2017-09-02 02:30:46 ----A---- C:\Windows\SYSWOW64\mantleaxl32.dll
2017-09-02 02:30:46 ----A---- C:\Windows\system32\clinfo.exe
2017-09-02 02:30:46 ----A---- C:\Windows\system32\atiesrxx.exe
2017-09-02 02:30:44 ----A---- C:\Windows\system32\OpenCL.dll
2017-09-02 02:30:44 ----A---- C:\Windows\system32\mantle64.dll
2017-09-02 02:30:44 ----A---- C:\Windows\system32\atieclxx.exe
2017-09-02 02:30:42 ----A---- C:\Windows\SYSWOW64\OpenCL.dll
2017-09-02 02:30:42 ----A---- C:\Windows\SYSWOW64\mantle32.dll
2017-09-02 02:30:42 ----A---- C:\Windows\system32\atieah64.exe
2017-09-02 02:30:40 ----A---- C:\Windows\SYSWOW64\atieah32.exe
2017-09-02 02:30:40 ----A---- C:\Windows\system32\ATIODE.exe
2017-09-02 02:30:40 ----A---- C:\Windows\system32\ATIODCLI.exe
2017-09-02 02:30:40 ----A---- C:\Windows\system32\atidemgy.dll
2017-09-02 02:30:36 ----A---- C:\Windows\system32\aticalrt64.dll
2017-09-02 02:30:34 ----A---- C:\Windows\SYSWOW64\aticalrt.dll
2017-09-02 02:30:30 ----A---- C:\Windows\system32\drivers\ati2erec.dll
2017-09-02 02:30:26 ----A---- C:\Windows\SYSWOW64\atiumdva.dll
2017-09-02 02:30:26 ----A---- C:\Windows\system32\aticaldd64.dll
2017-09-02 02:30:20 ----A---- C:\Windows\SYSWOW64\aticaldd.dll
2017-09-02 02:30:20 ----A---- C:\Windows\system32\atiumd6a.dll
2017-09-02 02:30:18 ----A---- C:\Windows\SYSWOW64\atimpc32.dll
2017-09-02 02:30:18 ----A---- C:\Windows\SYSWOW64\amdpcom32.dll
2017-09-02 02:30:18 ----A---- C:\Windows\system32\atimpc64.dll
2017-09-02 02:30:18 ----A---- C:\Windows\system32\aticalcl64.dll
2017-09-02 02:30:18 ----A---- C:\Windows\system32\amdpcom64.dll
2017-09-02 02:30:16 ----A---- C:\Windows\SYSWOW64\aticalcl.dll
2017-09-02 02:30:14 ----A---- C:\Windows\system32\amdhcp64.dll
2017-09-02 02:30:12 ----A---- C:\Windows\SYSWOW64\amdhcp32.dll
2017-09-02 02:30:12 ----A---- C:\Windows\system32\atiapfxx.exe
2017-09-02 02:30:10 ----A---- C:\Windows\system32\amdocl64.dll
2017-09-02 02:30:08 ----A---- C:\Windows\SYSWOW64\atiadlxy.dll
2017-09-02 02:30:08 ----A---- C:\Windows\SYSWOW64\atiadlxx.dll
2017-09-02 02:30:08 ----A---- C:\Windows\system32\amdmantle64.dll
2017-09-02 02:30:04 ----A---- C:\Windows\SYSWOW64\amdave32.dll
2017-09-02 02:30:04 ----A---- C:\Windows\system32\amdave64.dll
2017-09-02 02:30:02 ----A---- C:\Windows\SYSWOW64\amdmantle32.dll
2017-09-02 02:30:00 ----A---- C:\Windows\system32\amdlvr64.dll
2017-09-02 02:29:58 ----A---- C:\Windows\SYSWOW64\amdlvr32.dll
2017-09-02 02:29:54 ----A---- C:\Windows\system32\amdocl12cl64.dll
2017-09-02 02:29:48 ----A---- C:\Windows\system32\atisamu64.dll
2017-09-02 02:29:46 ----A---- C:\Windows\SYSWOW64\atisamu32.dll
2017-09-02 02:29:46 ----A---- C:\Windows\system32\amdgfxinfo64.dll
2017-09-02 02:29:44 ----A---- C:\Windows\SYSWOW64\amdgfxinfo32.dll
2017-09-02 02:29:42 ----A---- C:\Windows\SYSWOW64\amdocl12cl.dll
2017-09-02 02:29:42 ----A---- C:\Windows\system32\drivers\amdacpksd.sys
2017-09-02 02:29:36 ----A---- C:\Windows\system32\drivers\atikmdag.sys
2017-09-02 02:29:28 ----A---- C:\Windows\system32\amfrt64.dll
2017-09-02 02:29:26 ----A---- C:\Windows\SYSWOW64\amfrt32.dll
2017-09-02 02:29:26 ----A---- C:\Windows\SYSWOW64\amdocl.dll
2017-09-02 02:29:20 ----A---- C:\Windows\system32\amdvlk64.dll
2017-09-02 02:29:16 ----A---- C:\Windows\SYSWOW64\amdvlk32.dll
2017-09-02 02:29:12 ----A---- C:\Windows\system32\amduve64.dll
2017-09-02 02:29:10 ----A---- C:\Windows\SYSWOW64\amduve32.dll
2017-09-02 02:29:04 ----A---- C:\Windows\SYSWOW64\amdmmcl.dll
2017-09-02 02:29:04 ----A---- C:\Windows\system32\amdmmcl6.dll
2017-09-02 02:29:02 ----A---- C:\Windows\system32\amdmcl64.dll
2017-09-02 02:29:00 ----A---- C:\Windows\SYSWOW64\amdmcl32.dll
2017-09-02 02:28:56 ----A---- C:\Windows\SYSWOW64\atioglxx.dll

======List of files/folders modified in the last 1 month======

2017-09-27 17:14:06 ----D---- C:\Windows\Prefetch
2017-09-27 17:14:04 ----D---- C:\Windows\Temp
2017-09-27 17:14:00 ----RD---- C:\Program Files
2017-09-27 17:03:49 ----D---- C:\Windows\system32\config
2017-09-27 14:34:09 ----D---- C:\Windows\system32\Tasks
2017-09-27 11:51:56 ----A---- C:\Windows\win.ini
2017-09-26 12:17:10 ----SHD---- C:\System Volume Information
2017-09-25 14:49:07 ----D---- C:\Program Files (x86)\Steam
2017-09-24 21:52:18 ----D---- C:\Users\P3S\AppData\Roaming\uTorrent
2017-09-24 13:40:17 ----D---- C:\Windows\system32\NDF
2017-09-21 20:02:48 ----D---- C:\ProgramData\Package Cache
2017-09-21 20:02:46 ----SHD---- C:\Windows\Installer
2017-09-21 20:02:45 ----SHD---- C:\Config.Msi
2017-09-19 15:05:51 ----RSD---- C:\Windows\assembly
2017-09-19 15:04:36 ----D---- C:\Windows\Logs
2017-09-19 15:01:52 ----RD---- C:\Program Files (x86)
2017-09-19 15:01:23 ----D---- C:\Windows\winsxs
2017-09-18 22:17:35 ----D---- C:\Windows
2017-09-17 16:40:31 ----D---- C:\Windows\system32\drivers
2017-09-17 16:40:25 ----D---- C:\Windows\SysWOW64
2017-09-17 16:40:16 ----D---- C:\Program Files (x86)\Common Files
2017-09-17 16:40:14 ----HD---- C:\ProgramData
2017-09-17 08:15:47 ----D---- C:\Windows\System32
2017-09-17 08:15:19 ----D---- C:\Windows\system32\catroot
2017-09-17 08:10:07 ----D---- C:\Windows\inf
2017-09-17 08:09:56 ----D---- C:\Windows\system32\DriverStore
2017-09-17 08:03:44 ----D---- C:\AMD
2017-09-16 20:05:57 ----D---- C:\Users\P3S\AppData\Roaming\DAEMON Tools Lite
2017-09-16 08:19:56 ----D---- C:\Windows\SoftwareDistribution
2017-09-16 08:17:39 ----D---- C:\Windows\debug
2017-09-14 10:40:19 ----D---- C:\Windows\rescache
2017-09-14 10:11:39 ----D---- C:\Windows\Microsoft.NET
2017-09-14 09:56:43 ----A---- C:\Windows\system32\PerfStringBackup.INI
2017-09-14 09:48:54 ----D---- C:\Program Files\Internet Explorer
2017-09-14 09:48:53 ----D---- C:\Windows\SYSWOW64\cs-CZ
2017-09-14 09:48:53 ----D---- C:\Program Files (x86)\Internet Explorer
2017-09-14 09:48:52 ----D---- C:\Windows\SYSWOW64\en-US
2017-09-14 09:48:48 ----D---- C:\Windows\system32\cs-CZ
2017-09-14 09:48:46 ----D---- C:\Windows\system32\en-US
2017-09-14 09:48:41 ----D---- C:\Windows\AppPatch
2017-09-14 09:48:40 ----D---- C:\Windows\system32\Boot
2017-09-14 00:55:53 ----D---- C:\Windows\system32\MRT
2017-09-14 00:53:49 ----AC---- C:\Windows\system32\MRT.exe
2017-09-14 00:51:22 ----D---- C:\Windows\system32\catroot2
2017-09-14 00:49:19 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2017-09-10 15:37:47 ----RSD---- C:\Windows\Fonts
2017-09-02 16:53:55 ----D---- C:\Program Files (x86)\Google
2017-09-02 16:51:23 ----D---- C:\Users\P3S\AppData\Roaming\TS3Client
2017-09-02 02:31:46 ----A---- C:\Windows\system32\atiuxp64.dll
2017-09-02 02:31:22 ----A---- C:\Windows\system32\atidxx64.dll
2017-09-02 02:31:12 ----A---- C:\Windows\system32\aticfx64.dll
2017-09-02 02:31:08 ----A---- C:\Windows\system32\detoured.dll
2017-09-02 02:30:50 ----A---- C:\Windows\system32\atig6txx.dll
2017-09-02 02:30:48 ----A---- C:\Windows\system32\atig6pxx.dll
2017-09-02 02:30:06 ----A---- C:\Windows\system32\atiadlxx.dll
2017-09-02 02:29:44 ----A---- C:\Windows\system32\coinst_17.30.dll
2017-09-02 02:28:44 ----A---- C:\Windows\system32\atio6axx.dll
2017-08-29 08:26:04 ----SHD---- C:\$Recycle.Bin
2017-08-29 08:19:59 ----D---- C:\Program Files (x86)\VulkanRT

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 avdevprot;avdevprot; C:\Windows\system32\DRIVERS\avdevprot.sys [2017-06-13 64504]
R0 avusbflt;avusbflt; C:\Windows\System32\Drivers\avusbflt.sys [2017-06-13 34128]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2015-09-16 213848]
R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2017-09-02 151128]
R1 avkmgr;avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [2017-04-10 35328]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2015-09-16 516096]
R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2017-09-21 194272]
R2 avnetflt;avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [2017-04-10 78600]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2017-09-02 38752136]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2017-09-02 532360]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2017-07-06 96256]
R3 dtlitescsibus;DAEMON Tools Lite Virtual SCSI Bus; C:\Windows\system32\DRIVERS\dtlitescsibus.sys [2017-05-08 30264]
R3 dtliteusbbus;DAEMON Tools Lite Virtual USB Bus; C:\Windows\system32\DRIVERS\dtliteusbbus.sys [2017-05-08 47672]
R3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C; C:\Windows\system32\DRIVERS\e1c62x64.sys [2013-08-21 494864]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2012-01-03 4730344]
R3 MEIx64;Intel(R) Management Engine Interface ; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [2014-09-10 99288]
R3 TPM;Čip TPM; C:\Windows\system32\drivers\tpm.sys [2016-02-05 147904]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
S3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2012-11-12 5337184]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-21 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2015-09-16 19456]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-21 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-21 34688]
S3 terminpt;Microsoft Remote Desktop Input Driver; C:\Windows\system32\drivers\terminpt.sys [2015-09-16 29696]
S3 trufos;trufos; C:\Windows\system32\drivers\trufos.sys [2017-09-17 485512]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2015-09-16 57856]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2015-09-16 30208]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-21 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-21 21760]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-21 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2017-09-02 543112]
R2 AntiVirService;Avira Real-Time Protection; C:\Program Files (x86)\Avira\Antivirus\avguard.exe [2017-09-21 490968]
R2 AntiVirSchedulerService;Avira Scheduler; C:\Program Files (x86)\Avira\Antivirus\sched.exe [2017-09-21 490968]
R2 Avira.ServiceHost;Avira Service Host; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [2017-08-30 402768]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2015-09-16 27136]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2015-09-16 27136]
S2 AntiVirMailService;Avira Mail Protection; C:\Program Files (x86)\Avira\Antivirus\avmailc7.exe [2017-09-21 1128432]
S2 AntiVirWebService;Avira Web Protection; C:\Program Files (x86)\Avira\Antivirus\avwebg7.exe [2017-09-21 1525240]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2017-04-21 107656]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2017-04-21 128648]
S2 gupdate;Služba Aktualizace Google (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-09-02 153168]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2015-09-16 27136]
S3 cphs;Intel(R) Content Protection HECI Service; C:\Windows\SysWow64\IntelCpHeciSvc.exe [2012-11-14 277048]
S3 Disc Soft Lite Bus Service;Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe [2017-02-07 1471168]
S3 gupdatem;Služba Aktualizace Google (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-09-02 153168]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2017-08-13 116224]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2015-09-16 27136]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2017-09-07 1610016]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2015-09-16 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2015-09-16 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2017-05-03 1255736]
S4 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2017-04-21 52856]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-04-21 136312]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-04-21 136312]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-04-21 136312]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119669
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: Krádež STEEAM účtu

#2 Příspěvek od Rudy »

Zdravím!
MWAW v současné době už není to, co býval. Spusťte tuto utilitu:
Stáhněte AdwCleaner https://toolslib.net/downloads/viewdown ... dwcleaner/
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve na >Scan<(hledání) a pak na >Clean< (mazání).
Proběhne skenováni a pak se objeví log, který sem vložte.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
P3S
Návštěvník
Návštěvník
Příspěvky: 4
Registrován: 27 lis 2008 14:44

Re: Krádež STEEAM účtu

#3 Příspěvek od P3S »

# AdwCleaner 7.0.2.1 - Logfile created on Wed Sep 27 16:55:43 2017
# Updated on 2017/29/08 by Malwarebytes
# Running on Windows 7 Professional (X64)
# Mode: clean
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services deleted.

***** [ Folders ] *****

No malicious folders deleted.

***** [ Files ] *****

No malicious files deleted.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks deleted.

***** [ Registry ] *****

Deleted: [Key] - HKU\S-1-5-21-2797444172-2823968603-1846975788-1000\Software\Video Player
Deleted: [Key] - HKCU\Software\Video Player


***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries deleted.

***** [ Chromium (and derivatives) ] *****

Plugin deleted: Avira SafeSearch Plus -
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.msn.com/?pc=UP97&ocid=UP97DHP
Startpage deleted: http://isearch.omiga-plus.com/?type=hp& ... 7497874978
Startpage deleted: http://isearch.omiga?type=hppppp
Startpage deleted: http://www.yessearches.com/?mode=nnnb&p ... A34nAXYsAU..
Startpage deleted: http://mail.ru/cnt/10445?gp=811009
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.msn.com/?pc=UP97&ocid=UP97DHP
Startpage deleted: http://isearch.omiga-plus.com/?type=hp& ... 7497874978
Startpage deleted: http://isearch.omiga?type=hppppp
Startpage deleted: http://www.yessearches.com/?mode=nnnb&p ... A34nAXYsAU..
Startpage deleted: http://mail.ru/cnt/10445?gp=811009
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.msn.com/?pc=UP97&ocid=UP97DHP
Startpage deleted: http://isearch.omiga-plus.com/?type=hp& ... 7497874978
Startpage deleted: http://isearch.omiga?type=hppppp
Startpage deleted: http://www.yessearches.com/?mode=nnnb&p ... A34nAXYsAU..
Startpage deleted: http://mail.ru/cnt/10445?gp=811009
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.msn.com/?pc=UP97&ocid=UP97DHP
Startpage deleted: http://isearch.omiga-plus.com/?type=hp& ... 7497874978
Startpage deleted: http://isearch.omiga?type=hppppp
Startpage deleted: http://www.yessearches.com/?mode=nnnb&p ... A34nAXYsAU..
Startpage deleted: http://mail.ru/cnt/10445?gp=811009
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.msn.com/?pc=UP97&ocid=UP97DHP
Startpage deleted: http://isearch.omiga-plus.com/?type=hp& ... 7497874978
Startpage deleted: http://isearch.omiga?type=hppppp
Startpage deleted: http://www.yessearches.com/?mode=nnnb&p ... A34nAXYsAU..
Startpage deleted: http://mail.ru/cnt/10445?gp=811009
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.msn.com/?pc=UP97&ocid=UP97DHP
Startpage deleted: http://isearch.omiga-plus.com/?type=hp& ... 7497874978
Startpage deleted: http://isearch.omiga?type=hppppp
Startpage deleted: http://www.yessearches.com/?mode=nnnb&p ... A34nAXYsAU..
Startpage deleted: http://mail.ru/cnt/10445?gp=811009
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.msn.com/?pc=UP97&ocid=UP97DHP
Startpage deleted: http://isearch.omiga-plus.com/?type=hp& ... 7497874978
Startpage deleted: http://isearch.omiga?type=hppppp
Startpage deleted: http://www.yessearches.com/?mode=nnnb&p ... A34nAXYsAU..
Startpage deleted: http://mail.ru/cnt/10445?gp=811009
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.msn.com/?pc=UP97&ocid=UP97DHP
Startpage deleted: http://isearch.omiga-plus.com/?type=hp& ... 7497874978
Startpage deleted: http://isearch.omiga?type=hppppp
Startpage deleted: http://www.yessearches.com/?mode=nnnb&p ... A34nAXYsAU..
Startpage deleted: http://mail.ru/cnt/10445?gp=811009
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.msn.com/?pc=UP97&ocid=UP97DHP
Startpage deleted: http://isearch.omiga-plus.com/?type=hp& ... 7497874978
Startpage deleted: http://isearch.omiga?type=hppppp
Startpage deleted: http://www.yessearches.com/?mode=nnnb&p ... A34nAXYsAU..
Startpage deleted: http://mail.ru/cnt/10445?gp=811009
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.msn.com/?pc=UP97&ocid=UP97DHP
Startpage deleted: http://isearch.omiga-plus.com/?type=hp& ... 7497874978
Startpage deleted: http://isearch.omiga?type=hppppp
Startpage deleted: http://www.yessearches.com/?mode=nnnb&p ... A34nAXYsAU..
Startpage deleted: http://mail.ru/cnt/10445?gp=811009
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.msn.com/?pc=UP97&ocid=UP97DHP
Startpage deleted: http://isearch.omiga-plus.com/?type=hp& ... 7497874978
Startpage deleted: http://isearch.omiga?type=hppppp
Startpage deleted: http://www.yessearches.com/?mode=nnnb&p ... A34nAXYsAU..
Startpage deleted: http://mail.ru/cnt/10445?gp=811009
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.msn.com/?pc=UP97&ocid=UP97DHP
Startpage deleted: http://isearch.omiga-plus.com/?type=hp& ... 7497874978
Startpage deleted: http://isearch.omiga?type=hppppp
Startpage deleted: http://www.yessearches.com/?mode=nnnb&p ... A34nAXYsAU..
Startpage deleted: http://mail.ru/cnt/10445?gp=811009
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.msn.com/?pc=UP97&ocid=UP97DHP
Startpage deleted: http://isearch.omiga-plus.com/?type=hp& ... 7497874978
Startpage deleted: http://isearch.omiga?type=hppppp
Startpage deleted: http://www.yessearches.com/?mode=nnnb&p ... A34nAXYsAU..
Startpage deleted: http://mail.ru/cnt/10445?gp=811009
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.msn.com/?pc=UP97&ocid=UP97DHP
Startpage deleted: http://isearch.omiga-plus.com/?type=hp& ... 7497874978
Startpage deleted: http://isearch.omiga?type=hppppp
Startpage deleted: http://www.yessearches.com/?mode=nnnb&p ... A34nAXYsAU..
Startpage deleted: http://mail.ru/cnt/10445?gp=811009
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.msn.com/?pc=UP97&ocid=UP97DHP
Startpage deleted: http://isearch.omiga-plus.com/?type=hp& ... 7497874978
Startpage deleted: http://isearch.omiga?type=hppppp
Startpage deleted: http://www.yessearches.com/?mode=nnnb&p ... A34nAXYsAU..
Startpage deleted: http://mail.ru/cnt/10445?gp=811009
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.msn.com/?pc=UP97&ocid=UP97DHP
Startpage deleted: http://isearch.omiga-plus.com/?type=hp& ... 7497874978
Startpage deleted: http://isearch.omiga?type=hppppp
Startpage deleted: http://www.yessearches.com/?mode=nnnb&p ... A34nAXYsAU..
Startpage deleted: http://mail.ru/cnt/10445?gp=811009
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.msn.com/?pc=UP97&ocid=UP97DHP
Startpage deleted: http://isearch.omiga-plus.com/?type=hp& ... 7497874978
Startpage deleted: http://isearch.omiga?type=hppppp
Startpage deleted: http://www.yessearches.com/?mode=nnnb&p ... A34nAXYsAU..
Startpage deleted: http://mail.ru/cnt/10445?gp=811009
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.msn.com/?pc=UP97&ocid=UP97DHP
Startpage deleted: http://isearch.omiga-plus.com/?type=hp& ... 7497874978
Startpage deleted: http://isearch.omiga?type=hppppp
Startpage deleted: http://www.yessearches.com/?mode=nnnb&p ... A34nAXYsAU..
Startpage deleted: http://mail.ru/cnt/10445?gp=811009
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.msn.com/?pc=UP97&ocid=UP97DHP
Startpage deleted: http://isearch.omiga-plus.com/?type=hp& ... 7497874978
Startpage deleted: http://isearch.omiga?type=hppppp
Startpage deleted: http://www.yessearches.com/?mode=nnnb&p ... A34nAXYsAU..
Startpage deleted: http://mail.ru/cnt/10445?gp=811009
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.msn.com/?pc=UP97&ocid=UP97DHP
Startpage deleted: http://isearch.omiga-plus.com/?type=hp& ... 7497874978
Startpage deleted: http://isearch.omiga?type=hppppp
Startpage deleted: http://www.yessearches.com/?mode=nnnb&p ... A34nAXYsAU..
Startpage deleted: http://mail.ru/cnt/10445?gp=811009
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.msn.com/?pc=UP97&ocid=UP97DHP
Startpage deleted: http://isearch.omiga-plus.com/?type=hp& ... 7497874978
Startpage deleted: http://isearch.omiga?type=hppppp
Startpage deleted: http://www.yessearches.com/?mode=nnnb&p ... A34nAXYsAU..
Startpage deleted: http://mail.ru/cnt/10445?gp=811009
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.msn.com/?pc=UP97&ocid=UP97DHP
Startpage deleted: http://isearch.omiga-plus.com/?type=hp& ... 7497874978
Startpage deleted: http://isearch.omiga?type=hppppp
Startpage deleted: http://www.yessearches.com/?mode=nnnb&p ... A34nAXYsAU..
Startpage deleted: http://mail.ru/cnt/10445?gp=811009
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.msn.com/?pc=UP97&ocid=UP97DHP
Startpage deleted: http://isearch.omiga-plus.com/?type=hp& ... 7497874978
Startpage deleted: http://isearch.omiga?type=hppppp
Startpage deleted: http://www.yessearches.com/?mode=nnnb&p ... A34nAXYsAU..
Startpage deleted: http://mail.ru/cnt/10445?gp=811009
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.msn.com/?pc=UP97&ocid=UP97DHP
Startpage deleted: http://isearch.omiga-plus.com/?type=hp& ... 7497874978
Startpage deleted: http://isearch.omiga?type=hppppp
Startpage deleted: http://www.yessearches.com/?mode=nnnb&p ... A34nAXYsAU..
Startpage deleted: http://mail.ru/cnt/10445?gp=811009
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.msn.com/?pc=UP97&ocid=UP97DHP
Startpage deleted: http://isearch.omiga-plus.com/?type=hp& ... 7497874978
Startpage deleted: http://isearch.omiga?type=hppppp
Startpage deleted: http://www.yessearches.com/?mode=nnnb&p ... A34nAXYsAU..
Startpage deleted: http://mail.ru/cnt/10445?gp=811009
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.msn.com/?pc=UP97&ocid=UP97DHP
Startpage deleted: http://isearch.omiga-plus.com/?type=hp& ... 7497874978
Startpage deleted: http://isearch.omiga?type=hppppp
Startpage deleted: http://www.yessearches.com/?mode=nnnb&p ... A34nAXYsAU..
Startpage deleted: http://mail.ru/cnt/10445?gp=811009
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.msn.com/?pc=UP97&ocid=UP97DHP
Startpage deleted: http://isearch.omiga-plus.com/?type=hp& ... 7497874978
Startpage deleted: http://isearch.omiga?type=hppppp
Startpage deleted: http://www.yessearches.com/?mode=nnnb&p ... A34nAXYsAU..
Startpage deleted: http://mail.ru/cnt/10445?gp=811009
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.google.com/
Startpage deleted: http://www.msn.com/?pc=UP97&ocid=UP97DHP
Startpage deleted: http://isearch.omiga-plus.com/?type=hp& ... 7497874978
Startpage deleted: http://isearch.omiga?type=hppppp
Startpage deleted: http://www.yessearches.com/?mode=nnnb&p ... A34nAXYsAU..
Startpage deleted: http://mail.ru/cnt/10445?gp=811009


*************************

::Tracing keys deleted
::Winsock settings cleared
::Additional Actions: 0



*************************

C:/AdwCleaner/AdwCleaner[S0].txt - [2548 B] - [2017/9/27 16:52:27]
C:/AdwCleaner/AdwCleaner[S1].txt - [2616 B] - [2017/9/27 16:55:30]


########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt ##########
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119669
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: Krádež STEEAM účtu

#4 Příspěvek od Rudy »

Dejte nový log RSIT.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
P3S
Návštěvník
Návštěvník
Příspěvky: 4
Registrován: 27 lis 2008 14:44

Re: Krádež STEEAM účtu

#5 Příspěvek od P3S »

Logfile of random's system information tool 1.10 (written by random/random)
Run by P3S at 2017-09-29 08:52:09
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 68 GB (14%) free of 477 GB
Total RAM: 4054 MB (62% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:52:11, on 29.9.2017
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18792)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Avira\Antivirus\avgnt.exe
C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
C:\Program Files\trend micro\P3S.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKCU\..\Run: [World of Tanks] "C:\Games\World_of_Tanks\WargamingGameUpdater.exe"
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Avira Mail Protection (AntiVirMailService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\Antivirus\avmailc7.exe
O23 - Service: Avira Scheduler (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\Antivirus\sched.exe
O23 - Service: Avira Real-Time Protection (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\Antivirus\avguard.exe
O23 - Service: Avira Web Protection (AntiVirWebService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\Antivirus\avwebg7.exe
O23 - Service: Avira Service Host (Avira.ServiceHost) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: Disc Soft Lite Bus Service - Disc Soft Ltd - C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Aktualizace Google (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Aktualizace Google (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 5885 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
atieclxx
C:\Windows\System32\spoolsv.exe
"C:\Program Files (x86)\Avira\Antivirus\sched.exe"
"taskhost.exe"
taskeng.exe {DD4A13EF-CE0F-4FB7-B069-BEB60AA3AB8D}
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe atlogon
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler.exe"
"C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler64.exe"
"C:\Program Files (x86)\Avira\Antivirus\avguard.exe"
C:\Windows\System32\svchost.exe -k utcsvc
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe"
"C:\Program Files\CCleaner\CCleaner.exe" /MONITOR /uac
"C:\Program Files (x86)\Avira\Antivirus\avshadow.exe" avshadowcontrol0_00000544
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files (x86)\Avira\Antivirus\avgnt.exe" /min
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\P3S\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\P3S\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=61.0.3163.100 --initial-client-data=0x80,0x84,0x88,0x7c,0x8c,0x7feef671988,0x7feef671948,0x7feef671958
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=3704 --on-initialized-event-handle=312 --parent-handle=316 /prefetch:6
"C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe" /connectToHost
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1116,16070854367453906157,16492601883982654411,131072 --disable-direct-composition --supports-dual-gpus=false --gpu-driver-bug-workarounds=9,12,13,22,23,24,27,49,84 --disable-gl-extensions="GL_KHR_blend_equation_advanced GL_KHR_blend_equation_advanced_coherent" --gpu-vendor-id=0x1002 --gpu-device-id=0x6613 --gpu-driver-vendor="Advanced Micro Devices, Inc." --gpu-driver-version=22.19.676.4 --gpu-driver-date=9-1-2017 --service-request-channel-token=5A741BEA531F28612657DC5BE2E9E456 --mojo-platform-channel-handle=1120 --ignored=" --type=renderer " /prefetch:2
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1116,16070854367453906157,16492601883982654411,131072 --service-pipe-token=452C8DC903E991BDF76A4A9B64F89E8E --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=452C8DC903E991BDF76A4A9B64F89E8E --renderer-client-id=5 --mojo-platform-channel-handle=3000 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1116,16070854367453906157,16492601883982654411,131072 --service-pipe-token=A31E9C982C804D97DAEB95A8C3D2B4B8 --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=A31E9C982C804D97DAEB95A8C3D2B4B8 --renderer-client-id=4 --mojo-platform-channel-handle=4908 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1116,16070854367453906157,16492601883982654411,131072 --service-pipe-token=28B6CBDB990B0E3259CA6CD2B9C06586 --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=28B6CBDB990B0E3259CA6CD2B9C06586 --renderer-client-id=10 --mojo-platform-channel-handle=5148 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1116,16070854367453906157,16492601883982654411,131072 --service-pipe-token=0121485D2FC11EB3F4A984BFAE53B98E --lang=cs --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=0121485D2FC11EB3F4A984BFAE53B98E --renderer-client-id=15 --mojo-platform-channel-handle=1752 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1116,16070854367453906157,16492601883982654411,131072 --service-pipe-token=704B53D962A1FAC76E487DA0D06ADFBD --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=704B53D962A1FAC76E487DA0D06ADFBD --renderer-client-id=16 --mojo-platform-channel-handle=4616 /prefetch:1
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\vssvc.exe
C:\Windows\System32\svchost.exe -k swprv

"C:\Users\P3S\Downloads\RSITx64.exe"
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}

======Registry dump======

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"World of Tanks"=C:\Games\World_of_Tanks\WargamingGameUpdater.exe [2017-02-28 3135752]
"CCleaner Monitoring"=C:\Program Files\CCleaner\CCleaner64.exe [2017-09-20 9856176]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CCleaner Monitoring]
C:\Program Files\CCleaner\CCleaner64.exe [2017-09-20 9856176]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite Automount]
C:\Program Files\DAEMON Tools Lite\DTAgent.exe [2017-02-07 4701888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VDownloader]
C:\Program Files\VDownloader\Vdownloader4.exe [2017-04-10 13975552]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\World of Tanks]
C:\Games\World_of_Tanks\WargamingGameUpdater.exe [2017-02-28 3135752]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2012-11-12 441344]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=153

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktopChanges"=1
"NoDriveTypeAutoRun"=153

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux2"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2017-09-27 18:51:07 ----D---- C:\AdwCleaner
2017-09-27 17:23:24 ----D---- C:\Program Files\CCleaner
2017-09-27 17:14:00 ----D---- C:\Program Files\trend micro
2017-09-27 17:13:59 ----D---- C:\rsit
2017-09-19 15:01:52 ----D---- C:\Program Files (x86)\InstallShield Installation Information
2017-09-19 14:43:59 ----D---- C:\Program Files (x86)\Ubisoft
2017-09-19 09:09:13 ----D---- C:\Users\P3S\AppData\Roaming\FiraxisLive
2017-09-18 22:18:31 ----D---- C:\Program Files (x86)\Electronic Arts
2017-09-18 12:43:11 ----D---- C:\Program Files\FlatOut2
2017-09-17 16:40:31 ----A---- C:\Windows\system32\drivers\trufos.sys
2017-09-17 16:40:25 ----A---- C:\Windows\SYSWOW64\msvcr80.dll
2017-09-17 16:40:24 ----A---- C:\Windows\SYSWOW64\msvcp80.dll
2017-09-17 16:40:23 ----A---- C:\Windows\SYSWOW64\msvcp90.dll
2017-09-17 16:40:22 ----A---- C:\Windows\SYSWOW64\msvcr90.dll
2017-09-17 16:40:21 ----A---- C:\Windows\SYSWOW64\eEmpty.exe
2017-09-17 16:40:14 ----D---- C:\ProgramData\MicroWorld
2017-09-17 08:13:32 ----D---- C:\Program Files (x86)\AMD
2017-09-16 20:07:59 ----D---- C:\Windows\SYSWOW64\Macromed
2017-09-13 07:55:36 ----A---- C:\Windows\system32\mshtml.dll
2017-09-13 07:55:34 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2017-09-13 07:55:34 ----A---- C:\Windows\system32\ieframe.dll
2017-09-13 07:55:32 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2017-09-13 07:55:32 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2017-09-13 07:55:32 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2017-09-13 07:55:32 ----A---- C:\Windows\system32\wininet.dll
2017-09-13 07:55:32 ----A---- C:\Windows\system32\jscript9.dll
2017-09-13 07:55:31 ----A---- C:\Windows\SYSWOW64\wininet.dll
2017-09-13 07:55:31 ----A---- C:\Windows\SYSWOW64\DXPTaskRingtone.dll
2017-09-13 07:55:31 ----A---- C:\Windows\system32\win32k.sys
2017-09-13 07:55:31 ----A---- C:\Windows\system32\shell32.dll
2017-09-13 07:55:31 ----A---- C:\Windows\system32\iertutil.dll
2017-09-13 07:55:31 ----A---- C:\Windows\system32\DXPTaskRingtone.dll
2017-09-13 07:55:30 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2017-09-13 07:55:30 ----A---- C:\Windows\SYSWOW64\shell32.dll
2017-09-13 07:55:30 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2017-09-13 07:55:30 ----A---- C:\Windows\system32\urlmon.dll
2017-09-13 07:55:30 ----A---- C:\Windows\system32\msfeeds.dll
2017-09-13 07:55:30 ----A---- C:\Windows\system32\mmcndmgr.dll
2017-09-13 07:55:30 ----A---- C:\Windows\system32\mmc.exe
2017-09-13 07:55:29 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2017-09-13 07:55:29 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2017-09-13 07:55:29 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2017-09-13 07:55:29 ----A---- C:\Windows\system32\ntoskrnl.exe
2017-09-13 07:55:28 ----A---- C:\Windows\SYSWOW64\mmcndmgr.dll
2017-09-13 07:55:28 ----A---- C:\Windows\SYSWOW64\mmc.exe
2017-09-13 07:55:28 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2017-09-13 07:55:28 ----A---- C:\Windows\system32\win32spl.dll
2017-09-13 07:55:28 ----A---- C:\Windows\system32\localspl.dll
2017-09-13 07:55:28 ----A---- C:\Windows\system32\iedkcs32.dll
2017-09-13 07:55:27 ----A---- C:\Windows\SYSWOW64\Wldap32.dll
2017-09-13 07:55:27 ----A---- C:\Windows\SYSWOW64\win32spl.dll
2017-09-13 07:55:27 ----A---- C:\Windows\SYSWOW64\usp10.dll
2017-09-13 07:55:27 ----A---- C:\Windows\system32\Wldap32.dll
2017-09-13 07:55:27 ----A---- C:\Windows\system32\usp10.dll
2017-09-13 07:55:27 ----A---- C:\Windows\system32\ie4uinit.exe
2017-09-13 07:55:27 ----A---- C:\Windows\system32\drivers\srvnet.sys
2017-09-13 07:55:26 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2017-09-13 07:55:26 ----A---- C:\Windows\system32\ntprint.dll
2017-09-13 07:55:26 ----A---- C:\Windows\system32\nsisvc.dll
2017-09-13 07:55:26 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2017-09-13 07:55:26 ----A---- C:\Windows\system32\mmcshext.dll
2017-09-13 07:55:26 ----A---- C:\Windows\system32\mmcbase.dll
2017-09-13 07:55:26 ----A---- C:\Windows\system32\drivers\netbt.sys
2017-09-13 07:55:26 ----A---- C:\Windows\system32\cic.dll
2017-09-13 07:55:25 ----A---- C:\Windows\SYSWOW64\ntprint.dll
2017-09-13 07:55:25 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2017-09-13 07:55:25 ----A---- C:\Windows\system32\ntdll.dll
2017-09-13 07:55:25 ----A---- C:\Windows\system32\drivers\nsiproxy.sys
2017-09-13 07:55:25 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2017-09-13 07:55:25 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2017-09-13 07:55:24 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2017-09-13 07:55:24 ----A---- C:\Windows\SYSWOW64\msrating.dll
2017-09-13 07:55:24 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2017-09-13 07:55:24 ----A---- C:\Windows\SYSWOW64\mmcshext.dll
2017-09-13 07:55:24 ----A---- C:\Windows\SYSWOW64\mmcbase.dll
2017-09-13 07:55:24 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2017-09-13 07:55:24 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2017-09-13 07:55:24 ----A---- C:\Windows\SYSWOW64\cic.dll
2017-09-13 07:55:24 ----A---- C:\Windows\system32\webcheck.dll
2017-09-13 07:55:24 ----A---- C:\Windows\system32\shdocvw.dll
2017-09-13 07:55:24 ----A---- C:\Windows\system32\msrating.dll
2017-09-13 07:55:24 ----A---- C:\Windows\system32\mshtmled.dll
2017-09-13 07:55:24 ----A---- C:\Windows\system32\dxtrans.dll
2017-09-13 07:55:24 ----A---- C:\Windows\system32\dxtmsft.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\winnsi.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\shdocvw.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\occache.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\nsi.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\jscript.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\inseng.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\ieui.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\certcli.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\winnsi.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\vbscript.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\ole32.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\occache.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\nsi.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\mshtmlmedia.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\MshtmlDac.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\jsproxy.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\jscript9diag.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\jscript.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\inseng.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\ieUnatt.exe
2017-09-13 07:55:23 ----A---- C:\Windows\system32\ieui.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\iesetup.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\iernonce.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\ieetwproxystub.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\ieetwcollector.exe
2017-09-13 07:55:23 ----A---- C:\Windows\system32\certcli.dll
2017-09-13 07:55:22 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2017-09-13 07:55:22 ----A---- C:\Windows\SYSWOW64\ole32.dll
2017-09-13 07:55:22 ----A---- C:\Windows\system32\smss.exe
2017-09-13 07:55:22 ----A---- C:\Windows\system32\rpcss.dll
2017-09-13 07:55:22 ----A---- C:\Windows\system32\rpcrt4.dll
2017-09-13 07:55:22 ----A---- C:\Windows\system32\ntprint.exe
2017-09-13 07:55:22 ----A---- C:\Windows\system32\lsasrv.dll
2017-09-13 07:55:22 ----A---- C:\Windows\system32\kerberos.dll
2017-09-13 07:55:22 ----A---- C:\Windows\system32\ieapfltr.dll
2017-09-13 07:55:22 ----A---- C:\Windows\system32\drivers\srv2.sys
2017-09-13 07:55:22 ----A---- C:\Windows\system32\drivers\srv.sys
2017-09-13 07:55:22 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2017-09-13 07:55:22 ----A---- C:\Windows\system32\advapi32.dll
2017-09-13 07:55:21 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2017-09-13 07:55:21 ----A---- C:\Windows\SYSWOW64\ntprint.exe
2017-09-13 07:55:21 ----A---- C:\Windows\SYSWOW64\netbtugc.exe
2017-09-13 07:55:21 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2017-09-13 07:55:21 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2017-09-13 07:55:21 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2017-09-13 07:55:21 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2017-09-13 07:55:21 ----A---- C:\Windows\SYSWOW64\ExplorerFrame.dll
2017-09-13 07:55:21 ----A---- C:\Windows\SYSWOW64\advapi32.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\wow64win.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\wow64.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\winsrv.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\wdigest.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\TSpkg.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\sspicli.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\srcore.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\schannel.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\netbtugc.exe
2017-09-13 07:55:21 ----A---- C:\Windows\system32\ncrypt.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\msv1_0.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\KernelBase.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\kernel32.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\inetpp.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\ExplorerFrame.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2017-09-13 07:55:21 ----A---- C:\Windows\system32\conhost.exe
2017-09-13 07:55:21 ----A---- C:\Windows\system32\bcrypt.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\wow32.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\srclient.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\schannel.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\setup16.exe
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\secur32.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\rpchttp.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\instnm.exe
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\credssp.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\comcat.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\bcrypt.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\appidapi.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\wpnpinst.exe
2017-09-13 07:55:20 ----A---- C:\Windows\system32\wow64cpu.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\sspisrv.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\srclient.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\setbcdlocale.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\secur32.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\rstrui.exe
2017-09-13 07:55:20 ----A---- C:\Windows\system32\rpchttp.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\ntvdm64.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\lsass.exe
2017-09-13 07:55:20 ----A---- C:\Windows\system32\inetppui.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2017-09-13 07:55:20 ----A---- C:\Windows\system32\drivers\appid.sys
2017-09-13 07:55:20 ----A---- C:\Windows\system32\csrsrv.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\cryptbase.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\credssp.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\comcat.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\auditpol.exe
2017-09-13 07:55:20 ----A---- C:\Windows\system32\appidsvc.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\appidpolicyconverter.exe
2017-09-13 07:55:20 ----A---- C:\Windows\system32\appidcertstorecheck.exe
2017-09-13 07:55:20 ----A---- C:\Windows\system32\appidapi.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\apisetschema.dll
2017-09-13 07:55:19 ----A---- C:\Windows\SYSWOW64\user.exe
2017-09-13 07:55:19 ----A---- C:\Windows\SYSWOW64\oleres.dll
2017-09-13 07:55:19 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2017-09-13 07:55:19 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2017-09-13 07:55:19 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2017-09-13 07:55:19 ----A---- C:\Windows\system32\PrintBrmUi.exe
2017-09-13 07:55:19 ----A---- C:\Windows\system32\oleres.dll
2017-09-13 07:55:19 ----A---- C:\Windows\system32\msobjs.dll
2017-09-13 07:55:19 ----A---- C:\Windows\system32\msaudite.dll
2017-09-13 07:55:19 ----A---- C:\Windows\system32\adtschema.dll
2017-09-10 15:41:39 ----D---- C:\Program Files (x86)\THQ
2017-09-10 15:38:35 ----D---- C:\Users\P3S\AppData\Roaming\OpenOffice
2017-09-10 15:37:43 ----D---- C:\Program Files (x86)\OpenOffice 4
2017-09-08 11:54:21 ----D---- C:\ProgramData\Age of Empires II HD - Slovencina
2017-09-08 11:28:44 ----D---- C:\Program Files (x86)\Age of Empires II HD
2017-09-05 12:58:32 ----A---- C:\Windows\SYSWOW64\amdihk32.dll
2017-09-05 12:58:30 ----A---- C:\Windows\system32\amdihk64.dll
2017-09-03 19:37:28 ----D---- C:\Users\P3S\AppData\Roaming\MPC-HC
2017-09-02 02:31:46 ----A---- C:\Windows\SYSWOW64\atiuxpag.dll
2017-09-02 02:31:40 ----A---- C:\Windows\SYSWOW64\atiumdag.dll
2017-09-02 02:31:36 ----A---- C:\Windows\system32\atiumd64.dll
2017-09-02 02:31:34 ----A---- C:\Windows\SYSWOW64\atiu9pag.dll
2017-09-02 02:31:34 ----A---- C:\Windows\system32\atiu9p64.dll
2017-09-02 02:31:16 ----A---- C:\Windows\SYSWOW64\atidxx32.dll
2017-09-02 02:31:16 ----A---- C:\Windows\system32\GameManager64.dll
2017-09-02 02:31:14 ----A---- C:\Windows\SYSWOW64\GameManager32.dll
2017-09-02 02:31:12 ----A---- C:\Windows\system32\dgtrayicon.exe
2017-09-02 02:31:10 ----A---- C:\Windows\SYSWOW64\aticfx32.dll
2017-09-02 02:31:08 ----A---- C:\Windows\SYSWOW64\detoured.dll
2017-09-02 02:31:00 ----A---- C:\Windows\system32\atitmm64.dll
2017-09-02 02:30:58 ----A---- C:\Windows\system32\atimuixx.dll
2017-09-02 02:30:56 ----A---- C:\Windows\system32\RapidFireServer64.dll
2017-09-02 02:30:56 ----A---- C:\Windows\system32\drivers\atikmpag.sys
2017-09-02 02:30:54 ----A---- C:\Windows\SYSWOW64\RapidFireServer.dll
2017-09-02 02:30:54 ----A---- C:\Windows\SYSWOW64\atiglpxx.dll
2017-09-02 02:30:54 ----A---- C:\Windows\system32\atiglpxx.dll
2017-09-02 02:30:52 ----A---- C:\Windows\SYSWOW64\atigktxx.dll
2017-09-02 02:30:52 ----A---- C:\Windows\system32\Rapidfire64.dll
2017-09-02 02:30:50 ----A---- C:\Windows\SYSWOW64\Rapidfire.dll
2017-09-02 02:30:48 ----A---- C:\Windows\system32\mantleaxl64.dll
2017-09-02 02:30:46 ----A---- C:\Windows\SYSWOW64\mantleaxl32.dll
2017-09-02 02:30:46 ----A---- C:\Windows\system32\clinfo.exe
2017-09-02 02:30:46 ----A---- C:\Windows\system32\atiesrxx.exe
2017-09-02 02:30:44 ----A---- C:\Windows\system32\OpenCL.dll
2017-09-02 02:30:44 ----A---- C:\Windows\system32\mantle64.dll
2017-09-02 02:30:44 ----A---- C:\Windows\system32\atieclxx.exe
2017-09-02 02:30:42 ----A---- C:\Windows\SYSWOW64\OpenCL.dll
2017-09-02 02:30:42 ----A---- C:\Windows\SYSWOW64\mantle32.dll
2017-09-02 02:30:42 ----A---- C:\Windows\system32\atieah64.exe
2017-09-02 02:30:40 ----A---- C:\Windows\SYSWOW64\atieah32.exe
2017-09-02 02:30:40 ----A---- C:\Windows\system32\ATIODE.exe
2017-09-02 02:30:40 ----A---- C:\Windows\system32\ATIODCLI.exe
2017-09-02 02:30:40 ----A---- C:\Windows\system32\atidemgy.dll
2017-09-02 02:30:36 ----A---- C:\Windows\system32\aticalrt64.dll
2017-09-02 02:30:34 ----A---- C:\Windows\SYSWOW64\aticalrt.dll
2017-09-02 02:30:30 ----A---- C:\Windows\system32\drivers\ati2erec.dll
2017-09-02 02:30:26 ----A---- C:\Windows\SYSWOW64\atiumdva.dll
2017-09-02 02:30:26 ----A---- C:\Windows\system32\aticaldd64.dll
2017-09-02 02:30:20 ----A---- C:\Windows\SYSWOW64\aticaldd.dll
2017-09-02 02:30:20 ----A---- C:\Windows\system32\atiumd6a.dll
2017-09-02 02:30:18 ----A---- C:\Windows\SYSWOW64\atimpc32.dll
2017-09-02 02:30:18 ----A---- C:\Windows\SYSWOW64\amdpcom32.dll
2017-09-02 02:30:18 ----A---- C:\Windows\system32\atimpc64.dll
2017-09-02 02:30:18 ----A---- C:\Windows\system32\aticalcl64.dll
2017-09-02 02:30:18 ----A---- C:\Windows\system32\amdpcom64.dll
2017-09-02 02:30:16 ----A---- C:\Windows\SYSWOW64\aticalcl.dll
2017-09-02 02:30:14 ----A---- C:\Windows\system32\amdhcp64.dll
2017-09-02 02:30:12 ----A---- C:\Windows\SYSWOW64\amdhcp32.dll
2017-09-02 02:30:12 ----A---- C:\Windows\system32\atiapfxx.exe
2017-09-02 02:30:10 ----A---- C:\Windows\system32\amdocl64.dll
2017-09-02 02:30:08 ----A---- C:\Windows\SYSWOW64\atiadlxy.dll
2017-09-02 02:30:08 ----A---- C:\Windows\SYSWOW64\atiadlxx.dll
2017-09-02 02:30:08 ----A---- C:\Windows\system32\amdmantle64.dll
2017-09-02 02:30:04 ----A---- C:\Windows\SYSWOW64\amdave32.dll
2017-09-02 02:30:04 ----A---- C:\Windows\system32\amdave64.dll
2017-09-02 02:30:02 ----A---- C:\Windows\SYSWOW64\amdmantle32.dll
2017-09-02 02:30:00 ----A---- C:\Windows\system32\amdlvr64.dll
2017-09-02 02:29:58 ----A---- C:\Windows\SYSWOW64\amdlvr32.dll
2017-09-02 02:29:54 ----A---- C:\Windows\system32\amdocl12cl64.dll
2017-09-02 02:29:48 ----A---- C:\Windows\system32\atisamu64.dll
2017-09-02 02:29:46 ----A---- C:\Windows\SYSWOW64\atisamu32.dll
2017-09-02 02:29:46 ----A---- C:\Windows\system32\amdgfxinfo64.dll
2017-09-02 02:29:44 ----A---- C:\Windows\SYSWOW64\amdgfxinfo32.dll
2017-09-02 02:29:42 ----A---- C:\Windows\SYSWOW64\amdocl12cl.dll
2017-09-02 02:29:42 ----A---- C:\Windows\system32\drivers\amdacpksd.sys
2017-09-02 02:29:36 ----A---- C:\Windows\system32\drivers\atikmdag.sys
2017-09-02 02:29:28 ----A---- C:\Windows\system32\amfrt64.dll
2017-09-02 02:29:26 ----A---- C:\Windows\SYSWOW64\amfrt32.dll
2017-09-02 02:29:26 ----A---- C:\Windows\SYSWOW64\amdocl.dll
2017-09-02 02:29:20 ----A---- C:\Windows\system32\amdvlk64.dll
2017-09-02 02:29:16 ----A---- C:\Windows\SYSWOW64\amdvlk32.dll
2017-09-02 02:29:12 ----A---- C:\Windows\system32\amduve64.dll
2017-09-02 02:29:10 ----A---- C:\Windows\SYSWOW64\amduve32.dll
2017-09-02 02:29:04 ----A---- C:\Windows\SYSWOW64\amdmmcl.dll
2017-09-02 02:29:04 ----A---- C:\Windows\system32\amdmmcl6.dll
2017-09-02 02:29:02 ----A---- C:\Windows\system32\amdmcl64.dll
2017-09-02 02:29:00 ----A---- C:\Windows\SYSWOW64\amdmcl32.dll
2017-09-02 02:28:56 ----A---- C:\Windows\SYSWOW64\atioglxx.dll

======List of files/folders modified in the last 1 month======

2017-09-29 08:52:10 ----D---- C:\Windows\Temp
2017-09-29 07:02:56 ----D---- C:\Windows\system32\config
2017-09-27 18:53:13 ----D---- C:\Windows\Prefetch
2017-09-27 17:23:30 ----D---- C:\Windows\system32\Tasks
2017-09-27 17:23:24 ----RD---- C:\Program Files
2017-09-27 11:51:56 ----A---- C:\Windows\win.ini
2017-09-26 12:17:10 ----SHD---- C:\System Volume Information
2017-09-25 14:49:07 ----D---- C:\Program Files (x86)\Steam
2017-09-24 21:52:18 ----D---- C:\Users\P3S\AppData\Roaming\uTorrent
2017-09-24 13:40:17 ----D---- C:\Windows\system32\NDF
2017-09-21 20:02:48 ----D---- C:\ProgramData\Package Cache
2017-09-21 20:02:46 ----SHD---- C:\Windows\Installer
2017-09-21 20:02:45 ----SHD---- C:\Config.Msi
2017-09-19 15:05:51 ----RSD---- C:\Windows\assembly
2017-09-19 15:04:36 ----D---- C:\Windows\Logs
2017-09-19 15:01:52 ----RD---- C:\Program Files (x86)
2017-09-19 15:01:23 ----D---- C:\Windows\winsxs
2017-09-18 22:17:35 ----D---- C:\Windows
2017-09-17 16:40:31 ----D---- C:\Windows\system32\drivers
2017-09-17 16:40:25 ----D---- C:\Windows\SysWOW64
2017-09-17 16:40:16 ----D---- C:\Program Files (x86)\Common Files
2017-09-17 16:40:14 ----HD---- C:\ProgramData
2017-09-17 08:15:47 ----D---- C:\Windows\System32
2017-09-17 08:15:19 ----D---- C:\Windows\system32\catroot
2017-09-17 08:10:07 ----D---- C:\Windows\inf
2017-09-17 08:09:56 ----D---- C:\Windows\system32\DriverStore
2017-09-17 08:03:44 ----D---- C:\AMD
2017-09-16 20:05:57 ----D---- C:\Users\P3S\AppData\Roaming\DAEMON Tools Lite
2017-09-16 08:19:56 ----D---- C:\Windows\SoftwareDistribution
2017-09-16 08:17:39 ----D---- C:\Windows\debug
2017-09-14 10:40:19 ----D---- C:\Windows\rescache
2017-09-14 10:11:39 ----D---- C:\Windows\Microsoft.NET
2017-09-14 09:56:43 ----A---- C:\Windows\system32\PerfStringBackup.INI
2017-09-14 09:48:54 ----D---- C:\Program Files\Internet Explorer
2017-09-14 09:48:53 ----D---- C:\Windows\SYSWOW64\cs-CZ
2017-09-14 09:48:53 ----D---- C:\Program Files (x86)\Internet Explorer
2017-09-14 09:48:52 ----D---- C:\Windows\SYSWOW64\en-US
2017-09-14 09:48:48 ----D---- C:\Windows\system32\cs-CZ
2017-09-14 09:48:46 ----D---- C:\Windows\system32\en-US
2017-09-14 09:48:41 ----D---- C:\Windows\AppPatch
2017-09-14 09:48:40 ----D---- C:\Windows\system32\Boot
2017-09-14 00:55:53 ----D---- C:\Windows\system32\MRT
2017-09-14 00:53:49 ----AC---- C:\Windows\system32\MRT.exe
2017-09-14 00:51:22 ----D---- C:\Windows\system32\catroot2
2017-09-14 00:49:19 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2017-09-10 15:37:47 ----RSD---- C:\Windows\Fonts
2017-09-02 16:53:55 ----D---- C:\Program Files (x86)\Google
2017-09-02 16:51:23 ----D---- C:\Users\P3S\AppData\Roaming\TS3Client
2017-09-02 02:31:46 ----A---- C:\Windows\system32\atiuxp64.dll
2017-09-02 02:31:22 ----A---- C:\Windows\system32\atidxx64.dll
2017-09-02 02:31:12 ----A---- C:\Windows\system32\aticfx64.dll
2017-09-02 02:31:08 ----A---- C:\Windows\system32\detoured.dll
2017-09-02 02:30:50 ----A---- C:\Windows\system32\atig6txx.dll
2017-09-02 02:30:48 ----A---- C:\Windows\system32\atig6pxx.dll
2017-09-02 02:30:06 ----A---- C:\Windows\system32\atiadlxx.dll
2017-09-02 02:29:44 ----A---- C:\Windows\system32\coinst_17.30.dll
2017-09-02 02:28:44 ----A---- C:\Windows\system32\atio6axx.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 avdevprot;avdevprot; C:\Windows\system32\DRIVERS\avdevprot.sys [2017-06-13 64504]
R0 avusbflt;avusbflt; C:\Windows\System32\Drivers\avusbflt.sys [2017-06-13 34128]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2015-09-16 213848]
R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2017-09-02 151128]
R1 avkmgr;avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [2017-04-10 35328]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2015-09-16 516096]
R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2017-09-21 194272]
R2 avnetflt;avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [2017-04-10 78600]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2017-09-02 38752136]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2017-09-02 532360]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2017-07-06 96256]
R3 dtlitescsibus;DAEMON Tools Lite Virtual SCSI Bus; C:\Windows\system32\DRIVERS\dtlitescsibus.sys [2017-05-08 30264]
R3 dtliteusbbus;DAEMON Tools Lite Virtual USB Bus; C:\Windows\system32\DRIVERS\dtliteusbbus.sys [2017-05-08 47672]
R3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C; C:\Windows\system32\DRIVERS\e1c62x64.sys [2013-08-21 494864]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2012-01-03 4730344]
R3 MEIx64;Intel(R) Management Engine Interface ; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [2014-09-10 99288]
R3 TPM;Čip TPM; C:\Windows\system32\drivers\tpm.sys [2016-02-05 147904]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
S3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2012-11-12 5337184]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-21 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2015-09-16 19456]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-21 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-21 34688]
S3 terminpt;Microsoft Remote Desktop Input Driver; C:\Windows\system32\drivers\terminpt.sys [2015-09-16 29696]
S3 trufos;trufos; C:\Windows\system32\drivers\trufos.sys [2017-09-17 485512]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2015-09-16 57856]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2015-09-16 30208]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-21 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-21 21760]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-21 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2017-09-02 543112]
R2 AntiVirService;Avira Real-Time Protection; C:\Program Files (x86)\Avira\Antivirus\avguard.exe [2017-09-21 490968]
R2 AntiVirSchedulerService;Avira Scheduler; C:\Program Files (x86)\Avira\Antivirus\sched.exe [2017-09-21 490968]
R2 Avira.ServiceHost;Avira Service Host; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [2017-08-30 402768]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2015-09-16 27136]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2015-09-16 27136]
S2 AntiVirMailService;Avira Mail Protection; C:\Program Files (x86)\Avira\Antivirus\avmailc7.exe [2017-09-21 1128432]
S2 AntiVirWebService;Avira Web Protection; C:\Program Files (x86)\Avira\Antivirus\avwebg7.exe [2017-09-21 1525240]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2017-04-21 107656]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2017-04-21 128648]
S2 gupdate;Služba Aktualizace Google (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-09-02 153168]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2015-09-16 27136]
S3 cphs;Intel(R) Content Protection HECI Service; C:\Windows\SysWow64\IntelCpHeciSvc.exe [2012-11-14 277048]
S3 Disc Soft Lite Bus Service;Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe [2017-02-07 1471168]
S3 gupdatem;Služba Aktualizace Google (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-09-02 153168]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2017-08-13 116224]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2015-09-16 27136]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2017-09-07 1610016]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2015-09-16 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2015-09-16 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2017-05-03 1255736]
S4 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2017-04-21 52856]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-04-21 136312]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-04-21 136312]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-04-21 136312]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119669
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: Krádež STEEAM účtu

#6 Příspěvek od Rudy »

Stáhněte OTM: http://oldtimer.geekstogo.com/OTM.exe a uložte na plochu. Spusťte a do levého okna zkopírujte:
:commands
[Purity]
[Emptytemp]
[Emptyflash]
a klikněte na >MoveIt!<. Po skenu restartujte PC a dejte nový log RSIT.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
P3S
Návštěvník
Návštěvník
Příspěvky: 4
Registrován: 27 lis 2008 14:44

Re: Krádež STEEAM účtu

#7 Příspěvek od P3S »

Logfile of random's system information tool 1.10 (written by random/random)
Run by P3S at 2017-09-30 19:15:17
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 184 GB (39%) free of 477 GB
Total RAM: 4054 MB (66% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:15:21, on 30.9.2017
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18792)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Avira\Antivirus\avgnt.exe
C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
C:\Program Files\trend micro\P3S.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKCU\..\Run: [World of Tanks] "C:\Games\World_of_Tanks\WargamingGameUpdater.exe"
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Avira Mail Protection (AntiVirMailService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\Antivirus\avmailc7.exe
O23 - Service: Avira Scheduler (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\Antivirus\sched.exe
O23 - Service: Avira Real-Time Protection (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\Antivirus\avguard.exe
O23 - Service: Avira Web Protection (AntiVirWebService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\Antivirus\avwebg7.exe
O23 - Service: Avira Service Host (Avira.ServiceHost) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: Disc Soft Lite Bus Service - Disc Soft Ltd - C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Aktualizace Google (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Aktualizace Google (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 5886 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
atieclxx
C:\Windows\System32\spoolsv.exe
"C:\Program Files (x86)\Avira\Antivirus\sched.exe"
"taskhost.exe"
taskeng.exe {17A17006-196F-4461-AA50-C5F3308AD4E6}
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe atlogon
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler.exe"
"C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler64.exe"
"C:\Program Files (x86)\Avira\Antivirus\avguard.exe"
C:\Windows\System32\svchost.exe -k utcsvc
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe"
"C:\Program Files (x86)\Avira\Antivirus\avshadow.exe" avshadowcontrol0_00000438
"C:\Program Files (x86)\Avira\Antivirus\avgnt.exe" /min
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Windows\notepad.exe" C:\_OTM\MovedFiles\09302017_184621.log
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files\CCleaner\CCleaner.exe" /MONITOR /uac
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe" /connectToHost
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\P3S\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\P3S\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=61.0.3163.100 --initial-client-data=0x80,0x84,0x88,0x7c,0x8c,0x7feee7f1988,0x7feee7f1948,0x7feee7f1958
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=4084 --on-initialized-event-handle=312 --parent-handle=316 /prefetch:6
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1108,12004600510105594418,8964412167704608453,131072 --disable-direct-composition --supports-dual-gpus=false --gpu-driver-bug-workarounds=9,12,13,22,23,24,27,49,84 --disable-gl-extensions="GL_KHR_blend_equation_advanced GL_KHR_blend_equation_advanced_coherent" --gpu-vendor-id=0x1002 --gpu-device-id=0x6613 --gpu-driver-vendor="Advanced Micro Devices, Inc." --gpu-driver-version=22.19.676.4 --gpu-driver-date=9-1-2017 --service-request-channel-token=E4600AEB70D98E82A7C3C6DE4EB44AAB --mojo-platform-channel-handle=1140 --ignored=" --type=renderer " /prefetch:2
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,12004600510105594418,8964412167704608453,131072 --service-pipe-token=05F4DF7BD384FDD463C4A253D6B40DC5 --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=05F4DF7BD384FDD463C4A253D6B40DC5 --renderer-client-id=5 --mojo-platform-channel-handle=2768 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,12004600510105594418,8964412167704608453,131072 --service-pipe-token=73B6117A9C8FFC71E569B24C0E12FC75 --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=73B6117A9C8FFC71E569B24C0E12FC75 --renderer-client-id=8 --mojo-platform-channel-handle=3304 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,12004600510105594418,8964412167704608453,131072 --service-pipe-token=D9EC374C91827C8D8261A44A503B84CF --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=D9EC374C91827C8D8261A44A503B84CF --renderer-client-id=4 --mojo-platform-channel-handle=3988 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,12004600510105594418,8964412167704608453,131072 --service-pipe-token=D644333C1CDDD96822389736BEA5529C --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=D644333C1CDDD96822389736BEA5529C --renderer-client-id=6 --mojo-platform-channel-handle=4104 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,12004600510105594418,8964412167704608453,131072 --service-pipe-token=7CE651B41781845EA3D1FBD41E0A5AAC --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=7CE651B41781845EA3D1FBD41E0A5AAC --renderer-client-id=7 --mojo-platform-channel-handle=5192 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,12004600510105594418,8964412167704608453,131072 --service-pipe-token=8960903434DA8B79F8C87D59E4224292 --lang=cs --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=8960903434DA8B79F8C87D59E4224292 --renderer-client-id=11 --mojo-platform-channel-handle=5860 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,12004600510105594418,8964412167704608453,131072 --service-pipe-token=E0106B921910809B3FDD12A02DA30FA5 --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --enable-gpu-async-worker-context --service-request-channel-token=E0106B921910809B3FDD12A02DA30FA5 --renderer-client-id=13 --mojo-platform-channel-handle=5368 /prefetch:1
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 520 524 532 65536 528
"C:\Users\P3S\Desktop\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}

======Registry dump======

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"World of Tanks"=C:\Games\World_of_Tanks\WargamingGameUpdater.exe [2017-02-28 3135752]
"CCleaner Monitoring"=C:\Program Files\CCleaner\CCleaner64.exe [2017-09-20 9856176]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CCleaner Monitoring]
C:\Program Files\CCleaner\CCleaner64.exe [2017-09-20 9856176]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite Automount]
C:\Program Files\DAEMON Tools Lite\DTAgent.exe [2017-02-07 4701888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VDownloader]
C:\Program Files\VDownloader\Vdownloader4.exe [2017-04-10 13975552]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\World of Tanks]
C:\Games\World_of_Tanks\WargamingGameUpdater.exe [2017-02-28 3135752]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2012-11-12 441344]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=153

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktopChanges"=1
"NoDriveTypeAutoRun"=153

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux2"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2017-09-30 18:46:21 ----D---- C:\_OTM
2017-09-29 17:06:35 ----D---- C:\Program Files (x86)\Call of Juarez Gunslinger
2017-09-29 11:18:26 ----D---- C:\Users\P3S\AppData\Roaming\Playnet
2017-09-27 18:51:07 ----D---- C:\AdwCleaner
2017-09-27 17:23:24 ----D---- C:\Program Files\CCleaner
2017-09-27 17:14:00 ----D---- C:\Program Files\trend micro
2017-09-27 17:13:59 ----D---- C:\rsit
2017-09-19 15:01:52 ----D---- C:\Program Files (x86)\InstallShield Installation Information
2017-09-19 14:43:59 ----D---- C:\Program Files (x86)\Ubisoft
2017-09-19 09:09:13 ----D---- C:\Users\P3S\AppData\Roaming\FiraxisLive
2017-09-18 22:18:31 ----D---- C:\Program Files (x86)\Electronic Arts
2017-09-18 12:43:11 ----D---- C:\Program Files\FlatOut2
2017-09-17 16:40:31 ----A---- C:\Windows\system32\drivers\trufos.sys
2017-09-17 16:40:25 ----A---- C:\Windows\SYSWOW64\msvcr80.dll
2017-09-17 16:40:24 ----A---- C:\Windows\SYSWOW64\msvcp80.dll
2017-09-17 16:40:23 ----A---- C:\Windows\SYSWOW64\msvcp90.dll
2017-09-17 16:40:22 ----A---- C:\Windows\SYSWOW64\msvcr90.dll
2017-09-17 16:40:21 ----A---- C:\Windows\SYSWOW64\eEmpty.exe
2017-09-17 16:40:14 ----D---- C:\ProgramData\MicroWorld
2017-09-17 08:13:32 ----D---- C:\Program Files (x86)\AMD
2017-09-16 20:07:59 ----D---- C:\Windows\SYSWOW64\Macromed
2017-09-13 07:55:36 ----A---- C:\Windows\system32\mshtml.dll
2017-09-13 07:55:34 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2017-09-13 07:55:34 ----A---- C:\Windows\system32\ieframe.dll
2017-09-13 07:55:32 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2017-09-13 07:55:32 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2017-09-13 07:55:32 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2017-09-13 07:55:32 ----A---- C:\Windows\system32\wininet.dll
2017-09-13 07:55:32 ----A---- C:\Windows\system32\jscript9.dll
2017-09-13 07:55:31 ----A---- C:\Windows\SYSWOW64\wininet.dll
2017-09-13 07:55:31 ----A---- C:\Windows\SYSWOW64\DXPTaskRingtone.dll
2017-09-13 07:55:31 ----A---- C:\Windows\system32\win32k.sys
2017-09-13 07:55:31 ----A---- C:\Windows\system32\shell32.dll
2017-09-13 07:55:31 ----A---- C:\Windows\system32\iertutil.dll
2017-09-13 07:55:31 ----A---- C:\Windows\system32\DXPTaskRingtone.dll
2017-09-13 07:55:30 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2017-09-13 07:55:30 ----A---- C:\Windows\SYSWOW64\shell32.dll
2017-09-13 07:55:30 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2017-09-13 07:55:30 ----A---- C:\Windows\system32\urlmon.dll
2017-09-13 07:55:30 ----A---- C:\Windows\system32\msfeeds.dll
2017-09-13 07:55:30 ----A---- C:\Windows\system32\mmcndmgr.dll
2017-09-13 07:55:30 ----A---- C:\Windows\system32\mmc.exe
2017-09-13 07:55:29 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2017-09-13 07:55:29 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2017-09-13 07:55:29 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2017-09-13 07:55:29 ----A---- C:\Windows\system32\ntoskrnl.exe
2017-09-13 07:55:28 ----A---- C:\Windows\SYSWOW64\mmcndmgr.dll
2017-09-13 07:55:28 ----A---- C:\Windows\SYSWOW64\mmc.exe
2017-09-13 07:55:28 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2017-09-13 07:55:28 ----A---- C:\Windows\system32\win32spl.dll
2017-09-13 07:55:28 ----A---- C:\Windows\system32\localspl.dll
2017-09-13 07:55:28 ----A---- C:\Windows\system32\iedkcs32.dll
2017-09-13 07:55:27 ----A---- C:\Windows\SYSWOW64\Wldap32.dll
2017-09-13 07:55:27 ----A---- C:\Windows\SYSWOW64\win32spl.dll
2017-09-13 07:55:27 ----A---- C:\Windows\SYSWOW64\usp10.dll
2017-09-13 07:55:27 ----A---- C:\Windows\system32\Wldap32.dll
2017-09-13 07:55:27 ----A---- C:\Windows\system32\usp10.dll
2017-09-13 07:55:27 ----A---- C:\Windows\system32\ie4uinit.exe
2017-09-13 07:55:27 ----A---- C:\Windows\system32\drivers\srvnet.sys
2017-09-13 07:55:26 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2017-09-13 07:55:26 ----A---- C:\Windows\system32\ntprint.dll
2017-09-13 07:55:26 ----A---- C:\Windows\system32\nsisvc.dll
2017-09-13 07:55:26 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2017-09-13 07:55:26 ----A---- C:\Windows\system32\mmcshext.dll
2017-09-13 07:55:26 ----A---- C:\Windows\system32\mmcbase.dll
2017-09-13 07:55:26 ----A---- C:\Windows\system32\drivers\netbt.sys
2017-09-13 07:55:26 ----A---- C:\Windows\system32\cic.dll
2017-09-13 07:55:25 ----A---- C:\Windows\SYSWOW64\ntprint.dll
2017-09-13 07:55:25 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2017-09-13 07:55:25 ----A---- C:\Windows\system32\ntdll.dll
2017-09-13 07:55:25 ----A---- C:\Windows\system32\drivers\nsiproxy.sys
2017-09-13 07:55:25 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2017-09-13 07:55:25 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2017-09-13 07:55:24 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2017-09-13 07:55:24 ----A---- C:\Windows\SYSWOW64\msrating.dll
2017-09-13 07:55:24 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2017-09-13 07:55:24 ----A---- C:\Windows\SYSWOW64\mmcshext.dll
2017-09-13 07:55:24 ----A---- C:\Windows\SYSWOW64\mmcbase.dll
2017-09-13 07:55:24 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2017-09-13 07:55:24 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2017-09-13 07:55:24 ----A---- C:\Windows\SYSWOW64\cic.dll
2017-09-13 07:55:24 ----A---- C:\Windows\system32\webcheck.dll
2017-09-13 07:55:24 ----A---- C:\Windows\system32\shdocvw.dll
2017-09-13 07:55:24 ----A---- C:\Windows\system32\msrating.dll
2017-09-13 07:55:24 ----A---- C:\Windows\system32\mshtmled.dll
2017-09-13 07:55:24 ----A---- C:\Windows\system32\dxtrans.dll
2017-09-13 07:55:24 ----A---- C:\Windows\system32\dxtmsft.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\winnsi.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\shdocvw.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\occache.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\nsi.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\jscript.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\inseng.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\ieui.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2017-09-13 07:55:23 ----A---- C:\Windows\SYSWOW64\certcli.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\winnsi.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\vbscript.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\ole32.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\occache.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\nsi.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\mshtmlmedia.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\MshtmlDac.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\jsproxy.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\jscript9diag.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\jscript.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\inseng.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\ieUnatt.exe
2017-09-13 07:55:23 ----A---- C:\Windows\system32\ieui.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\iesetup.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\iernonce.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\ieetwproxystub.dll
2017-09-13 07:55:23 ----A---- C:\Windows\system32\ieetwcollector.exe
2017-09-13 07:55:23 ----A---- C:\Windows\system32\certcli.dll
2017-09-13 07:55:22 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2017-09-13 07:55:22 ----A---- C:\Windows\SYSWOW64\ole32.dll
2017-09-13 07:55:22 ----A---- C:\Windows\system32\smss.exe
2017-09-13 07:55:22 ----A---- C:\Windows\system32\rpcss.dll
2017-09-13 07:55:22 ----A---- C:\Windows\system32\rpcrt4.dll
2017-09-13 07:55:22 ----A---- C:\Windows\system32\ntprint.exe
2017-09-13 07:55:22 ----A---- C:\Windows\system32\lsasrv.dll
2017-09-13 07:55:22 ----A---- C:\Windows\system32\kerberos.dll
2017-09-13 07:55:22 ----A---- C:\Windows\system32\ieapfltr.dll
2017-09-13 07:55:22 ----A---- C:\Windows\system32\drivers\srv2.sys
2017-09-13 07:55:22 ----A---- C:\Windows\system32\drivers\srv.sys
2017-09-13 07:55:22 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2017-09-13 07:55:22 ----A---- C:\Windows\system32\advapi32.dll
2017-09-13 07:55:21 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2017-09-13 07:55:21 ----A---- C:\Windows\SYSWOW64\ntprint.exe
2017-09-13 07:55:21 ----A---- C:\Windows\SYSWOW64\netbtugc.exe
2017-09-13 07:55:21 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2017-09-13 07:55:21 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2017-09-13 07:55:21 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2017-09-13 07:55:21 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2017-09-13 07:55:21 ----A---- C:\Windows\SYSWOW64\ExplorerFrame.dll
2017-09-13 07:55:21 ----A---- C:\Windows\SYSWOW64\advapi32.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\wow64win.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\wow64.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\winsrv.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\wdigest.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\TSpkg.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\sspicli.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\srcore.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\schannel.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\netbtugc.exe
2017-09-13 07:55:21 ----A---- C:\Windows\system32\ncrypt.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\msv1_0.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\KernelBase.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\kernel32.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\inetpp.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\ExplorerFrame.dll
2017-09-13 07:55:21 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2017-09-13 07:55:21 ----A---- C:\Windows\system32\conhost.exe
2017-09-13 07:55:21 ----A---- C:\Windows\system32\bcrypt.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-09-13 07:55:20 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\wow32.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\srclient.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\schannel.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\setup16.exe
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\secur32.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\rpchttp.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\instnm.exe
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\credssp.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\comcat.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\bcrypt.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\appidapi.dll
2017-09-13 07:55:20 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\wpnpinst.exe
2017-09-13 07:55:20 ----A---- C:\Windows\system32\wow64cpu.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\sspisrv.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\srclient.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\setbcdlocale.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\secur32.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\rstrui.exe
2017-09-13 07:55:20 ----A---- C:\Windows\system32\rpchttp.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\ntvdm64.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\lsass.exe
2017-09-13 07:55:20 ----A---- C:\Windows\system32\inetppui.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2017-09-13 07:55:20 ----A---- C:\Windows\system32\drivers\appid.sys
2017-09-13 07:55:20 ----A---- C:\Windows\system32\csrsrv.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\cryptbase.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\credssp.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\comcat.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\auditpol.exe
2017-09-13 07:55:20 ----A---- C:\Windows\system32\appidsvc.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\appidpolicyconverter.exe
2017-09-13 07:55:20 ----A---- C:\Windows\system32\appidcertstorecheck.exe
2017-09-13 07:55:20 ----A---- C:\Windows\system32\appidapi.dll
2017-09-13 07:55:20 ----A---- C:\Windows\system32\apisetschema.dll
2017-09-13 07:55:19 ----A---- C:\Windows\SYSWOW64\user.exe
2017-09-13 07:55:19 ----A---- C:\Windows\SYSWOW64\oleres.dll
2017-09-13 07:55:19 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2017-09-13 07:55:19 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2017-09-13 07:55:19 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2017-09-13 07:55:19 ----A---- C:\Windows\system32\PrintBrmUi.exe
2017-09-13 07:55:19 ----A---- C:\Windows\system32\oleres.dll
2017-09-13 07:55:19 ----A---- C:\Windows\system32\msobjs.dll
2017-09-13 07:55:19 ----A---- C:\Windows\system32\msaudite.dll
2017-09-13 07:55:19 ----A---- C:\Windows\system32\adtschema.dll
2017-09-10 15:41:39 ----D---- C:\Program Files (x86)\THQ
2017-09-10 15:38:35 ----D---- C:\Users\P3S\AppData\Roaming\OpenOffice
2017-09-10 15:37:43 ----D---- C:\Program Files (x86)\OpenOffice 4
2017-09-08 11:54:21 ----D---- C:\ProgramData\Age of Empires II HD - Slovencina
2017-09-08 11:28:44 ----D---- C:\Program Files (x86)\Age of Empires II HD
2017-09-05 12:58:32 ----A---- C:\Windows\SYSWOW64\amdihk32.dll
2017-09-05 12:58:30 ----A---- C:\Windows\system32\amdihk64.dll
2017-09-03 19:37:28 ----D---- C:\Users\P3S\AppData\Roaming\MPC-HC
2017-09-02 02:31:46 ----A---- C:\Windows\SYSWOW64\atiuxpag.dll
2017-09-02 02:31:40 ----A---- C:\Windows\SYSWOW64\atiumdag.dll
2017-09-02 02:31:36 ----A---- C:\Windows\system32\atiumd64.dll
2017-09-02 02:31:34 ----A---- C:\Windows\SYSWOW64\atiu9pag.dll
2017-09-02 02:31:34 ----A---- C:\Windows\system32\atiu9p64.dll
2017-09-02 02:31:16 ----A---- C:\Windows\SYSWOW64\atidxx32.dll
2017-09-02 02:31:16 ----A---- C:\Windows\system32\GameManager64.dll
2017-09-02 02:31:14 ----A---- C:\Windows\SYSWOW64\GameManager32.dll
2017-09-02 02:31:12 ----A---- C:\Windows\system32\dgtrayicon.exe
2017-09-02 02:31:10 ----A---- C:\Windows\SYSWOW64\aticfx32.dll
2017-09-02 02:31:08 ----A---- C:\Windows\SYSWOW64\detoured.dll
2017-09-02 02:31:00 ----A---- C:\Windows\system32\atitmm64.dll
2017-09-02 02:30:58 ----A---- C:\Windows\system32\atimuixx.dll
2017-09-02 02:30:56 ----A---- C:\Windows\system32\RapidFireServer64.dll
2017-09-02 02:30:56 ----A---- C:\Windows\system32\drivers\atikmpag.sys
2017-09-02 02:30:54 ----A---- C:\Windows\SYSWOW64\RapidFireServer.dll
2017-09-02 02:30:54 ----A---- C:\Windows\SYSWOW64\atiglpxx.dll
2017-09-02 02:30:54 ----A---- C:\Windows\system32\atiglpxx.dll
2017-09-02 02:30:52 ----A---- C:\Windows\SYSWOW64\atigktxx.dll
2017-09-02 02:30:52 ----A---- C:\Windows\system32\Rapidfire64.dll
2017-09-02 02:30:50 ----A---- C:\Windows\SYSWOW64\Rapidfire.dll
2017-09-02 02:30:48 ----A---- C:\Windows\system32\mantleaxl64.dll
2017-09-02 02:30:46 ----A---- C:\Windows\SYSWOW64\mantleaxl32.dll
2017-09-02 02:30:46 ----A---- C:\Windows\system32\clinfo.exe
2017-09-02 02:30:46 ----A---- C:\Windows\system32\atiesrxx.exe
2017-09-02 02:30:44 ----A---- C:\Windows\system32\OpenCL.dll
2017-09-02 02:30:44 ----A---- C:\Windows\system32\mantle64.dll
2017-09-02 02:30:44 ----A---- C:\Windows\system32\atieclxx.exe
2017-09-02 02:30:42 ----A---- C:\Windows\SYSWOW64\OpenCL.dll
2017-09-02 02:30:42 ----A---- C:\Windows\SYSWOW64\mantle32.dll
2017-09-02 02:30:42 ----A---- C:\Windows\system32\atieah64.exe
2017-09-02 02:30:40 ----A---- C:\Windows\SYSWOW64\atieah32.exe
2017-09-02 02:30:40 ----A---- C:\Windows\system32\ATIODE.exe
2017-09-02 02:30:40 ----A---- C:\Windows\system32\ATIODCLI.exe
2017-09-02 02:30:40 ----A---- C:\Windows\system32\atidemgy.dll
2017-09-02 02:30:36 ----A---- C:\Windows\system32\aticalrt64.dll
2017-09-02 02:30:34 ----A---- C:\Windows\SYSWOW64\aticalrt.dll
2017-09-02 02:30:30 ----A---- C:\Windows\system32\drivers\ati2erec.dll
2017-09-02 02:30:26 ----A---- C:\Windows\SYSWOW64\atiumdva.dll
2017-09-02 02:30:26 ----A---- C:\Windows\system32\aticaldd64.dll
2017-09-02 02:30:20 ----A---- C:\Windows\SYSWOW64\aticaldd.dll
2017-09-02 02:30:20 ----A---- C:\Windows\system32\atiumd6a.dll
2017-09-02 02:30:18 ----A---- C:\Windows\SYSWOW64\atimpc32.dll
2017-09-02 02:30:18 ----A---- C:\Windows\SYSWOW64\amdpcom32.dll
2017-09-02 02:30:18 ----A---- C:\Windows\system32\atimpc64.dll
2017-09-02 02:30:18 ----A---- C:\Windows\system32\aticalcl64.dll
2017-09-02 02:30:18 ----A---- C:\Windows\system32\amdpcom64.dll
2017-09-02 02:30:16 ----A---- C:\Windows\SYSWOW64\aticalcl.dll
2017-09-02 02:30:14 ----A---- C:\Windows\system32\amdhcp64.dll
2017-09-02 02:30:12 ----A---- C:\Windows\SYSWOW64\amdhcp32.dll
2017-09-02 02:30:12 ----A---- C:\Windows\system32\atiapfxx.exe
2017-09-02 02:30:10 ----A---- C:\Windows\system32\amdocl64.dll
2017-09-02 02:30:08 ----A---- C:\Windows\SYSWOW64\atiadlxy.dll
2017-09-02 02:30:08 ----A---- C:\Windows\SYSWOW64\atiadlxx.dll
2017-09-02 02:30:08 ----A---- C:\Windows\system32\amdmantle64.dll
2017-09-02 02:30:04 ----A---- C:\Windows\SYSWOW64\amdave32.dll
2017-09-02 02:30:04 ----A---- C:\Windows\system32\amdave64.dll
2017-09-02 02:30:02 ----A---- C:\Windows\SYSWOW64\amdmantle32.dll
2017-09-02 02:30:00 ----A---- C:\Windows\system32\amdlvr64.dll
2017-09-02 02:29:58 ----A---- C:\Windows\SYSWOW64\amdlvr32.dll
2017-09-02 02:29:54 ----A---- C:\Windows\system32\amdocl12cl64.dll
2017-09-02 02:29:48 ----A---- C:\Windows\system32\atisamu64.dll
2017-09-02 02:29:46 ----A---- C:\Windows\SYSWOW64\atisamu32.dll
2017-09-02 02:29:46 ----A---- C:\Windows\system32\amdgfxinfo64.dll
2017-09-02 02:29:44 ----A---- C:\Windows\SYSWOW64\amdgfxinfo32.dll
2017-09-02 02:29:42 ----A---- C:\Windows\SYSWOW64\amdocl12cl.dll
2017-09-02 02:29:42 ----A---- C:\Windows\system32\drivers\amdacpksd.sys
2017-09-02 02:29:36 ----A---- C:\Windows\system32\drivers\atikmdag.sys
2017-09-02 02:29:28 ----A---- C:\Windows\system32\amfrt64.dll
2017-09-02 02:29:26 ----A---- C:\Windows\SYSWOW64\amfrt32.dll
2017-09-02 02:29:26 ----A---- C:\Windows\SYSWOW64\amdocl.dll
2017-09-02 02:29:20 ----A---- C:\Windows\system32\amdvlk64.dll
2017-09-02 02:29:16 ----A---- C:\Windows\SYSWOW64\amdvlk32.dll
2017-09-02 02:29:12 ----A---- C:\Windows\system32\amduve64.dll
2017-09-02 02:29:10 ----A---- C:\Windows\SYSWOW64\amduve32.dll
2017-09-02 02:29:04 ----A---- C:\Windows\SYSWOW64\amdmmcl.dll
2017-09-02 02:29:04 ----A---- C:\Windows\system32\amdmmcl6.dll
2017-09-02 02:29:02 ----A---- C:\Windows\system32\amdmcl64.dll
2017-09-02 02:29:00 ----A---- C:\Windows\SYSWOW64\amdmcl32.dll
2017-09-02 02:28:56 ----A---- C:\Windows\SYSWOW64\atioglxx.dll

======List of files/folders modified in the last 1 month======

2017-09-30 19:15:21 ----D---- C:\Windows\Prefetch
2017-09-30 19:15:18 ----D---- C:\Windows\Temp
2017-09-30 18:47:30 ----D---- C:\Windows\system32\config
2017-09-30 18:47:05 ----D---- C:\Windows\System32
2017-09-30 18:47:04 ----D---- C:\Windows\SysWOW64
2017-09-30 18:47:04 ----D---- C:\Windows
2017-09-30 15:04:34 ----D---- C:\Program Files (x86)\Steam
2017-09-29 20:27:58 ----D---- C:\Users\P3S\AppData\Roaming\uTorrent
2017-09-29 17:06:35 ----RD---- C:\Program Files (x86)
2017-09-29 11:21:38 ----SHD---- C:\System Volume Information
2017-09-29 11:18:09 ----D---- C:\ProgramData\Package Cache
2017-09-29 11:17:50 ----SHD---- C:\Windows\Installer
2017-09-29 11:17:49 ----SHD---- C:\Config.Msi
2017-09-27 17:23:30 ----D---- C:\Windows\system32\Tasks
2017-09-27 17:23:24 ----RD---- C:\Program Files
2017-09-27 11:51:56 ----A---- C:\Windows\win.ini
2017-09-24 13:40:17 ----D---- C:\Windows\system32\NDF
2017-09-19 15:05:51 ----RSD---- C:\Windows\assembly
2017-09-19 15:04:36 ----D---- C:\Windows\Logs
2017-09-19 15:01:23 ----D---- C:\Windows\winsxs
2017-09-17 16:40:31 ----D---- C:\Windows\system32\drivers
2017-09-17 16:40:16 ----D---- C:\Program Files (x86)\Common Files
2017-09-17 16:40:14 ----HD---- C:\ProgramData
2017-09-17 08:15:19 ----D---- C:\Windows\system32\catroot
2017-09-17 08:10:07 ----D---- C:\Windows\inf
2017-09-17 08:09:56 ----D---- C:\Windows\system32\DriverStore
2017-09-17 08:03:44 ----D---- C:\AMD
2017-09-16 20:05:57 ----D---- C:\Users\P3S\AppData\Roaming\DAEMON Tools Lite
2017-09-16 08:19:56 ----D---- C:\Windows\SoftwareDistribution
2017-09-16 08:17:39 ----D---- C:\Windows\debug
2017-09-14 10:40:19 ----D---- C:\Windows\rescache
2017-09-14 10:11:39 ----D---- C:\Windows\Microsoft.NET
2017-09-14 09:56:43 ----A---- C:\Windows\system32\PerfStringBackup.INI
2017-09-14 09:48:54 ----D---- C:\Program Files\Internet Explorer
2017-09-14 09:48:53 ----D---- C:\Windows\SYSWOW64\cs-CZ
2017-09-14 09:48:53 ----D---- C:\Program Files (x86)\Internet Explorer
2017-09-14 09:48:52 ----D---- C:\Windows\SYSWOW64\en-US
2017-09-14 09:48:48 ----D---- C:\Windows\system32\cs-CZ
2017-09-14 09:48:46 ----D---- C:\Windows\system32\en-US
2017-09-14 09:48:41 ----D---- C:\Windows\AppPatch
2017-09-14 09:48:40 ----D---- C:\Windows\system32\Boot
2017-09-14 00:55:53 ----D---- C:\Windows\system32\MRT
2017-09-14 00:53:49 ----AC---- C:\Windows\system32\MRT.exe
2017-09-14 00:51:22 ----D---- C:\Windows\system32\catroot2
2017-09-14 00:49:19 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2017-09-10 15:37:47 ----RSD---- C:\Windows\Fonts
2017-09-02 16:53:55 ----D---- C:\Program Files (x86)\Google
2017-09-02 16:51:23 ----D---- C:\Users\P3S\AppData\Roaming\TS3Client
2017-09-02 02:31:46 ----A---- C:\Windows\system32\atiuxp64.dll
2017-09-02 02:31:22 ----A---- C:\Windows\system32\atidxx64.dll
2017-09-02 02:31:12 ----A---- C:\Windows\system32\aticfx64.dll
2017-09-02 02:31:08 ----A---- C:\Windows\system32\detoured.dll
2017-09-02 02:30:50 ----A---- C:\Windows\system32\atig6txx.dll
2017-09-02 02:30:48 ----A---- C:\Windows\system32\atig6pxx.dll
2017-09-02 02:30:06 ----A---- C:\Windows\system32\atiadlxx.dll
2017-09-02 02:29:44 ----A---- C:\Windows\system32\coinst_17.30.dll
2017-09-02 02:28:44 ----A---- C:\Windows\system32\atio6axx.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 avdevprot;avdevprot; C:\Windows\system32\DRIVERS\avdevprot.sys [2017-06-13 64504]
R0 avusbflt;avusbflt; C:\Windows\System32\Drivers\avusbflt.sys [2017-06-13 34128]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2015-09-16 213848]
R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2017-09-02 151128]
R1 avkmgr;avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [2017-04-10 35328]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2015-09-16 516096]
R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2017-09-21 194272]
R2 avnetflt;avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [2017-04-10 78600]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2017-09-02 38752136]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2017-09-02 532360]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2017-07-06 96256]
R3 dtlitescsibus;DAEMON Tools Lite Virtual SCSI Bus; C:\Windows\system32\DRIVERS\dtlitescsibus.sys [2017-05-08 30264]
R3 dtliteusbbus;DAEMON Tools Lite Virtual USB Bus; C:\Windows\system32\DRIVERS\dtliteusbbus.sys [2017-05-08 47672]
R3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C; C:\Windows\system32\DRIVERS\e1c62x64.sys [2013-08-21 494864]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2012-01-03 4730344]
R3 MEIx64;Intel(R) Management Engine Interface ; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [2014-09-10 99288]
R3 TPM;Čip TPM; C:\Windows\system32\drivers\tpm.sys [2016-02-05 147904]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
S3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2012-11-12 5337184]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-21 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2015-09-16 19456]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-21 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-21 34688]
S3 terminpt;Microsoft Remote Desktop Input Driver; C:\Windows\system32\drivers\terminpt.sys [2015-09-16 29696]
S3 trufos;trufos; C:\Windows\system32\drivers\trufos.sys [2017-09-17 485512]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2015-09-16 57856]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2015-09-16 30208]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-21 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-21 21760]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-21 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2017-09-02 543112]
R2 AntiVirService;Avira Real-Time Protection; C:\Program Files (x86)\Avira\Antivirus\avguard.exe [2017-09-21 490968]
R2 AntiVirSchedulerService;Avira Scheduler; C:\Program Files (x86)\Avira\Antivirus\sched.exe [2017-09-21 490968]
R2 Avira.ServiceHost;Avira Service Host; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [2017-08-30 402768]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2015-09-16 27136]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2015-09-16 27136]
S2 AntiVirMailService;Avira Mail Protection; C:\Program Files (x86)\Avira\Antivirus\avmailc7.exe [2017-09-21 1128432]
S2 AntiVirWebService;Avira Web Protection; C:\Program Files (x86)\Avira\Antivirus\avwebg7.exe [2017-09-21 1525240]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2017-04-21 107656]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2017-04-21 128648]
S2 gupdate;Služba Aktualizace Google (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-09-02 153168]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2015-09-16 27136]
S3 cphs;Intel(R) Content Protection HECI Service; C:\Windows\SysWow64\IntelCpHeciSvc.exe [2012-11-14 277048]
S3 Disc Soft Lite Bus Service;Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe [2017-02-07 1471168]
S3 gupdatem;Služba Aktualizace Google (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-09-02 153168]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2017-08-13 116224]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2015-09-16 27136]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2017-09-27 1610016]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2015-09-16 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2015-09-16 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2017-05-03 1255736]
S4 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2017-04-21 52856]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-04-21 136312]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-04-21 136312]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-04-21 136312]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119669
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: Krádež STEEAM účtu

#8 Příspěvek od Rudy »

Smazáno, log je již OK. Ve vašem případě by bylo dobré ještě proskenovat MBAM: http://www.malwarebytes.org/mbam.php . Udělejte kompletní sken a dejte log.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Odpovědět

Zpět na „Řešení problémů, logy“