Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

Podezření na malware v PC

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Zamčeno
Zpráva
Autor
MarekH

Podezření na malware v PC

#1 Příspěvek od MarekH »

Dobrý den, mám podezření na přítomnost zmetků v mém PC :-(

zde je výpis z FRST


Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:05-07-2015
Ran by Randaal (administrator) on RANDAAL-PC on 06-07-2015 23:06:04
Running from C:\Users\Randaal\Desktop
Loaded Profiles: Randaal (Available Profiles: Randaal)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Čeština (Česká republika)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
() C:\Program Files (x86)\ASUS\AXSP\1.02.00\atkexComSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
() C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.22\AsSysCtrlService.exe
(AVerMedia) C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRECentral.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(M-Audio) C:\Program Files (x86)\M-Audio\M-Track Plus\AudioDevMon.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\System32\PnkBstrA.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
(Electronic Arts) C:\Program Files (x86)\Origin\Origin.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_x64.exe
(GoPro) C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\avastui.exe
(OCCAM Financial Technology) C:\Program Files (x86)\VeNCrypt-0.2.6\vencviewer.exe
(Logitech Inc.) C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe
(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winampa.exe
(Dropbox, Inc.) C:\Users\Randaal\AppData\Roaming\Dropbox\bin\Dropbox.exe
() C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Corsair Components, Inc.) C:\Program Files (x86)\corsair\Corsair Utility Engine\CorsairHID.exe
(TP-LINK) C:\Program Files (x86)\TP-LINK\USB Printer Controller\USB Printer Controller.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\Bluetooth Headset Helper.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2754704 2015-06-03] (NVIDIA Corporation)
HKLM\...\Run: [Launch LCore] => C:\Program Files\Logitech Gaming Software\LCore.exe [13318424 2015-03-12] (Logitech Inc.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7634648 2014-08-14] (Realtek Semiconductor)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2014-05-28] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2014-06-27] (Intel Corporation)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5515496 2015-05-15] (Avast Software s.r.o.)
HKLM-x32\...\Run: [LWS] => C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [204136 2012-09-13] (Logitech Inc.)
HKLM-x32\...\Run: [WinampAgent] => C:\Program Files (x86)\Winamp\winampa.exe [85600 2013-12-13] (Nullsoft, Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
HKLM-x32\...\Run: [GoPro Studio Importer] => C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe [3207680 2015-05-20] (GoPro)
HKLM-x32\...\Run: [Corsair Utility Engine] => C:\Program Files (x86)\Corsair\Corsair Utility Engine\CorsairHID.exe [11753792 2015-05-22] (Corsair Components, Inc.)
HKLM-x32\...\Run: [TP-LINK USB Printer Controller] => C:\Program Files (x86)\TP-LINK\USB Printer Controller\USB Printer Controller.exe [4245504 2013-08-01] (TP-LINK)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3978600 2015-03-30] (LogMeIn Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-06-17] (Apple Inc.)
HKU\S-1-5-21-516098057-2350176401-1669302986-1000\...\Run: [GoogleChromeAutoLaunch_41382869C0F1E7842E76A758AD89BD5F] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [813896 2015-06-20] (Google Inc.)
HKU\S-1-5-21-516098057-2350176401-1669302986-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8204056 2015-04-23] (Piriform Ltd)
HKU\S-1-5-21-516098057-2350176401-1669302986-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [28785792 2015-06-02] (Skype Technologies S.A.)
HKU\S-1-5-21-516098057-2350176401-1669302986-1000\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3632112 2015-06-30] (Electronic Arts)
HKU\S-1-5-21-516098057-2350176401-1669302986-1000\...\Run: [Dropbox Update] => C:\Users\Randaal\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-13] (Dropbox, Inc.)
HKU\S-1-5-21-516098057-2350176401-1669302986-1000\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-516098057-2350176401-1669302986-1000\...\MountPoints2: D - D:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-516098057-2350176401-1669302986-1000\...\MountPoints2: {91843ce1-0607-11e5-be03-10c37ba0c3b2} - E:\HTC_Sync_Manager_PC.exe
Lsa: [Notification Packages] scecli C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2015-05-06]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\GoPro Importer.lnk [2015-05-15]
ShortcutTarget: GoPro Importer.lnk -> C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe (GoPro)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Run VeNCrypt Listening Viewer.lnk [2015-05-29]
ShortcutTarget: Run VeNCrypt Listening Viewer.lnk -> C:\Program Files (x86)\VeNCrypt-0.2.6\vencviewer.exe (OCCAM Financial Technology)
Startup: C:\Users\Randaal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-05-07]
ShortcutTarget: Dropbox.lnk -> C:\Users\Randaal\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Randaal\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Randaal\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Randaal\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Randaal\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Randaal\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Randaal\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Randaal\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Randaal\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-05-07] (Avast Software s.r.o.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Randaal\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Randaal\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Randaal\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Randaal\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Randaal\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Randaal\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Randaal\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Randaal\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-05-15] (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-05-07] (Avast Software s.r.o.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-05-15] (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-05-07] (Avast Software s.r.o.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2015-07-05] (Oracle Corporation)
Tcpip\..\Interfaces\{193C4257-9EBA-4C3D-8296-FDBD7CE69F2E}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{30D51955-0623-4371-9AED-04903074CE8D}: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF Plugin: @esn/npbattlelog,version=2.7.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.7.0\npbattlelogx64.dll [2015-04-23] (EA Digital Illusions CE AB)
FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-05-15] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-05-15] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin-x32: @esn/npbattlelog,version=2.7.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.7.0\npbattlelog.dll [2015-04-23] (EA Digital Illusions CE AB)
FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll [2015-07-05] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-06-17] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-06-17] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-03-17] (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-05-07]

Chrome:
=======
CHR Profile: C:\Users\Randaal\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (BetterTTV) - C:\Users\Randaal\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajopnjidmegmdimjlfnijceegpefgped [2015-05-06]
CHR Extension: (YouTube) - C:\Users\Randaal\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-05-06]
CHR Extension: (Adblock for Youtube™) - C:\Users\Randaal\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmedhionkhpnakcndndgjdbohmhepckk [2015-05-06]
CHR Extension: (Google Search) - C:\Users\Randaal\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-05-06]
CHR Extension: (Avast SafePrice) - C:\Users\Randaal\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2015-05-15]
CHR Extension: (Avast Online Security) - C:\Users\Randaal\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-05-07]
CHR Extension: (Twitch Live) - C:\Users\Randaal\AppData\Local\Google\Chrome\User Data\Default\Extensions\iiljidcefnbhbpamageahhblhbbhhopm [2015-05-06]
CHR Extension: (Google Wallet) - C:\Users\Randaal\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-05-06]
CHR Extension: (Gmail) - C:\Users\Randaal\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-05-06]
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx [2015-05-07]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-05-07]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.02.00\atkexComSvc.exe [936728 2014-01-28] ()
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.22\AsSysCtrlService.exe [1360016 2014-04-24] ()
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-05-07] (Avast Software s.r.o.)
R2 AVerRECentral; C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRECentral.exe [355840 2013-05-09] (AVerMedia) [File not signed]
S3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [235744 2015-07-04] (EasyAntiCheat Ltd)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1152656 2015-06-03] (NVIDIA Corporation)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [16232 2014-05-28] (Intel Corporation)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [417552 2015-03-30] (LogMeIn, Inc.)
R2 MTrackPlusAudioDevMon; C:\Program Files (x86)\M-Audio\M-Track Plus\AudioDevMon.exe [2366736 2015-01-09] (M-Audio)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1893008 2015-06-03] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [23007376 2015-06-03] (NVIDIA Corporation)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2004488 2015-06-30] (Electronic Arts)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76152 2015-06-04] ()
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75136 2015-05-29] ()
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5495056 2015-06-18] (TeamViewer GmbH)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2014-01-28] ()
R0 asstor64; C:\Windows\System32\DRIVERS\asstor64.sys [77600 2014-03-26] (Asmedia Technology)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-05-07] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [89944 2015-05-07] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-05-07] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-05-07] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-05-07] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-06-26] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [137288 2015-05-07] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [272248 2015-05-07] ()
R3 AVer330; C:\Windows\System32\DRIVERS\AVer330.sys [1503744 2013-06-05] (AVerMedia TECHNOLOGIES, Inc.)
R3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [172760 2013-10-01] (Broadcom Corporation.)
R3 CorsairVBusDriver; C:\Windows\System32\DRIVERS\CorsairVBusDriver.sys [47840 2015-05-18] (Corsair)
R3 CorsairVHidDriver; C:\Windows\System32\DRIVERS\CorsairVHidDriver.sys [21728 2015-05-18] (Corsair)
R3 e1dexpress; C:\Windows\System32\DRIVERS\e1d62x64.sys [487704 2014-03-14] (Intel Corporation)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2014-05-28] (Intel Corporation)
R3 LGSHidFilt; C:\Windows\System32\DRIVERS\LGSHidFilt.Sys [64280 2013-05-30] (Logitech Inc.)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [129312 2014-09-30] (Intel Corporation)
R3 MTRACKPLUS; C:\Windows\System32\DRIVERS\MAudioMTrackPlus.sys [530192 2015-01-09] (M-Audio)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-06-03] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [46768 2015-05-19] (NVIDIA Corporation)
R3 TPLINKUDSMBus; C:\Windows\System32\drivers\TplinkUDSMBus.sys [113888 2013-07-25] (Windows (R) Codename Longhorn DDK provider)
R3 tplinkUDSTcpBus; C:\Windows\System32\drivers\tplinkUDSTcpBus.sys [193248 2013-07-25] (Windows (R) Codename Longhorn DDK provider)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-06 23:06 - 2015-07-06 23:06 - 00023092 _____ C:\Users\Randaal\Desktop\FRST.txt
2015-07-06 23:05 - 2015-07-06 23:06 - 00000000 ____D C:\FRST
2015-07-06 22:57 - 2015-07-06 22:57 - 02112512 _____ (Farbar) C:\Users\Randaal\Desktop\FRST64.exe
2015-07-06 22:35 - 2015-07-06 22:36 - 00000000 ____D C:\Users\Randaal\AppData\Roaming\112b48
2015-07-06 22:35 - 2015-07-06 22:35 - 01897768 _____ (Adobe Systems Incorporated) C:\Users\Randaal\Desktop\flashplayer18_ha_install.exe
2015-07-05 23:37 - 2015-07-05 23:38 - 00000000 ____D C:\Users\Randaal\AppData\Roaming\BSplayer
2015-07-05 23:37 - 2015-07-05 23:37 - 00001128 _____ C:\ProgramData\Microsoft\Windows\Start Menu\BS.Player FREE.lnk
2015-07-05 23:37 - 2015-07-05 23:37 - 00001122 _____ C:\Users\Public\Desktop\BS.Player FREE.lnk
2015-07-05 23:37 - 2015-07-05 23:37 - 00000000 ____D C:\Users\Randaal\AppData\Roaming\BSplayer Pro
2015-07-05 23:37 - 2015-07-05 23:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BS.Player
2015-07-05 23:37 - 2015-07-05 23:37 - 00000000 ____D C:\Program Files (x86)\Webteh
2015-07-05 23:35 - 2015-07-05 23:35 - 10554352 _____ C:\Users\Randaal\Desktop\bsplayer269-1079.exe
2015-07-05 17:30 - 2015-07-04 23:31 - 00235744 _____ (EasyAntiCheat Ltd) C:\Windows\SysWOW64\EasyAntiCheat.exe
2015-07-05 17:29 - 2015-07-05 17:29 - 00000000 ____D C:\Users\Randaal\AppData\Roaming\Day 1 Studios
2015-07-05 17:28 - 2015-07-05 17:28 - 00000000 ____D C:\Users\Randaal\AppData\Local\Daedalic Entertainment GmbH
2015-07-05 17:27 - 2015-07-05 17:27 - 00544656 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2015-07-05 17:27 - 2015-07-05 17:27 - 00214408 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2015-07-05 17:27 - 2015-07-05 17:27 - 00173960 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2015-07-05 17:27 - 2015-07-05 17:27 - 00173960 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2015-07-05 17:27 - 2015-07-05 17:27 - 00000000 ____D C:\Program Files (x86)\Java
2015-07-04 10:00 - 2015-05-26 00:25 - 00891904 _____ (Microsoft) C:\Users\Randaal\Desktop\Matchmaking Server Picker.exe
2015-07-04 09:59 - 2015-07-04 09:59 - 00432287 _____ C:\Users\Randaal\Desktop\matchmaking_server_picker_2_7.zip
2015-07-03 05:36 - 2015-07-03 05:36 - 00000000 ____D C:\Users\Randaal\AppData\Roaming\TownOfSalem
2015-07-02 23:33 - 2015-07-02 23:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2015-07-02 23:33 - 2015-07-02 23:33 - 00000000 ____D C:\ProgramData\Apple Computer
2015-07-01 04:32 - 2015-07-01 04:32 - 00000000 ____D C:\Users\Randaal\AppData\Local\squishy
2015-07-01 03:20 - 2015-07-01 03:20 - 00000000 ____D C:\Users\Randaal\AppData\Local\BridgeProject
2015-06-30 02:33 - 2015-07-06 22:54 - 00000000 ____D C:\Users\Randaal\AppData\Local\LogMeIn Hamachi
2015-06-30 02:33 - 2015-06-30 02:33 - 00000000 ____D C:\Users\Randaal\AppData\Local\LogMeIn
2015-06-30 02:33 - 2015-06-30 02:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2015-06-30 02:33 - 2015-06-30 02:33 - 00000000 ____D C:\ProgramData\LogMeIn
2015-06-30 02:33 - 2015-06-30 02:33 - 00000000 ____D C:\Program Files (x86)\LogMeIn Hamachi
2015-06-30 02:32 - 2015-06-30 02:32 - 08552448 _____ C:\Users\Randaal\Desktop\hamachi.msi
2015-06-29 18:13 - 2015-06-29 18:56 - 01108823 _____ C:\Users\Randaal\Desktop\overpass.jpeg
2015-06-28 02:33 - 2015-06-28 02:33 - 00000000 ____D C:\Program Files (x86)\Microsoft XNA
2015-06-25 20:32 - 2015-06-25 20:32 - 00002177 _____ C:\Users\Public\Desktop\USB Printer Controller.lnk
2015-06-25 20:32 - 2015-06-25 20:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TP-LINK
2015-06-25 20:32 - 2015-06-25 20:32 - 00000000 ____D C:\Program Files (x86)\TP-LINK
2015-06-25 20:32 - 2013-07-25 15:26 - 00193248 _____ (Windows (R) Codename Longhorn DDK provider) C:\Windows\system32\Drivers\tplinkUDSTcpBus.sys
2015-06-25 20:32 - 2013-07-25 15:26 - 00113888 _____ (Windows (R) Codename Longhorn DDK provider) C:\Windows\system32\Drivers\tplinkUDSMBus.sys
2015-06-25 20:16 - 2015-06-25 20:22 - 00000000 ____D C:\Users\Randaal\Documents\Of Orcs and Men
2015-06-24 13:44 - 2015-06-24 13:46 - 10221921 _____ C:\Users\Randaal\Desktop\CSGO Moviemaking Files by BLDZRR.rar
2015-06-24 13:18 - 2015-06-24 13:18 - 00115001 _____ C:\Users\Randaal\Desktop\csgo_helper.zip
2015-06-24 11:32 - 2015-06-25 19:15 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-06-24 11:32 - 2015-06-24 11:32 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2015-06-24 11:32 - 2015-06-24 11:32 - 00000000 ____D C:\Program Files (x86)\Adobe
2015-06-24 11:29 - 2015-07-06 22:35 - 00000914 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-06-24 11:29 - 2015-06-24 11:29 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-06-24 11:29 - 2015-06-24 11:29 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-06-24 11:29 - 2015-06-24 11:29 - 00003852 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-06-24 11:29 - 2015-06-24 11:29 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2015-06-24 11:29 - 2015-06-24 11:29 - 00000000 ____D C:\Windows\system32\Macromed
2015-06-24 11:29 - 2015-06-24 11:29 - 00000000 ____D C:\Users\Randaal\AppData\Roaming\Macromedia
2015-06-23 22:55 - 2015-06-23 22:55 - 01487263 _____ C:\Users\Randaal\Desktop\Chatty_0.8_hotkey_64bit.zip
2015-06-23 13:42 - 2015-06-23 21:05 - 00000000 ____D C:\Users\Randaal\AppData\Roaming\uTorrent
2015-06-23 13:42 - 2015-06-23 13:42 - 00266445 _____ C:\Users\Randaal\Desktop\[kat.cr]320mp3.monstercat.complete.discography.as.of.june.1.2015.albums.thru.022.eps.thru.073.and.more.torrent
2015-06-23 13:42 - 2015-06-23 13:42 - 00000000 ____D C:\Users\Randaal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\uTorrent
2015-06-23 12:15 - 2015-06-23 12:15 - 06477032 _____ (Tim Kosse) C:\Users\Randaal\Downloads\FileZilla_3.11.0.2_win64-setup.exe
2015-06-23 12:14 - 2015-06-23 12:14 - 06471520 _____ (Tim Kosse) C:\Users\Randaal\Downloads\FileZilla_3.11.0.1_win64-setup.exe
2015-06-23 10:29 - 2015-06-17 08:03 - 00571024 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2015-06-23 10:28 - 2015-06-17 11:10 - 42729104 _____ C:\Windows\system32\nvcompiler.dll
2015-06-23 10:28 - 2015-06-17 11:10 - 37748880 _____ C:\Windows\SysWOW64\nvcompiler.dll
2015-06-23 10:28 - 2015-06-17 11:10 - 30481552 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2015-06-23 10:28 - 2015-06-17 11:10 - 16145200 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2015-06-23 10:28 - 2015-06-17 11:10 - 14497520 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2015-06-23 10:28 - 2015-06-17 11:10 - 13263056 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2015-06-23 10:28 - 2015-06-17 11:10 - 11831856 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2015-06-23 10:28 - 2015-06-17 11:10 - 11011216 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2015-06-23 10:28 - 2015-06-17 11:10 - 02932368 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2015-06-23 10:28 - 2015-06-17 11:10 - 02599752 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2015-06-23 10:28 - 2015-06-17 11:10 - 01898128 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6435330.dll
2015-06-23 10:28 - 2015-06-17 11:10 - 01557832 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6435330.dll
2015-06-23 10:28 - 2015-06-17 11:10 - 01099992 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2015-06-23 10:28 - 2015-06-17 11:10 - 01060168 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2015-06-23 10:28 - 2015-06-17 11:10 - 01050768 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2015-06-23 10:28 - 2015-06-17 11:10 - 00982672 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2015-06-23 10:28 - 2015-06-17 11:10 - 00975176 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2015-06-23 10:28 - 2015-06-17 11:10 - 00938752 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2015-06-23 10:28 - 2015-06-17 11:10 - 00503408 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2015-06-23 10:28 - 2015-06-17 11:10 - 00408392 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2015-06-23 10:28 - 2015-06-17 11:10 - 00407296 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2015-06-23 10:28 - 2015-06-17 11:10 - 00364176 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2015-06-23 10:28 - 2015-06-17 11:10 - 00204648 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2015-06-23 10:28 - 2015-06-17 11:10 - 00176904 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2015-06-23 10:28 - 2015-06-17 11:10 - 00155280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2015-06-23 10:28 - 2015-06-17 11:10 - 00150832 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2015-06-23 10:28 - 2015-06-17 11:10 - 00128696 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2015-06-23 10:28 - 2015-06-17 11:10 - 00040280 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2015-06-23 10:25 - 2015-06-23 10:25 - 00000000 ____D C:\Users\Randaal\Documents\WB Games
2015-06-22 14:19 - 2015-06-22 14:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com
2015-06-22 14:12 - 2015-06-22 14:12 - 00000000 ____D C:\GOG Games
2015-06-19 13:59 - 2015-06-19 13:59 - 10158550 _____ C:\Users\Randaal\Desktop\Archer_C5_V2_USB_Print_Service_Client_Setup.zip
2015-06-17 00:23 - 2015-06-17 00:23 - 00094208 _____ (Apple Inc.) C:\Windows\SysWOW64\QuickTimeVR.qtx
2015-06-17 00:23 - 2015-06-17 00:23 - 00069632 _____ (Apple Inc.) C:\Windows\SysWOW64\QuickTime.qts
2015-06-16 13:18 - 2015-06-17 11:10 - 22947144 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2015-06-16 13:18 - 2015-05-28 09:04 - 01898312 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6435306.dll
2015-06-16 13:18 - 2015-05-28 09:04 - 01557832 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6435306.dll
2015-06-16 13:11 - 2015-05-19 05:29 - 00046768 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2015-06-16 13:11 - 2015-05-19 05:14 - 00057520 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2015-06-16 03:06 - 2015-06-16 03:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Corsair Utility Engine
2015-06-16 02:58 - 2015-06-16 02:58 - 53900082 _____ C:\Users\Randaal\Desktop\Corsair-Utility-Engine-v1.7.106.zip
2015-06-16 02:31 - 2015-07-06 22:54 - 00000000 ____D C:\Windows\Minidump
2015-06-15 18:38 - 2015-06-15 18:38 - 00000000 ____D C:\Users\Randaal\Documents\Square Enix
2015-06-15 18:04 - 2015-06-15 18:04 - 00000000 ____D C:\Users\Randaal\AppData\Local\openvr
2015-06-15 09:29 - 2015-06-15 09:30 - 05127432 _____ (Piriform Ltd) C:\Users\Randaal\Desktop\spsetup128.exe
2015-06-13 18:52 - 2015-07-06 22:57 - 00000926 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-516098057-2350176401-1669302986-1000UA.job
2015-06-13 18:52 - 2015-07-06 19:08 - 00000874 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-516098057-2350176401-1669302986-1000Core.job
2015-06-13 18:52 - 2015-06-13 18:52 - 00003904 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-516098057-2350176401-1669302986-1000UA
2015-06-13 18:52 - 2015-06-13 18:52 - 00003508 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-516098057-2350176401-1669302986-1000Core
2015-06-13 18:52 - 2015-06-13 18:52 - 00000000 ____D C:\Users\Randaal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-06-13 18:52 - 2015-06-13 18:52 - 00000000 ____D C:\Users\Randaal\AppData\Local\Dropbox
2015-06-13 18:52 - 2015-06-13 18:52 - 00000000 ____D C:\ProgramData\Dropbox
2015-06-10 05:17 - 2015-06-01 21:16 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-06-10 05:17 - 2015-06-01 20:07 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-06-10 05:17 - 2015-05-27 16:35 - 24917504 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-06-10 05:17 - 2015-05-27 16:08 - 19607040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-06-10 05:17 - 2015-05-25 20:24 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-06-10 05:17 - 2015-05-25 20:23 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-06-10 05:17 - 2015-05-25 20:23 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-06-10 05:17 - 2015-05-25 20:21 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-06-10 05:17 - 2015-05-25 20:19 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-06-10 05:17 - 2015-05-25 20:19 - 01255424 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-06-10 05:17 - 2015-05-25 20:19 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-06-10 05:17 - 2015-05-25 20:19 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-06-10 05:17 - 2015-05-25 20:19 - 00728576 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-06-10 05:17 - 2015-05-25 20:19 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-06-10 05:17 - 2015-05-25 20:19 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-06-10 05:17 - 2015-05-25 20:19 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-06-10 05:17 - 2015-05-25 20:19 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-06-10 05:17 - 2015-05-25 20:19 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-06-10 05:17 - 2015-05-25 20:19 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-06-10 05:17 - 2015-05-25 20:19 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-06-10 05:17 - 2015-05-25 20:19 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-06-10 05:17 - 2015-05-25 20:19 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-06-10 05:17 - 2015-05-25 20:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-06-10 05:17 - 2015-05-25 20:19 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-06-10 05:17 - 2015-05-25 20:19 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-06-10 05:17 - 2015-05-25 20:19 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-06-10 05:17 - 2015-05-25 20:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-06-10 05:17 - 2015-05-25 20:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-06-10 05:17 - 2015-05-25 20:19 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-06-10 05:17 - 2015-05-25 20:19 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-06-10 05:17 - 2015-05-25 20:18 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-06-10 05:17 - 2015-05-25 20:18 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-06-10 05:17 - 2015-05-25 20:18 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-06-10 05:17 - 2015-05-25 20:18 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-06-10 05:17 - 2015-05-25 20:18 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-06-10 05:17 - 2015-05-25 20:18 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-06-10 05:17 - 2015-05-25 20:18 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-06-10 05:17 - 2015-05-25 20:18 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-06-10 05:17 - 2015-05-25 20:18 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-06-10 05:17 - 2015-05-25 20:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-06-10 05:17 - 2015-05-25 20:18 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-06-10 05:17 - 2015-05-25 20:18 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-06-10 05:17 - 2015-05-25 20:18 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-06-10 05:17 - 2015-05-25 20:14 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-06-10 05:17 - 2015-05-25 20:14 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-06-10 05:17 - 2015-05-25 20:11 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-06-10 05:17 - 2015-05-25 20:11 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-06-10 05:17 - 2015-05-25 20:11 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 20:11 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 20:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 20:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 20:07 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-06-10 05:17 - 2015-05-25 20:07 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-06-10 05:17 - 2015-05-25 20:04 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-06-10 05:17 - 2015-05-25 20:01 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-06-10 05:17 - 2015-05-25 20:01 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-06-10 05:17 - 2015-05-25 20:01 - 00551424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-06-10 05:17 - 2015-05-25 20:01 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-06-10 05:17 - 2015-05-25 20:01 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-06-10 05:17 - 2015-05-25 20:01 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-06-10 05:17 - 2015-05-25 20:01 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-06-10 05:17 - 2015-05-25 20:01 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-06-10 05:17 - 2015-05-25 20:01 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-06-10 05:17 - 2015-05-25 20:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-06-10 05:17 - 2015-05-25 20:01 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-06-10 05:17 - 2015-05-25 20:01 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-06-10 05:17 - 2015-05-25 20:01 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-06-10 05:17 - 2015-05-25 20:00 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-06-10 05:17 - 2015-05-25 20:00 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-06-10 05:17 - 2015-05-25 20:00 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-06-10 05:17 - 2015-05-25 20:00 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-06-10 05:17 - 2015-05-25 20:00 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-06-10 05:17 - 2015-05-25 20:00 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-06-10 05:17 - 2015-05-25 20:00 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-06-10 05:17 - 2015-05-25 19:59 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-06-10 05:17 - 2015-05-25 19:59 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-06-10 05:17 - 2015-05-25 19:59 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-06-10 05:17 - 2015-05-25 19:59 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-06-10 05:17 - 2015-05-25 19:57 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-06-10 05:17 - 2015-05-25 19:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-06-10 05:17 - 2015-05-25 19:55 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-06-10 05:17 - 2015-05-25 19:55 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-06-10 05:17 - 2015-05-25 19:55 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 19:08 - 03206144 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-06-10 05:17 - 2015-05-25 19:00 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-06-10 05:17 - 2015-05-25 18:50 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-06-10 05:17 - 2015-05-25 18:50 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-06-10 05:17 - 2015-05-25 18:48 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 18:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-06-10 05:17 - 2015-05-25 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-06-10 05:17 - 2015-05-23 05:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-06-10 05:17 - 2015-05-23 05:15 - 00503808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-06-10 05:17 - 2015-05-23 05:15 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-06-10 05:17 - 2015-05-23 05:15 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-06-10 05:17 - 2015-05-23 05:14 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-06-10 05:17 - 2015-05-23 05:13 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-06-10 05:17 - 2015-05-23 05:10 - 02278912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-06-10 05:17 - 2015-05-23 05:09 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-06-10 05:17 - 2015-05-23 05:08 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-06-10 05:17 - 2015-05-23 05:06 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-06-10 05:17 - 2015-05-23 05:05 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-06-10 05:17 - 2015-05-23 05:05 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-06-10 05:17 - 2015-05-23 05:04 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-06-10 05:17 - 2015-05-23 04:57 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-06-10 05:17 - 2015-05-23 04:52 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-06-10 05:17 - 2015-05-23 04:49 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-06-10 05:17 - 2015-05-23 04:48 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-06-10 05:17 - 2015-05-23 04:47 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-06-10 05:17 - 2015-05-23 04:47 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-06-10 05:17 - 2015-05-23 04:38 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-06-10 05:17 - 2015-05-23 04:37 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-06-10 05:17 - 2015-05-23 04:37 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-06-10 05:17 - 2015-05-23 04:28 - 12829696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-06-10 05:17 - 2015-05-23 04:20 - 01950720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-06-10 05:17 - 2015-05-23 04:16 - 01309696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-06-10 05:17 - 2015-05-23 04:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-06-10 05:17 - 2015-05-22 21:16 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-06-10 05:17 - 2015-05-22 21:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-06-10 05:17 - 2015-05-22 21:01 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-06-10 05:17 - 2015-05-22 21:00 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-06-10 05:17 - 2015-05-22 21:00 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-06-10 05:17 - 2015-05-22 21:00 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-06-10 05:17 - 2015-05-22 21:00 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-06-10 05:17 - 2015-05-22 20:59 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-06-10 05:17 - 2015-05-22 20:53 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-06-10 05:17 - 2015-05-22 20:52 - 06026240 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-06-10 05:17 - 2015-05-22 20:52 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-06-10 05:17 - 2015-05-22 20:48 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-06-10 05:17 - 2015-05-22 20:47 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-06-10 05:17 - 2015-05-22 20:47 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-06-10 05:17 - 2015-05-22 20:47 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-06-10 05:17 - 2015-05-22 20:47 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-06-10 05:17 - 2015-05-22 20:40 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-06-10 05:17 - 2015-05-22 20:36 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-06-10 05:17 - 2015-05-22 20:29 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-06-10 05:17 - 2015-05-22 20:25 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-06-10 05:17 - 2015-05-22 20:24 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-06-10 05:17 - 2015-05-22 20:21 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-06-10 05:17 - 2015-05-22 20:07 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-06-10 05:17 - 2015-05-22 20:06 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-06-10 05:17 - 2015-05-22 20:05 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-06-10 05:17 - 2015-05-22 20:05 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-06-10 05:17 - 2015-05-22 19:57 - 14404096 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-06-10 05:17 - 2015-05-22 19:50 - 02426880 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-06-10 05:17 - 2015-05-22 19:38 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-06-10 05:17 - 2015-05-22 19:26 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-06-10 05:17 - 2015-04-29 20:22 - 14635008 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-06-10 05:17 - 2015-04-29 20:21 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-06-10 05:17 - 2015-04-29 20:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-06-10 05:17 - 2015-04-29 20:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-06-10 05:17 - 2015-04-29 20:19 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-06-10 05:17 - 2015-04-29 20:07 - 11411456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-06-10 05:17 - 2015-04-29 20:07 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-06-10 05:17 - 2015-04-29 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-06-10 05:17 - 2015-04-29 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-06-10 05:17 - 2015-04-29 20:05 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-06-10 05:17 - 2015-04-24 20:17 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2015-06-10 05:17 - 2015-04-24 19:56 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2015-06-10 05:17 - 2015-04-11 05:19 - 00069888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\stream.sys
2015-06-06 01:31 - 2015-06-06 01:56 - 00000000 ____D C:\Users\Randaal\AppData\Local\Ori and the Blind Forest

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-06 22:58 - 2015-05-07 07:30 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-07-06 22:58 - 2015-05-07 07:30 - 00000000 ____D C:\Program Files\Microsoft Office
2015-07-06 22:58 - 2011-04-12 10:45 - 00000000 ____D C:\Windows\ShellNew
2015-07-06 22:58 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2015-07-06 22:57 - 2015-05-06 12:41 - 00000952 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-07-06 22:57 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\System
2015-07-06 22:57 - 2009-07-14 04:34 - 00000387 _____ C:\Windows\win.ini
2015-07-06 22:55 - 2015-05-15 02:23 - 00000000 ____D C:\Users\Randaal\AppData\Roaming\Skype
2015-07-06 22:54 - 2015-06-04 03:56 - 00000000 ____D C:\Users\Randaal\AppData\Local\CrashDumps
2015-07-06 22:54 - 2015-05-15 23:39 - 00000000 ____D C:\Users\Randaal\AppData\Roaming\TS3Client
2015-07-06 22:54 - 2015-05-06 08:19 - 00000000 ____D C:\Program Files (x86)\Steam
2015-07-06 22:49 - 2009-07-14 06:45 - 00022096 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-07-06 22:49 - 2009-07-14 06:45 - 00022096 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-07-06 22:46 - 2011-04-12 10:34 - 00669580 _____ C:\Windows\system32\perfh005.dat
2015-07-06 22:46 - 2011-04-12 10:34 - 00141738 _____ C:\Windows\system32\perfc005.dat
2015-07-06 22:46 - 2009-07-14 07:13 - 01586648 _____ C:\Windows\system32\PerfStringBackup.INI
2015-07-06 22:43 - 2015-05-06 08:06 - 01273751 ____N C:\Windows\WindowsUpdate.log
2015-07-06 22:40 - 2015-05-29 10:40 - 00000000 ____D C:\ProgramData\Origin
2015-07-06 22:40 - 2015-05-07 08:27 - 00000000 ____D C:\Users\Randaal\AppData\Roaming\Dropbox
2015-07-06 22:40 - 2015-05-06 12:41 - 00000948 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-07-06 22:40 - 2015-05-06 09:06 - 00000000 ____D C:\ProgramData\NVIDIA
2015-07-06 22:40 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-06 17:34 - 2015-05-15 23:04 - 00000000 ____D C:\Users\Randaal\AppData\Roaming\OBS
2015-07-06 04:37 - 2015-05-06 22:57 - 00000000 ____D C:\Users\Randaal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2015-07-05 01:14 - 2015-05-15 23:34 - 00000000 ____D C:\Users\Randaal\.chatty
2015-07-02 23:33 - 2015-05-15 14:02 - 00000000 ____D C:\Program Files (x86)\QuickTime
2015-06-30 08:21 - 2015-05-24 08:49 - 00000071 _____ C:\Users\Randaal\Documents\ClownfishForTeamspeak.ini
2015-06-30 02:37 - 2015-05-15 23:44 - 00000000 ____D C:\Users\Randaal\AppData\Local\Deployment
2015-06-30 02:36 - 2015-05-29 10:40 - 00000000 ____D C:\Program Files (x86)\Origin
2015-06-28 02:34 - 2015-05-07 00:10 - 00000000 ____D C:\Users\Randaal\Documents\My Games
2015-06-26 17:40 - 2015-05-07 07:46 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2015-06-26 17:40 - 2015-05-07 07:34 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2015-06-26 17:32 - 2015-05-07 07:36 - 00004008 _____ C:\Windows\system32\TeamViewer10_Hooks.log
2015-06-26 17:32 - 2015-05-07 07:34 - 00000971 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
2015-06-26 17:30 - 2015-05-07 07:46 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswsp.sys
2015-06-25 19:02 - 2009-07-14 07:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2015-06-24 23:21 - 2015-05-06 13:06 - 00000000 ____D C:\Users\Randaal\AppData\Roaming\Adobe
2015-06-24 11:33 - 2015-05-07 08:42 - 00000000 ____D C:\ProgramData\Adobe
2015-06-24 11:32 - 2015-05-07 08:42 - 00000000 ____D C:\Users\Randaal\AppData\Local\Adobe
2015-06-24 11:26 - 2015-05-29 14:31 - 00000000 __SHD C:\Users\Randaal\AppData\Local\EmieUserList
2015-06-24 11:26 - 2015-05-29 14:31 - 00000000 __SHD C:\Users\Randaal\AppData\Local\EmieSiteList
2015-06-24 11:26 - 2015-05-29 14:31 - 00000000 __SHD C:\Users\Randaal\AppData\Local\EmieBrowserModeList
2015-06-23 22:54 - 2015-05-15 23:04 - 00000000 ____D C:\Program Files\OBS
2015-06-23 21:29 - 2009-07-14 06:57 - 00001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-06-23 21:27 - 2015-05-15 14:03 - 00000000 ____D C:\Users\Public\CineForm
2015-06-23 12:40 - 2015-06-02 11:37 - 00000000 ____D C:\Users\Randaal\AppData\Roaming\FileZilla
2015-06-23 12:15 - 2015-06-02 11:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2015-06-23 12:15 - 2015-06-02 11:37 - 00000000 ____D C:\Program Files (x86)\FileZilla FTP Client
2015-06-23 10:29 - 2015-05-06 12:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2015-06-23 10:29 - 2015-05-06 09:05 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2015-06-23 10:28 - 2015-05-29 14:52 - 00000000 ____D C:\ProgramData\boost_interprocess
2015-06-22 14:19 - 2009-07-14 07:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-06-20 17:47 - 2015-05-07 07:48 - 00034511 _____ C:\Windows\system32\lvcoinst.log
2015-06-20 17:47 - 2015-05-07 07:47 - 00000000 ____D C:\Program Files\Common Files\logishrd
2015-06-18 21:34 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2015-06-17 11:10 - 2015-05-16 11:55 - 15866992 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2015-06-17 11:10 - 2015-05-06 12:53 - 17724600 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2015-06-17 11:10 - 2015-05-06 12:53 - 15224784 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2015-06-17 11:10 - 2015-05-06 12:53 - 12855416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2015-06-17 11:10 - 2015-05-06 12:53 - 03395648 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2015-06-17 11:10 - 2015-05-06 12:53 - 02997544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2015-06-17 11:10 - 2015-05-06 09:06 - 00112784 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2015-06-17 11:10 - 2015-05-06 09:06 - 00105288 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2015-06-17 11:10 - 2015-02-20 01:18 - 01567576 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll
2015-06-17 11:10 - 2015-02-20 01:18 - 00030966 _____ C:\Windows\system32\nvinfo.pb
2015-06-17 08:48 - 2015-05-06 09:06 - 06873232 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2015-06-17 08:48 - 2015-05-06 09:06 - 03492168 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2015-06-17 08:48 - 2015-05-06 09:06 - 02558792 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2015-06-17 08:48 - 2015-05-06 09:06 - 00937616 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2015-06-17 08:48 - 2015-05-06 09:06 - 00385168 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2015-06-17 08:48 - 2015-05-06 09:06 - 00062792 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2015-06-16 03:06 - 2015-05-06 13:14 - 00000000 ____D C:\Program Files (x86)\corsair
2015-06-16 01:21 - 2015-05-17 22:58 - 00000000 ____D C:\Users\Randaal\AppData\Local\RECentral
2015-06-16 01:14 - 2015-05-15 02:23 - 00000000 ____D C:\ProgramData\Skype
2015-06-15 18:38 - 2015-05-06 22:19 - 00000000 ____D C:\Users\Randaal\AppData\Roaming\NVIDIA
2015-06-15 09:30 - 2015-05-16 22:43 - 00000000 ____D C:\Program Files\Speccy
2015-06-11 03:53 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-06-11 03:28 - 2009-07-14 06:45 - 00433992 _____ C:\Windows\system32\FNTCACHE.DAT
2015-06-11 03:27 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-06-11 03:05 - 2015-05-06 08:46 - 00000000 ____D C:\Windows\system32\MRT
2015-06-11 03:01 - 2015-05-06 08:46 - 140135120 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-06-10 02:11 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\LiveKernelReports
2015-06-10 00:14 - 2015-05-06 08:18 - 00000000 ____D C:\ProgramData\Package Cache

==================== Files in the root of some directories =======

2015-05-17 13:41 - 2015-05-17 17:17 - 0001120 _____ () C:\Users\Randaal\AppData\Local\MRDownloader.nast
2015-05-06 22:14 - 2015-05-06 22:14 - 0000017 _____ () C:\Users\Randaal\AppData\Local\resmon.resmoncfg

Some files in TEMP:
====================
C:\Users\Randaal\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmptm1sun.dll
C:\Users\Randaal\AppData\Local\Temp\ose00000.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-07-03 12:37

==================== End of log ============================
Přílohy
FRST.rar
(29.42 KiB) Staženo 61 x
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: Podezření na malware v PC

#2 Příspěvek od vyosek »

Zdravim :)

Na logu se pracuje...
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
MarekH

Re: Podezření na malware v PC

#3 Příspěvek od MarekH »

Děkuji mnohokrát. Nevím, jestli mám zmiňovat nějaká konkrétní podezření, nebo je to prakticky jedno?
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: Podezření na malware v PC

#4 Příspěvek od vyosek »

By me jeste tak nejak zajimalo, proc jste si zalozil novy nick MarekH a nepokracoval ve svem puvodnim Randaal http://forum.viry.cz/memberlist.php?mod ... le&u=29167

Ze by to bylo kvuli tomu, ze na "starem" ucte jiz mate nekolik prohresku proti pravidlum fora?? :?:
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
MarekH

Re: Podezření na malware v PC

#5 Příspěvek od MarekH »

Nepamatoval jsem si heslo a email, na který jsem registraci vytvářel, již dlouho nepoužívám
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: Podezření na malware v PC

#6 Příspěvek od vyosek »

Tento novy ucet (MarekH) bude smazan z duvodu poruseni pravidel fora. Pri zapomenutem mailu(heslu) staci napsat administratorovi mail. Nyni poslete na MUJ mail heslo a email, jaky chcete priradit k uctu Randaal a bude provedena zmena.
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
MarekH

Re: Podezření na malware v PC

#7 Příspěvek od MarekH »

a kde najdu Váš email? Na stránce profilu jsem jej nenašel
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: Podezření na malware v PC

#8 Příspěvek od vyosek »

vyosek(leklaryba)forum.viry.cz
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: Podezření na malware v PC

#9 Příspěvek od vyosek »

:arrow: Zmena hesla a mailu dle dohody provedena. Pokracovani pod puvodnim uctem

:arrow: Stahnete OTL http://oldtimer.geekstogo.com/OTL.exe a ulozte jej na plochu
  • Pokud pouzivate Win Vista ci W7, kliknete na OTL pravym a dejte Run As Administrator ci Spustit jako spravce
  • Pokud pouzivate 64bitovy OS, zkontrolujte, zda-li je zaskrtnuty ctverecek u Pro 64 bitové OS, pokud ne, zaskrtnete jej
  • Zaskrtnete okenko Pro vsechny uzivatele
  • Zaskrtnete okenko Kontrola na havet "LOP"
  • Zaskrtnete okenko Kontrola na havet "Purity"
  • Stari souboru zmente z 30 dnu na 7 dnu
  • Do spodniho okenka Vlastni skenovani/opravy vlozte skript nize

  • Kód: Vybrat vše

    CREATERESTOREPOINT

netsvcs
drivers32
savembr:0

/md5start
atapi.sys
autochk.exe
cdrom.sys
explorer.exe
hal.dll
scecli.dll
services.exe
svchost.exe
tcpip.sys
userinit.exe
winlogon.exe
/md5stop

%systemroot%*.* /U /s
%SYSTEMDRIVE%\*.exe
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\system32\drivers\*.sys /3
%systemroot%\system32\*.* /3
%SYSTEMDRIVE%\*.exe

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s

%PROGRAMFILES%\Mozilla Firefox\firefox.exe /md5
%PROGRAMFILES%\Internet Explorer\iexplore.exe /md5
%PROGRAMFILES%\Opera\opera.exe /md5
%PROGRAMFILES%\Google\Chrome\Application\chrome.exe /md5

%SystemDrive%\PhysicalMBR.bin /md5 

*crack* /s
*keygen* /s
*loader* /s
  • Kliknete na tlacitko Prohledat
  • Po dokonceni skenu (cca 10 az 15 min) se objevi logy OTL.txt a Extras.txt, oba sem vlozte
  • Pokud budou logy dlouhe (forum bude kricet o prekroceni maximalniho poctu znaku), tak je rozdelte do vice prispevku
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Uživatelský avatar
Randaal
Návštěvník
Návštěvník
Příspěvky: 58
Registrován: 20 říj 2008 22:57
Bydliště: Praha

Re: Podezření na malware v PC

#10 Příspěvek od Randaal »

OTL.txt

OTL logfile created on: 07/07/2015 6:47:05 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Randaal\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.17843)
Locale: 00001009 | Country: Kanada | Language: ENC | Date Format: dd/MM/yyyy

31.87 Gb Total Physical Memory | 25.31 Gb Available Physical Memory | 79.41% Memory free
63.74 Gb Paging File | 57.18 Gb Available in Paging File | 89.71% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 447.04 Gb Total Space | 315.46 Gb Free Space | 70.57% Space Free | Partition Type: NTFS
Drive X: | 5588.91 Gb Total Space | 4113.46 Gb Free Space | 73.60% Space Free | Partition Type: NTFS

Computer Name: RANDAAL-PC | User Name: Randaal | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 7 Days

========== Processes (SafeList) ==========

PRC - [2015/07/07 18:44:16 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Randaal\Desktop\OTL.exe
PRC - [2015/06/30 02:35:59 | 003,632,112 | ---- | M] (Electronic Arts) -- C:\Program Files (x86)\Origin\Origin.exe
PRC - [2015/06/20 07:46:07 | 000,813,896 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
PRC - [2015/06/18 12:55:23 | 017,905,424 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\TeamViewer.exe
PRC - [2015/06/18 12:55:23 | 005,495,056 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
PRC - [2015/06/18 12:32:23 | 000,229,136 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\tv_w32.exe
PRC - [2015/06/17 08:03:11 | 000,410,768 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2015/06/12 09:25:00 | 000,082,112 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2015/06/10 22:36:06 | 043,871,584 | ---- | M] (Dropbox, Inc.) -- C:\Users\Randaal\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2015/06/03 23:06:12 | 002,754,704 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
PRC - [2015/06/03 23:06:06 | 001,893,008 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
PRC - [2015/05/29 14:17:04 | 000,075,136 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2015/05/22 18:17:04 | 011,753,792 | ---- | M] (Corsair Components, Inc.) -- C:\Program Files (x86)\corsair\Corsair Utility Engine\CorsairHID.exe
PRC - [2015/05/20 09:59:12 | 003,207,680 | ---- | M] (GoPro) -- C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe
PRC - [2015/05/15 01:57:38 | 005,515,496 | ---- | M] (Avast Software s.r.o.) -- C:\Program Files\AVAST Software\Avast\avastui.exe
PRC - [2015/05/07 07:46:19 | 000,343,336 | ---- | M] (Avast Software s.r.o.) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2015/03/30 15:29:02 | 003,978,600 | ---- | M] (LogMeIn Inc.) -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
PRC - [2015/01/09 19:11:46 | 002,366,736 | ---- | M] (M-Audio) -- C:\Program Files (x86)\M-Audio\M-Track Plus\AudioDevMon.exe
PRC - [2014/07/17 18:31:42 | 000,153,344 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\Bluetooth Headset Helper.exe
PRC - [2014/06/27 05:31:26 | 000,292,848 | R--- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
PRC - [2014/05/28 10:10:36 | 000,287,592 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2014/05/28 10:10:36 | 000,016,232 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2014/04/24 08:29:24 | 001,360,016 | R--- | M] () -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.22\AsSysCtrlService.exe
PRC - [2014/01/28 05:16:06 | 000,936,728 | ---- | M] () -- C:\Program Files (x86)\ASUS\AXSP\1.02.00\atkexComSvc.exe
PRC - [2013/12/13 04:47:56 | 000,085,600 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\Winamp\winampa.exe
PRC - [2013/12/09 15:12:56 | 001,449,984 | ---- | M] (JimsApps) -- C:\Program Files (x86)\Snaz\Snaz.exe
PRC - [2013/08/01 18:07:58 | 004,245,504 | ---- | M] (TP-LINK) -- C:\Program Files (x86)\TP-LINK\USB Printer Controller\USB Printer Controller.exe
PRC - [2013/05/09 19:38:40 | 000,355,840 | ---- | M] (AVerMedia) -- C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRECentral.exe
PRC - [2012/09/13 00:38:44 | 000,204,136 | ---- | M] (Logitech Inc.) -- C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe
PRC - [2012/09/13 00:38:20 | 000,264,040 | ---- | M] () -- C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
PRC - [2006/12/11 12:13:44 | 000,730,664 | ---- | M] (OCCAM Financial Technology) -- C:\Program Files (x86)\VeNCrypt-0.2.6\vencviewer.exe


========== Modules (No Company Name) ==========

MOD - [2015/07/06 22:40:34 | 000,043,008 | ---- | M] () -- c:\Users\Randaal\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmptm1sun.dll
MOD - [2015/06/30 02:35:58 | 001,007,104 | ---- | M] () -- C:\Program Files (x86)\Origin\platforms\qwindows.dll
MOD - [2015/06/30 02:35:58 | 000,228,352 | ---- | M] () -- C:\Program Files (x86)\Origin\mediaservice\wmfengine.dll
MOD - [2015/06/30 02:35:57 | 000,337,408 | ---- | M] () -- C:\Program Files (x86)\Origin\imageformats\qtiff.dll
MOD - [2015/06/30 02:35:57 | 000,261,120 | ---- | M] () -- C:\Program Files (x86)\Origin\imageformats\qmng.dll
MOD - [2015/06/30 02:35:57 | 000,216,576 | ---- | M] () -- C:\Program Files (x86)\Origin\imageformats\qjpeg.dll
MOD - [2015/06/30 02:35:57 | 000,024,576 | ---- | M] () -- C:\Program Files (x86)\Origin\imageformats\qico.dll
MOD - [2015/06/30 02:35:57 | 000,023,552 | ---- | M] () -- C:\Program Files (x86)\Origin\imageformats\qgif.dll
MOD - [2015/06/30 02:35:57 | 000,019,456 | ---- | M] () -- C:\Program Files (x86)\Origin\imageformats\qtga.dll
MOD - [2015/06/30 02:35:57 | 000,018,944 | ---- | M] () -- C:\Program Files (x86)\Origin\imageformats\qwbmp.dll
MOD - [2015/06/20 07:46:04 | 001,281,864 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.130\libglesv2.dll
MOD - [2015/06/20 07:46:04 | 000,080,712 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.130\libegl.dll
MOD - [2015/06/03 23:06:11 | 000,011,920 | ---- | M] () -- C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
MOD - [2015/06/02 17:18:32 | 000,039,384 | ---- | M] () -- C:\Program Files (x86)\FileZilla FTP Client\fzshellext.dll
MOD - [2015/05/22 18:08:30 | 000,091,136 | ---- | M] () -- C:\Program Files (x86)\corsair\Corsair Utility Engine\LuaQtWrapperLibrary.dll
MOD - [2015/05/22 18:06:50 | 000,224,256 | ---- | M] () -- C:\Program Files (x86)\corsair\Corsair Utility Engine\quazip.dll
MOD - [2015/05/22 18:06:02 | 000,200,704 | ---- | M] () -- C:\Program Files (x86)\corsair\Corsair Utility Engine\lua52.dll
MOD - [2015/05/20 09:59:12 | 002,291,712 | ---- | M] () -- C:\Program Files (x86)\GoPro\Tools\Importer\gopro-lib-win-analytics.dll
MOD - [2015/05/15 10:01:54 | 010,069,504 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\d18e2115a3270f89663fce831547f534\System.ni.dll
MOD - [2015/05/15 10:01:16 | 000,118,272 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\93a0883923e78cc3e80b7ac4a9768c60\SMDiagnostics.ni.dll
MOD - [2015/05/15 10:00:39 | 000,798,720 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runt73a1fc9d#\f504b5348a87122eeabdec67d806148b\System.Runtime.Remoting.ni.dll
MOD - [2015/05/15 08:57:01 | 000,424,448 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Serv30e99c02#\e21f0e40e718941800c576b4ec924ba1\System.ServiceModel.Channels.ni.dll
MOD - [2015/05/15 08:56:26 | 000,026,624 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.IO.Cf61e09c5#\f808d12ffc9805d7e0825aac8d313cea\System.IO.Compression.FileSystem.ni.dll
MOD - [2015/05/15 08:56:25 | 000,168,448 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.IO.Cb3b124c8#\8d27288c0f3bb839ca1b3d29d9f17a34\System.IO.Compression.ni.dll
MOD - [2015/05/15 08:55:27 | 003,049,472 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\5eff995181b42a1570dc04a8ce7ae3bb\System.IdentityModel.ni.dll
MOD - [2015/05/15 08:55:19 | 019,734,528 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\23d2a4873fd11baa6849cdf02bf6ca05\System.ServiceModel.ni.dll
MOD - [2015/05/15 08:55:10 | 001,123,328 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Servf73e6522#\169f36cb6725f4ac6c47ee988d1f7510\System.ServiceModel.Web.ni.dll
MOD - [2015/05/15 08:53:47 | 000,023,040 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio84a6349c#\bcf03f74d961156c0b9d597b36890f3c\PresentationFramework-SystemCore.ni.dll
MOD - [2015/05/15 08:36:07 | 001,873,920 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\1196cc375887ce75f134047505fe19bf\System.Xaml.ni.dll
MOD - [2015/05/15 08:35:59 | 001,172,992 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\a48bd2a02ed1ae2fbb79ef8797f0c5f6\System.Management.ni.dll
MOD - [2015/05/15 08:35:33 | 012,897,280 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\a0b4e6b92d9c147d801a6f2e3a15080b\System.Windows.Forms.ni.dll
MOD - [2015/05/15 08:35:29 | 002,855,424 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\187177229c00aec6dec613ea4b9ff209\System.Runtime.Serialization.ni.dll
MOD - [2015/05/15 08:35:28 | 001,642,496 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\dd2f9ea99ac0f984b9dc430824638c9f\System.Drawing.ni.dll
MOD - [2015/05/15 08:35:28 | 000,790,528 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Servd1dec626#\14cc73701aac461eb89d6473a88fcd56\System.ServiceModel.Internals.ni.dll
MOD - [2015/05/15 08:35:05 | 018,761,216 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\b61f493e1736be80e7af377a94eb15a1\PresentationFramework.ni.dll
MOD - [2015/05/15 08:34:59 | 000,458,240 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio1c9175f8#\5e3e26e6c81809aab854ea76a884fde2\PresentationFramework.Aero.ni.dll
MOD - [2015/05/15 08:34:57 | 011,013,632 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\f00c65c9573cb88dfd42ae7634bd88e1\PresentationCore.ni.dll
MOD - [2015/05/15 08:34:52 | 003,945,472 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\1fb19af0c16ab00c017781f582e324bf\WindowsBase.ni.dll
MOD - [2015/05/15 08:34:42 | 007,793,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\3d6ee4ffbd9a86ac1e7b01800b6fe9c7\System.Xml.ni.dll
MOD - [2015/05/15 08:34:40 | 000,972,288 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\93729611cd078029e0000b18ee38f506\System.Configuration.ni.dll
MOD - [2015/05/15 08:34:39 | 007,002,624 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\02a4633b5f85cdbec8e14a51bdb028f9\System.Core.ni.dll
MOD - [2015/05/15 08:34:27 | 017,207,296 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\d1265d6159ea876f9d63ea4c1361b587\mscorlib.ni.dll
MOD - [2015/05/07 07:46:19 | 040,540,672 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\libcef.dll
MOD - [2015/05/07 07:46:19 | 000,104,400 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\log.dll
MOD - [2015/05/07 07:46:19 | 000,081,728 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
MOD - [2015/03/19 09:15:28 | 000,865,280 | ---- | M] () -- C:\Users\Randaal\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
MOD - [2015/03/19 09:15:28 | 000,750,080 | ---- | M] () -- C:\Users\Randaal\AppData\Roaming\Dropbox\bin\libGLESv2.dll
MOD - [2015/03/19 09:15:28 | 000,726,016 | ---- | M] () -- C:\Users\Randaal\AppData\Roaming\Dropbox\bin\QtQuick\Controls\qtquickcontrolsplugin.dll
MOD - [2015/03/19 09:15:28 | 000,200,704 | ---- | M] () -- C:\Users\Randaal\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
MOD - [2015/03/19 09:15:28 | 000,047,616 | ---- | M] () -- C:\Users\Randaal\AppData\Roaming\Dropbox\bin\libEGL.dll
MOD - [2015/03/19 09:15:28 | 000,010,240 | ---- | M] () -- C:\Users\Randaal\AppData\Roaming\Dropbox\bin\QtQuick\Window.2\windowplugin.dll
MOD - [2015/03/19 09:15:28 | 000,010,240 | ---- | M] () -- C:\Users\Randaal\AppData\Roaming\Dropbox\bin\QtQuick.2\qtquick2plugin.dll
MOD - [2012/09/13 00:39:18 | 000,336,232 | ---- | M] () -- C:\Program Files (x86)\Common Files\LogiShrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll
MOD - [2012/09/13 00:38:52 | 007,955,304 | ---- | M] () -- C:\Program Files (x86)\Logitech\LWS\Webcam Software\QTGui4.dll
MOD - [2012/09/13 00:38:52 | 000,341,352 | ---- | M] () -- C:\Program Files (x86)\Logitech\LWS\Webcam Software\QTXml4.dll
MOD - [2012/09/13 00:38:52 | 000,127,336 | ---- | M] () -- C:\Program Files (x86)\Logitech\LWS\Webcam Software\ImageFormats\QJpeg4.dll
MOD - [2012/09/13 00:38:52 | 000,028,008 | ---- | M] () -- C:\Program Files (x86)\Logitech\LWS\Webcam Software\ImageFormats\QGif4.dll
MOD - [2012/09/13 00:38:44 | 002,144,104 | ---- | M] () -- C:\Program Files (x86)\Logitech\LWS\Webcam Software\QTCore4.dll
MOD - [2012/09/13 00:38:20 | 000,264,040 | ---- | M] () -- C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe


========== Services (SafeList) ==========

SRV:64bit: - [2015/06/04 02:26:08 | 000,076,152 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\PnkBstrA.exe -- (PnkBstrA)
SRV:64bit: - [2015/06/03 23:06:06 | 001,152,656 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe -- (GfExperienceService)
SRV:64bit: - [2015/06/03 23:06:03 | 023,007,376 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe -- (NvStreamSvc)
SRV:64bit: - [2015/05/25 20:19:13 | 001,255,424 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\diagtrack.dll -- (DiagTrack)
SRV:64bit: - [2015/05/22 20:47:34 | 000,114,688 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)
SRV:64bit: - [2015/05/07 07:46:19 | 000,343,336 | ---- | M] (Avast Software s.r.o.) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV:64bit: - [2014/07/17 18:29:50 | 001,008,384 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
SRV:64bit: - [2014/05/28 10:10:36 | 000,016,232 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV:64bit: - [2014/03/11 16:31:58 | 000,260,360 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Windows\SysNative\IPROSetMonitor.exe -- (Intel(R)
SRV:64bit: - [2013/05/27 07:50:47 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/07/14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2015/07/04 23:31:43 | 000,235,744 | ---- | M] (EasyAntiCheat Ltd) [On_Demand | Stopped] -- C:\Windows\SysWOW64\EasyAntiCheat.exe -- (EasyAntiCheat)
SRV - [2015/06/30 02:35:59 | 002,004,488 | ---- | M] (Electronic Arts) [On_Demand | Stopped] -- C:\Program Files (x86)\Origin\OriginClientService.exe -- (Origin Client Service)
SRV - [2015/06/24 11:29:20 | 000,268,976 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2015/06/18 12:55:23 | 005,495,056 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe -- (TeamViewer)
SRV - [2015/06/17 08:03:11 | 000,410,768 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2015/06/12 09:25:00 | 000,082,112 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2015/06/04 20:56:54 | 000,837,312 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2015/06/03 23:06:06 | 001,893,008 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe -- (NvNetworkService)
SRV - [2015/05/29 14:17:04 | 000,075,136 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2015/03/30 15:29:00 | 002,490,216 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2015/03/30 15:25:28 | 000,417,552 | ---- | M] (LogMeIn, Inc.) [Auto | Running] -- C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe -- (LMIGuardianSvc)
SRV - [2015/02/18 19:11:32 | 000,315,488 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2015/01/09 19:11:46 | 002,366,736 | ---- | M] (M-Audio) [Auto | Running] -- C:\Program Files (x86)\M-Audio\M-Track Plus\AudioDevMon.exe -- (MTrackPlusAudioDevMon)
SRV - [2014/04/24 08:29:24 | 001,360,016 | R--- | M] () [Auto | Running] -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.22\AsSysCtrlService.exe -- (AsSysCtrlService)
SRV - [2014/04/11 23:08:08 | 000,103,608 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2014/03/21 00:49:18 | 000,067,224 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2014/01/28 05:16:06 | 000,936,728 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\ASUS\AXSP\1.02.00\atkexComSvc.exe -- (asComSvc)
SRV - [2013/05/09 19:38:40 | 000,355,840 | ---- | M] (AVerMedia) [Auto | Running] -- C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRECentral.exe -- (AVerRECentral)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2015/06/26 17:30:43 | 000,442,264 | ---- | M] (Avast Software s.r.o.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswsp.sys -- (aswSP)
DRV:64bit: - [2015/06/17 11:10:27 | 000,204,648 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2015/06/03 23:06:03 | 000,019,600 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys -- (NvStreamKms)
DRV:64bit: - [2015/05/19 05:29:01 | 000,046,768 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvvad64v.sys -- (nvvad_WaveExtensible)
DRV:64bit: - [2015/05/18 15:10:04 | 000,047,840 | ---- | M] (Corsair) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CorsairVBusDriver.sys -- (CorsairVBusDriver)
DRV:64bit: - [2015/05/18 15:10:04 | 000,021,728 | ---- | M] (Corsair) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CorsairVHidDriver.sys -- (CorsairVHidDriver)
DRV:64bit: - [2015/05/07 07:46:19 | 000,272,248 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswVmm.sys -- (aswVmm)
DRV:64bit: - [2015/05/07 07:46:19 | 000,137,288 | ---- | M] (Avast Software s.r.o.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\aswStm.sys -- (aswStm)
DRV:64bit: - [2015/05/07 07:46:19 | 000,093,528 | ---- | M] (Avast Software s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr)
DRV:64bit: - [2015/05/07 07:46:19 | 000,089,944 | ---- | M] (Avast Software s.r.o.) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:64bit: - [2015/05/07 07:46:19 | 000,065,736 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswRvrt.sys -- (aswRvrt)
DRV:64bit: - [2015/05/07 07:46:19 | 000,029,168 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\aswHwid.sys -- (aswHwid)
DRV:64bit: - [2015/05/07 07:46:18 | 001,047,320 | ---- | M] (Avast Software s.r.o.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx)
DRV:64bit: - [2015/03/30 15:25:00 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)
DRV:64bit: - [2015/01/09 19:11:44 | 000,530,192 | ---- | M] (M-Audio) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\MAudioMTrackPlus.sys -- (MTRACKPLUS)
DRV:64bit: - [2014/09/30 17:47:28 | 000,129,312 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\TeeDriverx64.sys -- (MEIx64)
DRV:64bit: - [2014/07/17 23:04:32 | 000,599,288 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwampfl.sys -- (btwampfl)
DRV:64bit: - [2014/07/16 18:15:52 | 007,765,240 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)
DRV:64bit: - [2014/06/27 05:30:50 | 000,020,464 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iusb3hcs.sys -- (iusb3hcs)
DRV:64bit: - [2014/06/27 05:30:46 | 000,795,120 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iusb3xhc.sys -- (iusb3xhc)
DRV:64bit: - [2014/06/27 05:30:46 | 000,383,472 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iusb3hub.sys -- (iusb3hub)
DRV:64bit: - [2014/05/28 10:10:20 | 000,672,104 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStorA.sys -- (iaStorA)
DRV:64bit: - [2014/05/28 10:10:20 | 000,028,008 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStorF.sys -- (iaStorF)
DRV:64bit: - [2014/03/26 09:49:46 | 000,077,600 | ---- | M] (Asmedia Technology) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\asstor64.sys -- (asstor64)
DRV:64bit: - [2014/03/14 05:23:30 | 000,487,704 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1d62x64.sys -- (e1dexpress)
DRV:64bit: - [2013/10/02 04:22:20 | 000,056,832 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2013/10/01 20:05:40 | 000,172,760 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\bcbtums.sys -- (bcbtums)
DRV:64bit: - [2013/07/25 15:26:54 | 000,113,888 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tplinkUDSMBus.sys -- (TPLINKUDSMBus)
DRV:64bit: - [2013/07/25 15:26:48 | 000,193,248 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tplinkUDSTcpBus.sys -- (tplinkUDSTcpBus)
DRV:64bit: - [2013/06/05 03:39:28 | 001,503,744 | ---- | M] (AVerMedia TECHNOLOGIES, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AVer330.sys -- (AVer330)
DRV:64bit: - [2013/05/30 18:16:40 | 000,064,280 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGSHidFilt.Sys -- (LGSHidFilt)
DRV:64bit: - [2012/09/21 21:04:22 | 004,763,680 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\lvuvc64.sys -- (LVUVC64)
DRV:64bit: - [2012/09/21 21:04:22 | 000,351,520 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\lvrs64.sys -- (LVRS64)
DRV:64bit: - [2012/08/23 16:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2012/08/23 16:08:26 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2012/07/31 10:45:10 | 000,038,992 | ---- | M] (Screaming Bee LLC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ScreamingBAudio64.sys -- (ScreamBAudioSvc)
DRV:64bit: - [2012/05/01 21:48:28 | 000,184,144 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio)
DRV:64bit: - [2012/03/06 02:59:42 | 000,210,984 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt)
DRV:64bit: - [2012/03/06 02:59:40 | 000,021,544 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid)
DRV:64bit: - [2012/03/01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011/09/17 16:08:52 | 000,039,976 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap)
DRV:64bit: - [2011/03/11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010/11/21 05:23:48 | 000,071,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc)
DRV:64bit: - [2010/11/21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009/11/24 02:38:00 | 000,016,008 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGVirHid.sys -- (LGVirHid)
DRV:64bit: - [2009/11/24 02:37:50 | 000,022,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGBusEnum.sys -- (LGBusEnum)
DRV:64bit: - [2009/07/14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/06/10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2009/07/14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-516098057-2350176401-1669302986-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-516098057-2350176401-1669302986-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTer ... ORM=IESR02
IE - HKU\S-1-5-21-516098057-2350176401-1669302986-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF:64bit: - HKLM\Software\MozillaPlugins\@esn/npbattlelog,version=2.7.0: C:\Program Files (x86)\Battlelog Web Plugins\2.7.0\npbattlelogx64.dll (EA Digital Illusions CE AB)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=11.45.2: C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=11.45.2: C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@esn/npbattlelog,version=2.7.0: C:\Program Files (x86)\Battlelog Web Plugins\2.7.0\npbattlelog.dll (EA Digital Illusions CE AB)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2015/05/07 07:46:20 | 000,000,000 | ---D | M]


========== Chrome ==========

CHR - Extension: No name found = C:\Users\Randaal\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajopnjidmegmdimjlfnijceegpefgped\6.6_0\
CHR - Extension: No name found = C:\Users\Randaal\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\
CHR - Extension: No name found = C:\Users\Randaal\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmedhionkhpnakcndndgjdbohmhepckk\2.28_0\
CHR - Extension: No name found = C:\Users\Randaal\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\
CHR - Extension: No name found = C:\Users\Randaal\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck\10.2.0.190_0\
CHR - Extension: No name found = C:\Users\Randaal\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki\10.2.0.190_0\
CHR - Extension: No name found = C:\Users\Randaal\AppData\Local\Google\Chrome\User Data\Default\Extensions\iiljidcefnbhbpamageahhblhbbhhopm\0.91_0\
CHR - Extension: No name found = C:\Users\Randaal\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.1.0_0\
CHR - Extension: No name found = C:\Users\Randaal\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\

O1 HOSTS File: ([2009/06/10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (Avast Software s.r.o.)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (Avast Software s.r.o.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4:64bit: - HKLM..\Run: [IAStorIcon] C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [NvBackend] C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [ShadowPlay] C:\Windows\SysNative\nvspcap64.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AvastUI.exe] C:\Program Files\AVAST Software\Avast\AvastUI.exe (Avast Software s.r.o.)
O4 - HKLM..\Run: [Corsair Utility Engine] C:\Program Files (x86)\Corsair\Corsair Utility Engine\CorsairHID.exe (Corsair Components, Inc.)
O4 - HKLM..\Run: [GoPro Studio Importer] C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe (GoPro)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [LWS] C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - HKLM..\Run: [TP-LINK USB Printer Controller] C:\Program Files (x86)\TP-LINK\USB Printer Controller\USB Printer Controller.exe (TP-LINK)
O4 - HKLM..\Run: [USB3MON] C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Intel Corporation)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-516098057-2350176401-1669302986-1000..\Run: [CCleaner Monitoring] C:\Program Files\CCleaner\CCleaner64.exe (Piriform Ltd)
O4 - HKU\S-1-5-21-516098057-2350176401-1669302986-1000..\Run: [Dropbox Update] C:\Users\Randaal\AppData\Local\Dropbox\Update\DropboxUpdate.exe (Dropbox, Inc.)
O4 - HKU\S-1-5-21-516098057-2350176401-1669302986-1000..\Run: [EADM] C:\Program Files (x86)\Origin\Origin.exe (Electronic Arts)
O4 - HKU\S-1-5-21-516098057-2350176401-1669302986-1000..\Run: [GoogleChromeAutoLaunch_41382869C0F1E7842E76A758AD89BD5F] C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
O4 - HKU\S-1-5-21-516098057-2350176401-1669302986-1000..\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Randaal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Randaal\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SoftwareSASGeneration = 1
O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~1\Office15\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~1\Office15\ONBttnIE.dll/105 File not found
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKU\.DEFAULT\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: sony.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: sony.com ([]* in Trusted sites)
O15 - HKU\S-1-5-19\..Trusted Domains: clonewarsadventures.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: freerealms.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: soe.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: sony.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: clonewarsadventures.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: freerealms.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: soe.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: sony.com ([]* in )
O15 - HKU\S-1-5-21-516098057-2350176401-1669302986-1000\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-516098057-2350176401-1669302986-1000\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-516098057-2350176401-1669302986-1000\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-516098057-2350176401-1669302986-1000\..Trusted Domains: sony.com ([]* in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinsta ... s-i586.cab (Java Plug-in 10.0.0)
O16 - DPF: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinsta ... s-i586.cab (Java Plug-in 1.7.0)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinsta ... s-i586.cab (Java Plug-in 1.7.0)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{193C4257-9EBA-4C3D-8296-FDBD7CE69F2E}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{30D51955-0623-4371-9AED-04903074CE8D}: DhcpNameServer = 192.168.0.1
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{91843ce1-0607-11e5-be03-10c37ba0c3b2}\Shell - "" = AutoRun
O33 - MountPoints2\{91843ce1-0607-11e5-be03-10c37ba0c3b2}\Shell\AutoRun\command - "" = E:\HTC_Sync_Manager_PC.exe
O33 - MountPoints2\D\Shell - "" = AutoRun
O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\HTC_Sync_Manager_PC.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32:64bit: msacm.vorbis - vorbis.acm (HMS http://hp.vector.co.jp/authors/VA012897/)
Drivers32:64bit: VIDC.CFHD - CFHD.dll (CineForm Inc.)
Drivers32:64bit: vidc.i420 - lvcod64.dll (Logitech Inc.)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.vorbis - C:\Windows\SysWow64\vorbis.acm (HMS http://hp.vector.co.jp/authors/VA012897/)
Drivers32: VIDC.CFHD - C:\Windows\SysWow64\CFHD.dll (CineForm Inc.)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.i420 - C:\Windows\SysWow64\lvcodec2.dll (Logitech Inc.)
PhysicalDisk0 MBR saved to C:\PhysicalMBR.bin

========== Files/Folders - Created Within 7 Days ==========

[2015/07/07 18:44:13 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Randaal\Desktop\OTL.exe
[2015/07/06 23:05:26 | 000,000,000 | ---D | C] -- C:\FRST
[2015/07/06 22:57:25 | 002,112,512 | ---- | C] (Farbar) -- C:\Users\Randaal\Desktop\FRST64.exe
[2015/07/06 22:56:39 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2015/07/06 22:35:47 | 000,000,000 | ---D | C] -- C:\Users\Randaal\AppData\Roaming\112b48
[2015/07/06 22:35:36 | 001,897,768 | ---- | C] (Adobe Systems Incorporated) -- C:\Users\Randaal\Desktop\flashplayer18_ha_install.exe
[2015/07/05 23:37:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BS.Player
[2015/07/05 23:37:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Webteh
[2015/07/05 23:37:23 | 000,000,000 | ---D | C] -- C:\Users\Randaal\AppData\Roaming\BSplayer Pro
[2015/07/05 23:37:23 | 000,000,000 | ---D | C] -- C:\Users\Randaal\AppData\Roaming\BSplayer
[2015/07/05 17:30:10 | 000,235,744 | ---- | C] (EasyAntiCheat Ltd) -- C:\Windows\SysWow64\EasyAntiCheat.exe
[2015/07/05 17:29:25 | 000,000,000 | ---D | C] -- C:\Users\Randaal\AppData\Roaming\Day 1 Studios
[2015/07/05 17:28:08 | 000,000,000 | ---D | C] -- C:\Users\Randaal\AppData\Local\Daedalic Entertainment GmbH
[2015/07/05 17:27:48 | 000,544,656 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\deployJava1.dll
[2015/07/05 17:27:48 | 000,214,408 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2015/07/05 17:27:48 | 000,173,960 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2015/07/05 17:27:48 | 000,173,960 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2015/07/05 17:27:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2015/07/04 10:00:00 | 000,891,904 | ---- | C] (Microsoft) -- C:\Users\Randaal\Desktop\Matchmaking Server Picker.exe
[2015/07/03 05:36:29 | 000,000,000 | ---D | C] -- C:\Users\Randaal\AppData\Roaming\TownOfSalem
[2015/07/02 23:33:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2015/07/02 23:33:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2015/07/01 04:32:14 | 000,000,000 | ---D | C] -- C:\Users\Randaal\AppData\Local\squishy
[2015/07/01 03:20:07 | 000,000,000 | ---D | C] -- C:\Users\Randaal\AppData\Local\BridgeProject

========== Files - Modified Within 7 Days ==========

[2015/07/07 18:50:01 | 000,000,512 | ---- | M] () -- C:\PhysicalMBR.bin
[2015/07/07 18:44:16 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Randaal\Desktop\OTL.exe
[2015/07/07 18:35:00 | 000,000,914 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2015/07/07 17:57:44 | 000,000,952 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2015/07/07 17:57:33 | 000,000,926 | ---- | M] () -- C:\Windows\tasks\DropboxUpdateTaskUserS-1-5-21-516098057-2350176401-1669302986-1000UA.job
[2015/07/07 09:23:01 | 000,022,096 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2015/07/07 09:23:01 | 000,022,096 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2015/07/06 23:10:16 | 000,030,122 | ---- | M] () -- C:\Users\Randaal\Desktop\FRST.rar
[2015/07/06 22:57:26 | 002,112,512 | ---- | M] (Farbar) -- C:\Users\Randaal\Desktop\FRST64.exe
[2015/07/06 22:46:22 | 001,586,648 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2015/07/06 22:46:22 | 000,669,580 | ---- | M] () -- C:\Windows\SysNative\perfh005.dat
[2015/07/06 22:46:22 | 000,654,968 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2015/07/06 22:46:22 | 000,141,738 | ---- | M] () -- C:\Windows\SysNative\perfc005.dat
[2015/07/06 22:46:22 | 000,122,338 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2015/07/06 22:40:14 | 000,000,948 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2015/07/06 22:40:10 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2015/07/06 22:40:07 | 4192,321,531 | -HS- | M] () -- C:\hiberfil.sys
[2015/07/06 22:35:43 | 001,897,768 | ---- | M] (Adobe Systems Incorporated) -- C:\Users\Randaal\Desktop\flashplayer18_ha_install.exe
[2015/07/06 19:08:02 | 000,000,874 | ---- | M] () -- C:\Windows\tasks\DropboxUpdateTaskUserS-1-5-21-516098057-2350176401-1669302986-1000Core.job
[2015/07/05 23:37:33 | 000,001,122 | ---- | M] () -- C:\Users\Public\Desktop\BS.Player FREE.lnk
[2015/07/05 23:35:34 | 010,554,352 | ---- | M] () -- C:\Users\Randaal\Desktop\bsplayer269-1079.exe
[2015/07/05 17:27:45 | 000,544,656 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\deployJava1.dll
[2015/07/05 17:27:45 | 000,214,408 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2015/07/05 17:27:45 | 000,173,960 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2015/07/05 17:27:45 | 000,173,960 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2015/07/04 23:31:43 | 000,235,744 | ---- | M] (EasyAntiCheat Ltd) -- C:\Windows\SysWow64\EasyAntiCheat.exe
[2015/07/04 09:59:38 | 000,432,287 | ---- | M] () -- C:\Users\Randaal\Desktop\matchmaking_server_picker_2_7.zip

========== Files Created - No Company Name ==========

[2015/07/07 18:50:01 | 000,000,512 | ---- | C] () -- C:\PhysicalMBR.bin
[2015/07/06 23:10:16 | 000,030,122 | ---- | C] () -- C:\Users\Randaal\Desktop\FRST.rar
[2015/07/05 23:37:33 | 000,001,122 | ---- | C] () -- C:\Users\Public\Desktop\BS.Player FREE.lnk
[2015/07/05 23:35:26 | 010,554,352 | ---- | C] () -- C:\Users\Randaal\Desktop\bsplayer269-1079.exe
[2015/07/04 09:59:35 | 000,432,287 | ---- | C] () -- C:\Users\Randaal\Desktop\matchmaking_server_picker_2_7.zip
[2015/06/23 10:28:04 | 037,748,880 | ---- | C] () -- C:\Windows\SysWow64\nvcompiler.dll
[2015/05/29 11:57:40 | 000,226,680 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2015/05/29 11:57:39 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2015/05/17 13:41:48 | 000,001,120 | ---- | C] () -- C:\Users\Randaal\AppData\Local\MRDownloader.nast
[2015/05/06 22:14:20 | 000,000,017 | ---- | C] () -- C:\Users\Randaal\AppData\Local\resmon.resmoncfg
[2015/05/06 13:14:42 | 001,199,831 | ---- | C] () -- C:\Windows\unins000.exe
[2015/05/06 13:14:42 | 000,008,543 | ---- | C] () -- C:\Windows\unins000.dat
[2015/05/06 12:50:54 | 001,561,362 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2015/05/06 12:46:41 | 000,015,232 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsIO.sys
[2015/05/06 08:09:00 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini
[2015/05/06 08:08:54 | 000,054,155 | ---- | C] () -- C:\Windows\Ascd_tmp.ini

========== ZeroAccess Check ==========

[2009/07/14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2015/02/13 07:22:33 | 014,177,280 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2015/02/13 07:26:18 | 012,875,264 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2015/05/30 10:27:13 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\.minecraft
[2015/07/06 22:36:48 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\112b48
[2015/05/20 14:02:27 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\AnkhHeart
[2015/05/07 08:27:42 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\AVAST Software
[2015/07/05 23:38:21 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\BSplayer
[2015/07/05 23:37:23 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\BSplayer Pro
[2015/05/06 18:59:35 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\Corsair
[2015/07/05 17:29:25 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\Day 1 Studios
[2015/07/06 22:40:41 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\Dropbox
[2015/06/23 12:40:22 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\FileZilla
[2015/05/15 14:06:40 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\GoPro
[2015/05/26 00:35:19 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\Image-Line
[2015/05/18 20:40:02 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\java
[2015/05/07 07:50:58 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\Leadertech
[2015/05/29 14:18:29 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\Need for Speed World
[2015/07/07 13:19:15 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\OBS
[2015/06/03 16:39:36 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\Origin
[2015/05/29 14:17:02 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\PunkBuster
[2015/05/16 12:09:19 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\Scooter Software
[2015/05/18 06:14:36 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\Screaming Bee
[2015/05/22 15:53:26 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\Shooter
[2015/05/19 14:27:47 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\TeamViewer
[2015/07/03 05:36:29 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\TownOfSalem
[2015/05/31 10:43:40 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\Trine1
[2015/07/06 22:54:35 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\TS3Client
[2015/06/23 21:05:59 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\uTorrent

========== Purity Check ==========



========== Custom Scans ==========

< >
[2009/07/14 07:08:49 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT
[2009/07/14 07:08:49 | 000,014,920 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2015/05/06 12:41:12 | 000,000,948 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
[2015/05/06 12:41:13 | 000,000,952 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
[2015/06/13 18:52:13 | 000,000,874 | ---- | C] () -- C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-516098057-2350176401-1669302986-1000Core.job
[2015/06/13 18:52:14 | 000,000,926 | ---- | C] () -- C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-516098057-2350176401-1669302986-1000UA.job
[2015/06/24 11:29:21 | 000,000,914 | ---- | C] () -- C:\Windows\Tasks\Adobe Flash Player Updater.job

< End of report >
Nahoru
Uživatelský avatar
Randaal
Návštěvník
Návštěvník
Příspěvky: 58
Registrován: 20 říj 2008 22:57
Bydliště: Praha

Re: Podezření na malware v PC

#11 Příspěvek od Randaal »

OTL.txt

OTL logfile created on: 07/07/2015 6:47:05 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Randaal\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.17843)
Locale: 00001009 | Country: Kanada | Language: ENC | Date Format: dd/MM/yyyy

31.87 Gb Total Physical Memory | 25.31 Gb Available Physical Memory | 79.41% Memory free
63.74 Gb Paging File | 57.18 Gb Available in Paging File | 89.71% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 447.04 Gb Total Space | 315.46 Gb Free Space | 70.57% Space Free | Partition Type: NTFS
Drive X: | 5588.91 Gb Total Space | 4113.46 Gb Free Space | 73.60% Space Free | Partition Type: NTFS

Computer Name: RANDAAL-PC | User Name: Randaal | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 7 Days

========== Processes (SafeList) ==========

PRC - [2015/07/07 18:44:16 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Randaal\Desktop\OTL.exe
PRC - [2015/06/30 02:35:59 | 003,632,112 | ---- | M] (Electronic Arts) -- C:\Program Files (x86)\Origin\Origin.exe
PRC - [2015/06/20 07:46:07 | 000,813,896 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
PRC - [2015/06/18 12:55:23 | 017,905,424 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\TeamViewer.exe
PRC - [2015/06/18 12:55:23 | 005,495,056 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
PRC - [2015/06/18 12:32:23 | 000,229,136 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\tv_w32.exe
PRC - [2015/06/17 08:03:11 | 000,410,768 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2015/06/12 09:25:00 | 000,082,112 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2015/06/10 22:36:06 | 043,871,584 | ---- | M] (Dropbox, Inc.) -- C:\Users\Randaal\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2015/06/03 23:06:12 | 002,754,704 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
PRC - [2015/06/03 23:06:06 | 001,893,008 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
PRC - [2015/05/29 14:17:04 | 000,075,136 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2015/05/22 18:17:04 | 011,753,792 | ---- | M] (Corsair Components, Inc.) -- C:\Program Files (x86)\corsair\Corsair Utility Engine\CorsairHID.exe
PRC - [2015/05/20 09:59:12 | 003,207,680 | ---- | M] (GoPro) -- C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe
PRC - [2015/05/15 01:57:38 | 005,515,496 | ---- | M] (Avast Software s.r.o.) -- C:\Program Files\AVAST Software\Avast\avastui.exe
PRC - [2015/05/07 07:46:19 | 000,343,336 | ---- | M] (Avast Software s.r.o.) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2015/03/30 15:29:02 | 003,978,600 | ---- | M] (LogMeIn Inc.) -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
PRC - [2015/01/09 19:11:46 | 002,366,736 | ---- | M] (M-Audio) -- C:\Program Files (x86)\M-Audio\M-Track Plus\AudioDevMon.exe
PRC - [2014/07/17 18:31:42 | 000,153,344 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\Bluetooth Headset Helper.exe
PRC - [2014/06/27 05:31:26 | 000,292,848 | R--- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
PRC - [2014/05/28 10:10:36 | 000,287,592 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2014/05/28 10:10:36 | 000,016,232 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2014/04/24 08:29:24 | 001,360,016 | R--- | M] () -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.22\AsSysCtrlService.exe
PRC - [2014/01/28 05:16:06 | 000,936,728 | ---- | M] () -- C:\Program Files (x86)\ASUS\AXSP\1.02.00\atkexComSvc.exe
PRC - [2013/12/13 04:47:56 | 000,085,600 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\Winamp\winampa.exe
PRC - [2013/12/09 15:12:56 | 001,449,984 | ---- | M] (JimsApps) -- C:\Program Files (x86)\Snaz\Snaz.exe
PRC - [2013/08/01 18:07:58 | 004,245,504 | ---- | M] (TP-LINK) -- C:\Program Files (x86)\TP-LINK\USB Printer Controller\USB Printer Controller.exe
PRC - [2013/05/09 19:38:40 | 000,355,840 | ---- | M] (AVerMedia) -- C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRECentral.exe
PRC - [2012/09/13 00:38:44 | 000,204,136 | ---- | M] (Logitech Inc.) -- C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe
PRC - [2012/09/13 00:38:20 | 000,264,040 | ---- | M] () -- C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
PRC - [2006/12/11 12:13:44 | 000,730,664 | ---- | M] (OCCAM Financial Technology) -- C:\Program Files (x86)\VeNCrypt-0.2.6\vencviewer.exe


========== Modules (No Company Name) ==========

MOD - [2015/07/06 22:40:34 | 000,043,008 | ---- | M] () -- c:\Users\Randaal\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmptm1sun.dll
MOD - [2015/06/30 02:35:58 | 001,007,104 | ---- | M] () -- C:\Program Files (x86)\Origin\platforms\qwindows.dll
MOD - [2015/06/30 02:35:58 | 000,228,352 | ---- | M] () -- C:\Program Files (x86)\Origin\mediaservice\wmfengine.dll
MOD - [2015/06/30 02:35:57 | 000,337,408 | ---- | M] () -- C:\Program Files (x86)\Origin\imageformats\qtiff.dll
MOD - [2015/06/30 02:35:57 | 000,261,120 | ---- | M] () -- C:\Program Files (x86)\Origin\imageformats\qmng.dll
MOD - [2015/06/30 02:35:57 | 000,216,576 | ---- | M] () -- C:\Program Files (x86)\Origin\imageformats\qjpeg.dll
MOD - [2015/06/30 02:35:57 | 000,024,576 | ---- | M] () -- C:\Program Files (x86)\Origin\imageformats\qico.dll
MOD - [2015/06/30 02:35:57 | 000,023,552 | ---- | M] () -- C:\Program Files (x86)\Origin\imageformats\qgif.dll
MOD - [2015/06/30 02:35:57 | 000,019,456 | ---- | M] () -- C:\Program Files (x86)\Origin\imageformats\qtga.dll
MOD - [2015/06/30 02:35:57 | 000,018,944 | ---- | M] () -- C:\Program Files (x86)\Origin\imageformats\qwbmp.dll
MOD - [2015/06/20 07:46:04 | 001,281,864 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.130\libglesv2.dll
MOD - [2015/06/20 07:46:04 | 000,080,712 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.130\libegl.dll
MOD - [2015/06/03 23:06:11 | 000,011,920 | ---- | M] () -- C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
MOD - [2015/06/02 17:18:32 | 000,039,384 | ---- | M] () -- C:\Program Files (x86)\FileZilla FTP Client\fzshellext.dll
MOD - [2015/05/22 18:08:30 | 000,091,136 | ---- | M] () -- C:\Program Files (x86)\corsair\Corsair Utility Engine\LuaQtWrapperLibrary.dll
MOD - [2015/05/22 18:06:50 | 000,224,256 | ---- | M] () -- C:\Program Files (x86)\corsair\Corsair Utility Engine\quazip.dll
MOD - [2015/05/22 18:06:02 | 000,200,704 | ---- | M] () -- C:\Program Files (x86)\corsair\Corsair Utility Engine\lua52.dll
MOD - [2015/05/20 09:59:12 | 002,291,712 | ---- | M] () -- C:\Program Files (x86)\GoPro\Tools\Importer\gopro-lib-win-analytics.dll
MOD - [2015/05/15 10:01:54 | 010,069,504 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\d18e2115a3270f89663fce831547f534\System.ni.dll
MOD - [2015/05/15 10:01:16 | 000,118,272 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\93a0883923e78cc3e80b7ac4a9768c60\SMDiagnostics.ni.dll
MOD - [2015/05/15 10:00:39 | 000,798,720 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runt73a1fc9d#\f504b5348a87122eeabdec67d806148b\System.Runtime.Remoting.ni.dll
MOD - [2015/05/15 08:57:01 | 000,424,448 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Serv30e99c02#\e21f0e40e718941800c576b4ec924ba1\System.ServiceModel.Channels.ni.dll
MOD - [2015/05/15 08:56:26 | 000,026,624 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.IO.Cf61e09c5#\f808d12ffc9805d7e0825aac8d313cea\System.IO.Compression.FileSystem.ni.dll
MOD - [2015/05/15 08:56:25 | 000,168,448 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.IO.Cb3b124c8#\8d27288c0f3bb839ca1b3d29d9f17a34\System.IO.Compression.ni.dll
MOD - [2015/05/15 08:55:27 | 003,049,472 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\5eff995181b42a1570dc04a8ce7ae3bb\System.IdentityModel.ni.dll
MOD - [2015/05/15 08:55:19 | 019,734,528 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\23d2a4873fd11baa6849cdf02bf6ca05\System.ServiceModel.ni.dll
MOD - [2015/05/15 08:55:10 | 001,123,328 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Servf73e6522#\169f36cb6725f4ac6c47ee988d1f7510\System.ServiceModel.Web.ni.dll
MOD - [2015/05/15 08:53:47 | 000,023,040 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio84a6349c#\bcf03f74d961156c0b9d597b36890f3c\PresentationFramework-SystemCore.ni.dll
MOD - [2015/05/15 08:36:07 | 001,873,920 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\1196cc375887ce75f134047505fe19bf\System.Xaml.ni.dll
MOD - [2015/05/15 08:35:59 | 001,172,992 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\a48bd2a02ed1ae2fbb79ef8797f0c5f6\System.Management.ni.dll
MOD - [2015/05/15 08:35:33 | 012,897,280 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\a0b4e6b92d9c147d801a6f2e3a15080b\System.Windows.Forms.ni.dll
MOD - [2015/05/15 08:35:29 | 002,855,424 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\187177229c00aec6dec613ea4b9ff209\System.Runtime.Serialization.ni.dll
MOD - [2015/05/15 08:35:28 | 001,642,496 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\dd2f9ea99ac0f984b9dc430824638c9f\System.Drawing.ni.dll
MOD - [2015/05/15 08:35:28 | 000,790,528 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Servd1dec626#\14cc73701aac461eb89d6473a88fcd56\System.ServiceModel.Internals.ni.dll
MOD - [2015/05/15 08:35:05 | 018,761,216 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\b61f493e1736be80e7af377a94eb15a1\PresentationFramework.ni.dll
MOD - [2015/05/15 08:34:59 | 000,458,240 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio1c9175f8#\5e3e26e6c81809aab854ea76a884fde2\PresentationFramework.Aero.ni.dll
MOD - [2015/05/15 08:34:57 | 011,013,632 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\f00c65c9573cb88dfd42ae7634bd88e1\PresentationCore.ni.dll
MOD - [2015/05/15 08:34:52 | 003,945,472 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\1fb19af0c16ab00c017781f582e324bf\WindowsBase.ni.dll
MOD - [2015/05/15 08:34:42 | 007,793,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\3d6ee4ffbd9a86ac1e7b01800b6fe9c7\System.Xml.ni.dll
MOD - [2015/05/15 08:34:40 | 000,972,288 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\93729611cd078029e0000b18ee38f506\System.Configuration.ni.dll
MOD - [2015/05/15 08:34:39 | 007,002,624 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\02a4633b5f85cdbec8e14a51bdb028f9\System.Core.ni.dll
MOD - [2015/05/15 08:34:27 | 017,207,296 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\d1265d6159ea876f9d63ea4c1361b587\mscorlib.ni.dll
MOD - [2015/05/07 07:46:19 | 040,540,672 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\libcef.dll
MOD - [2015/05/07 07:46:19 | 000,104,400 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\log.dll
MOD - [2015/05/07 07:46:19 | 000,081,728 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
MOD - [2015/03/19 09:15:28 | 000,865,280 | ---- | M] () -- C:\Users\Randaal\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
MOD - [2015/03/19 09:15:28 | 000,750,080 | ---- | M] () -- C:\Users\Randaal\AppData\Roaming\Dropbox\bin\libGLESv2.dll
MOD - [2015/03/19 09:15:28 | 000,726,016 | ---- | M] () -- C:\Users\Randaal\AppData\Roaming\Dropbox\bin\QtQuick\Controls\qtquickcontrolsplugin.dll
MOD - [2015/03/19 09:15:28 | 000,200,704 | ---- | M] () -- C:\Users\Randaal\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
MOD - [2015/03/19 09:15:28 | 000,047,616 | ---- | M] () -- C:\Users\Randaal\AppData\Roaming\Dropbox\bin\libEGL.dll
MOD - [2015/03/19 09:15:28 | 000,010,240 | ---- | M] () -- C:\Users\Randaal\AppData\Roaming\Dropbox\bin\QtQuick\Window.2\windowplugin.dll
MOD - [2015/03/19 09:15:28 | 000,010,240 | ---- | M] () -- C:\Users\Randaal\AppData\Roaming\Dropbox\bin\QtQuick.2\qtquick2plugin.dll
MOD - [2012/09/13 00:39:18 | 000,336,232 | ---- | M] () -- C:\Program Files (x86)\Common Files\LogiShrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll
MOD - [2012/09/13 00:38:52 | 007,955,304 | ---- | M] () -- C:\Program Files (x86)\Logitech\LWS\Webcam Software\QTGui4.dll
MOD - [2012/09/13 00:38:52 | 000,341,352 | ---- | M] () -- C:\Program Files (x86)\Logitech\LWS\Webcam Software\QTXml4.dll
MOD - [2012/09/13 00:38:52 | 000,127,336 | ---- | M] () -- C:\Program Files (x86)\Logitech\LWS\Webcam Software\ImageFormats\QJpeg4.dll
MOD - [2012/09/13 00:38:52 | 000,028,008 | ---- | M] () -- C:\Program Files (x86)\Logitech\LWS\Webcam Software\ImageFormats\QGif4.dll
MOD - [2012/09/13 00:38:44 | 002,144,104 | ---- | M] () -- C:\Program Files (x86)\Logitech\LWS\Webcam Software\QTCore4.dll
MOD - [2012/09/13 00:38:20 | 000,264,040 | ---- | M] () -- C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe


========== Services (SafeList) ==========

SRV:64bit: - [2015/06/04 02:26:08 | 000,076,152 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\PnkBstrA.exe -- (PnkBstrA)
SRV:64bit: - [2015/06/03 23:06:06 | 001,152,656 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe -- (GfExperienceService)
SRV:64bit: - [2015/06/03 23:06:03 | 023,007,376 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe -- (NvStreamSvc)
SRV:64bit: - [2015/05/25 20:19:13 | 001,255,424 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\diagtrack.dll -- (DiagTrack)
SRV:64bit: - [2015/05/22 20:47:34 | 000,114,688 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)
SRV:64bit: - [2015/05/07 07:46:19 | 000,343,336 | ---- | M] (Avast Software s.r.o.) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV:64bit: - [2014/07/17 18:29:50 | 001,008,384 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
SRV:64bit: - [2014/05/28 10:10:36 | 000,016,232 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV:64bit: - [2014/03/11 16:31:58 | 000,260,360 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Windows\SysNative\IPROSetMonitor.exe -- (Intel(R)
SRV:64bit: - [2013/05/27 07:50:47 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/07/14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2015/07/04 23:31:43 | 000,235,744 | ---- | M] (EasyAntiCheat Ltd) [On_Demand | Stopped] -- C:\Windows\SysWOW64\EasyAntiCheat.exe -- (EasyAntiCheat)
SRV - [2015/06/30 02:35:59 | 002,004,488 | ---- | M] (Electronic Arts) [On_Demand | Stopped] -- C:\Program Files (x86)\Origin\OriginClientService.exe -- (Origin Client Service)
SRV - [2015/06/24 11:29:20 | 000,268,976 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2015/06/18 12:55:23 | 005,495,056 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe -- (TeamViewer)
SRV - [2015/06/17 08:03:11 | 000,410,768 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2015/06/12 09:25:00 | 000,082,112 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2015/06/04 20:56:54 | 000,837,312 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2015/06/03 23:06:06 | 001,893,008 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe -- (NvNetworkService)
SRV - [2015/05/29 14:17:04 | 000,075,136 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2015/03/30 15:29:00 | 002,490,216 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2015/03/30 15:25:28 | 000,417,552 | ---- | M] (LogMeIn, Inc.) [Auto | Running] -- C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe -- (LMIGuardianSvc)
SRV - [2015/02/18 19:11:32 | 000,315,488 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2015/01/09 19:11:46 | 002,366,736 | ---- | M] (M-Audio) [Auto | Running] -- C:\Program Files (x86)\M-Audio\M-Track Plus\AudioDevMon.exe -- (MTrackPlusAudioDevMon)
SRV - [2014/04/24 08:29:24 | 001,360,016 | R--- | M] () [Auto | Running] -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.22\AsSysCtrlService.exe -- (AsSysCtrlService)
SRV - [2014/04/11 23:08:08 | 000,103,608 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2014/03/21 00:49:18 | 000,067,224 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2014/01/28 05:16:06 | 000,936,728 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\ASUS\AXSP\1.02.00\atkexComSvc.exe -- (asComSvc)
SRV - [2013/05/09 19:38:40 | 000,355,840 | ---- | M] (AVerMedia) [Auto | Running] -- C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRECentral.exe -- (AVerRECentral)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2015/06/26 17:30:43 | 000,442,264 | ---- | M] (Avast Software s.r.o.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswsp.sys -- (aswSP)
DRV:64bit: - [2015/06/17 11:10:27 | 000,204,648 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2015/06/03 23:06:03 | 000,019,600 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys -- (NvStreamKms)
DRV:64bit: - [2015/05/19 05:29:01 | 000,046,768 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvvad64v.sys -- (nvvad_WaveExtensible)
DRV:64bit: - [2015/05/18 15:10:04 | 000,047,840 | ---- | M] (Corsair) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CorsairVBusDriver.sys -- (CorsairVBusDriver)
DRV:64bit: - [2015/05/18 15:10:04 | 000,021,728 | ---- | M] (Corsair) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CorsairVHidDriver.sys -- (CorsairVHidDriver)
DRV:64bit: - [2015/05/07 07:46:19 | 000,272,248 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswVmm.sys -- (aswVmm)
DRV:64bit: - [2015/05/07 07:46:19 | 000,137,288 | ---- | M] (Avast Software s.r.o.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\aswStm.sys -- (aswStm)
DRV:64bit: - [2015/05/07 07:46:19 | 000,093,528 | ---- | M] (Avast Software s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr)
DRV:64bit: - [2015/05/07 07:46:19 | 000,089,944 | ---- | M] (Avast Software s.r.o.) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:64bit: - [2015/05/07 07:46:19 | 000,065,736 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswRvrt.sys -- (aswRvrt)
DRV:64bit: - [2015/05/07 07:46:19 | 000,029,168 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\aswHwid.sys -- (aswHwid)
DRV:64bit: - [2015/05/07 07:46:18 | 001,047,320 | ---- | M] (Avast Software s.r.o.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx)
DRV:64bit: - [2015/03/30 15:25:00 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)
DRV:64bit: - [2015/01/09 19:11:44 | 000,530,192 | ---- | M] (M-Audio) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\MAudioMTrackPlus.sys -- (MTRACKPLUS)
DRV:64bit: - [2014/09/30 17:47:28 | 000,129,312 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\TeeDriverx64.sys -- (MEIx64)
DRV:64bit: - [2014/07/17 23:04:32 | 000,599,288 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwampfl.sys -- (btwampfl)
DRV:64bit: - [2014/07/16 18:15:52 | 007,765,240 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)
DRV:64bit: - [2014/06/27 05:30:50 | 000,020,464 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iusb3hcs.sys -- (iusb3hcs)
DRV:64bit: - [2014/06/27 05:30:46 | 000,795,120 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iusb3xhc.sys -- (iusb3xhc)
DRV:64bit: - [2014/06/27 05:30:46 | 000,383,472 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iusb3hub.sys -- (iusb3hub)
DRV:64bit: - [2014/05/28 10:10:20 | 000,672,104 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStorA.sys -- (iaStorA)
DRV:64bit: - [2014/05/28 10:10:20 | 000,028,008 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStorF.sys -- (iaStorF)
DRV:64bit: - [2014/03/26 09:49:46 | 000,077,600 | ---- | M] (Asmedia Technology) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\asstor64.sys -- (asstor64)
DRV:64bit: - [2014/03/14 05:23:30 | 000,487,704 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1d62x64.sys -- (e1dexpress)
DRV:64bit: - [2013/10/02 04:22:20 | 000,056,832 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2013/10/01 20:05:40 | 000,172,760 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\bcbtums.sys -- (bcbtums)
DRV:64bit: - [2013/07/25 15:26:54 | 000,113,888 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tplinkUDSMBus.sys -- (TPLINKUDSMBus)
DRV:64bit: - [2013/07/25 15:26:48 | 000,193,248 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tplinkUDSTcpBus.sys -- (tplinkUDSTcpBus)
DRV:64bit: - [2013/06/05 03:39:28 | 001,503,744 | ---- | M] (AVerMedia TECHNOLOGIES, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AVer330.sys -- (AVer330)
DRV:64bit: - [2013/05/30 18:16:40 | 000,064,280 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGSHidFilt.Sys -- (LGSHidFilt)
DRV:64bit: - [2012/09/21 21:04:22 | 004,763,680 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\lvuvc64.sys -- (LVUVC64)
DRV:64bit: - [2012/09/21 21:04:22 | 000,351,520 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\lvrs64.sys -- (LVRS64)
DRV:64bit: - [2012/08/23 16:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2012/08/23 16:08:26 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2012/07/31 10:45:10 | 000,038,992 | ---- | M] (Screaming Bee LLC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ScreamingBAudio64.sys -- (ScreamBAudioSvc)
DRV:64bit: - [2012/05/01 21:48:28 | 000,184,144 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio)
DRV:64bit: - [2012/03/06 02:59:42 | 000,210,984 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt)
DRV:64bit: - [2012/03/06 02:59:40 | 000,021,544 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid)
DRV:64bit: - [2012/03/01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011/09/17 16:08:52 | 000,039,976 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap)
DRV:64bit: - [2011/03/11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010/11/21 05:23:48 | 000,071,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc)
DRV:64bit: - [2010/11/21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009/11/24 02:38:00 | 000,016,008 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGVirHid.sys -- (LGVirHid)
DRV:64bit: - [2009/11/24 02:37:50 | 000,022,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGBusEnum.sys -- (LGBusEnum)
DRV:64bit: - [2009/07/14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/06/10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2009/07/14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-516098057-2350176401-1669302986-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-516098057-2350176401-1669302986-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTer ... ORM=IESR02
IE - HKU\S-1-5-21-516098057-2350176401-1669302986-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF:64bit: - HKLM\Software\MozillaPlugins\@esn/npbattlelog,version=2.7.0: C:\Program Files (x86)\Battlelog Web Plugins\2.7.0\npbattlelogx64.dll (EA Digital Illusions CE AB)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=11.45.2: C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=11.45.2: C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@esn/npbattlelog,version=2.7.0: C:\Program Files (x86)\Battlelog Web Plugins\2.7.0\npbattlelog.dll (EA Digital Illusions CE AB)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2015/05/07 07:46:20 | 000,000,000 | ---D | M]


========== Chrome ==========

CHR - Extension: No name found = C:\Users\Randaal\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajopnjidmegmdimjlfnijceegpefgped\6.6_0\
CHR - Extension: No name found = C:\Users\Randaal\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\
CHR - Extension: No name found = C:\Users\Randaal\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmedhionkhpnakcndndgjdbohmhepckk\2.28_0\
CHR - Extension: No name found = C:\Users\Randaal\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\
CHR - Extension: No name found = C:\Users\Randaal\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck\10.2.0.190_0\
CHR - Extension: No name found = C:\Users\Randaal\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki\10.2.0.190_0\
CHR - Extension: No name found = C:\Users\Randaal\AppData\Local\Google\Chrome\User Data\Default\Extensions\iiljidcefnbhbpamageahhblhbbhhopm\0.91_0\
CHR - Extension: No name found = C:\Users\Randaal\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.1.0_0\
CHR - Extension: No name found = C:\Users\Randaal\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\

O1 HOSTS File: ([2009/06/10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (Avast Software s.r.o.)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (Avast Software s.r.o.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4:64bit: - HKLM..\Run: [IAStorIcon] C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [NvBackend] C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [ShadowPlay] C:\Windows\SysNative\nvspcap64.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AvastUI.exe] C:\Program Files\AVAST Software\Avast\AvastUI.exe (Avast Software s.r.o.)
O4 - HKLM..\Run: [Corsair Utility Engine] C:\Program Files (x86)\Corsair\Corsair Utility Engine\CorsairHID.exe (Corsair Components, Inc.)
O4 - HKLM..\Run: [GoPro Studio Importer] C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe (GoPro)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [LWS] C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - HKLM..\Run: [TP-LINK USB Printer Controller] C:\Program Files (x86)\TP-LINK\USB Printer Controller\USB Printer Controller.exe (TP-LINK)
O4 - HKLM..\Run: [USB3MON] C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Intel Corporation)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-516098057-2350176401-1669302986-1000..\Run: [CCleaner Monitoring] C:\Program Files\CCleaner\CCleaner64.exe (Piriform Ltd)
O4 - HKU\S-1-5-21-516098057-2350176401-1669302986-1000..\Run: [Dropbox Update] C:\Users\Randaal\AppData\Local\Dropbox\Update\DropboxUpdate.exe (Dropbox, Inc.)
O4 - HKU\S-1-5-21-516098057-2350176401-1669302986-1000..\Run: [EADM] C:\Program Files (x86)\Origin\Origin.exe (Electronic Arts)
O4 - HKU\S-1-5-21-516098057-2350176401-1669302986-1000..\Run: [GoogleChromeAutoLaunch_41382869C0F1E7842E76A758AD89BD5F] C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
O4 - HKU\S-1-5-21-516098057-2350176401-1669302986-1000..\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Randaal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Randaal\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SoftwareSASGeneration = 1
O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~1\Office15\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~1\Office15\ONBttnIE.dll/105 File not found
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKU\.DEFAULT\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: sony.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: sony.com ([]* in Trusted sites)
O15 - HKU\S-1-5-19\..Trusted Domains: clonewarsadventures.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: freerealms.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: soe.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: sony.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: clonewarsadventures.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: freerealms.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: soe.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: sony.com ([]* in )
O15 - HKU\S-1-5-21-516098057-2350176401-1669302986-1000\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-516098057-2350176401-1669302986-1000\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-516098057-2350176401-1669302986-1000\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-516098057-2350176401-1669302986-1000\..Trusted Domains: sony.com ([]* in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinsta ... s-i586.cab (Java Plug-in 10.0.0)
O16 - DPF: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinsta ... s-i586.cab (Java Plug-in 1.7.0)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinsta ... s-i586.cab (Java Plug-in 1.7.0)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{193C4257-9EBA-4C3D-8296-FDBD7CE69F2E}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{30D51955-0623-4371-9AED-04903074CE8D}: DhcpNameServer = 192.168.0.1
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{91843ce1-0607-11e5-be03-10c37ba0c3b2}\Shell - "" = AutoRun
O33 - MountPoints2\{91843ce1-0607-11e5-be03-10c37ba0c3b2}\Shell\AutoRun\command - "" = E:\HTC_Sync_Manager_PC.exe
O33 - MountPoints2\D\Shell - "" = AutoRun
O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\HTC_Sync_Manager_PC.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32:64bit: msacm.vorbis - vorbis.acm (HMS http://hp.vector.co.jp/authors/VA012897/)
Drivers32:64bit: VIDC.CFHD - CFHD.dll (CineForm Inc.)
Drivers32:64bit: vidc.i420 - lvcod64.dll (Logitech Inc.)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.vorbis - C:\Windows\SysWow64\vorbis.acm (HMS http://hp.vector.co.jp/authors/VA012897/)
Drivers32: VIDC.CFHD - C:\Windows\SysWow64\CFHD.dll (CineForm Inc.)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.i420 - C:\Windows\SysWow64\lvcodec2.dll (Logitech Inc.)
PhysicalDisk0 MBR saved to C:\PhysicalMBR.bin

========== Files/Folders - Created Within 7 Days ==========

[2015/07/07 18:44:13 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Randaal\Desktop\OTL.exe
[2015/07/06 23:05:26 | 000,000,000 | ---D | C] -- C:\FRST
[2015/07/06 22:57:25 | 002,112,512 | ---- | C] (Farbar) -- C:\Users\Randaal\Desktop\FRST64.exe
[2015/07/06 22:56:39 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2015/07/06 22:35:47 | 000,000,000 | ---D | C] -- C:\Users\Randaal\AppData\Roaming\112b48
[2015/07/06 22:35:36 | 001,897,768 | ---- | C] (Adobe Systems Incorporated) -- C:\Users\Randaal\Desktop\flashplayer18_ha_install.exe
[2015/07/05 23:37:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BS.Player
[2015/07/05 23:37:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Webteh
[2015/07/05 23:37:23 | 000,000,000 | ---D | C] -- C:\Users\Randaal\AppData\Roaming\BSplayer Pro
[2015/07/05 23:37:23 | 000,000,000 | ---D | C] -- C:\Users\Randaal\AppData\Roaming\BSplayer
[2015/07/05 17:30:10 | 000,235,744 | ---- | C] (EasyAntiCheat Ltd) -- C:\Windows\SysWow64\EasyAntiCheat.exe
[2015/07/05 17:29:25 | 000,000,000 | ---D | C] -- C:\Users\Randaal\AppData\Roaming\Day 1 Studios
[2015/07/05 17:28:08 | 000,000,000 | ---D | C] -- C:\Users\Randaal\AppData\Local\Daedalic Entertainment GmbH
[2015/07/05 17:27:48 | 000,544,656 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\deployJava1.dll
[2015/07/05 17:27:48 | 000,214,408 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2015/07/05 17:27:48 | 000,173,960 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2015/07/05 17:27:48 | 000,173,960 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2015/07/05 17:27:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2015/07/04 10:00:00 | 000,891,904 | ---- | C] (Microsoft) -- C:\Users\Randaal\Desktop\Matchmaking Server Picker.exe
[2015/07/03 05:36:29 | 000,000,000 | ---D | C] -- C:\Users\Randaal\AppData\Roaming\TownOfSalem
[2015/07/02 23:33:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2015/07/02 23:33:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2015/07/01 04:32:14 | 000,000,000 | ---D | C] -- C:\Users\Randaal\AppData\Local\squishy
[2015/07/01 03:20:07 | 000,000,000 | ---D | C] -- C:\Users\Randaal\AppData\Local\BridgeProject

========== Files - Modified Within 7 Days ==========

[2015/07/07 18:50:01 | 000,000,512 | ---- | M] () -- C:\PhysicalMBR.bin
[2015/07/07 18:44:16 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Randaal\Desktop\OTL.exe
[2015/07/07 18:35:00 | 000,000,914 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2015/07/07 17:57:44 | 000,000,952 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2015/07/07 17:57:33 | 000,000,926 | ---- | M] () -- C:\Windows\tasks\DropboxUpdateTaskUserS-1-5-21-516098057-2350176401-1669302986-1000UA.job
[2015/07/07 09:23:01 | 000,022,096 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2015/07/07 09:23:01 | 000,022,096 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2015/07/06 23:10:16 | 000,030,122 | ---- | M] () -- C:\Users\Randaal\Desktop\FRST.rar
[2015/07/06 22:57:26 | 002,112,512 | ---- | M] (Farbar) -- C:\Users\Randaal\Desktop\FRST64.exe
[2015/07/06 22:46:22 | 001,586,648 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2015/07/06 22:46:22 | 000,669,580 | ---- | M] () -- C:\Windows\SysNative\perfh005.dat
[2015/07/06 22:46:22 | 000,654,968 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2015/07/06 22:46:22 | 000,141,738 | ---- | M] () -- C:\Windows\SysNative\perfc005.dat
[2015/07/06 22:46:22 | 000,122,338 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2015/07/06 22:40:14 | 000,000,948 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2015/07/06 22:40:10 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2015/07/06 22:40:07 | 4192,321,531 | -HS- | M] () -- C:\hiberfil.sys
[2015/07/06 22:35:43 | 001,897,768 | ---- | M] (Adobe Systems Incorporated) -- C:\Users\Randaal\Desktop\flashplayer18_ha_install.exe
[2015/07/06 19:08:02 | 000,000,874 | ---- | M] () -- C:\Windows\tasks\DropboxUpdateTaskUserS-1-5-21-516098057-2350176401-1669302986-1000Core.job
[2015/07/05 23:37:33 | 000,001,122 | ---- | M] () -- C:\Users\Public\Desktop\BS.Player FREE.lnk
[2015/07/05 23:35:34 | 010,554,352 | ---- | M] () -- C:\Users\Randaal\Desktop\bsplayer269-1079.exe
[2015/07/05 17:27:45 | 000,544,656 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\deployJava1.dll
[2015/07/05 17:27:45 | 000,214,408 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2015/07/05 17:27:45 | 000,173,960 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2015/07/05 17:27:45 | 000,173,960 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2015/07/04 23:31:43 | 000,235,744 | ---- | M] (EasyAntiCheat Ltd) -- C:\Windows\SysWow64\EasyAntiCheat.exe
[2015/07/04 09:59:38 | 000,432,287 | ---- | M] () -- C:\Users\Randaal\Desktop\matchmaking_server_picker_2_7.zip

========== Files Created - No Company Name ==========

[2015/07/07 18:50:01 | 000,000,512 | ---- | C] () -- C:\PhysicalMBR.bin
[2015/07/06 23:10:16 | 000,030,122 | ---- | C] () -- C:\Users\Randaal\Desktop\FRST.rar
[2015/07/05 23:37:33 | 000,001,122 | ---- | C] () -- C:\Users\Public\Desktop\BS.Player FREE.lnk
[2015/07/05 23:35:26 | 010,554,352 | ---- | C] () -- C:\Users\Randaal\Desktop\bsplayer269-1079.exe
[2015/07/04 09:59:35 | 000,432,287 | ---- | C] () -- C:\Users\Randaal\Desktop\matchmaking_server_picker_2_7.zip
[2015/06/23 10:28:04 | 037,748,880 | ---- | C] () -- C:\Windows\SysWow64\nvcompiler.dll
[2015/05/29 11:57:40 | 000,226,680 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2015/05/29 11:57:39 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2015/05/17 13:41:48 | 000,001,120 | ---- | C] () -- C:\Users\Randaal\AppData\Local\MRDownloader.nast
[2015/05/06 22:14:20 | 000,000,017 | ---- | C] () -- C:\Users\Randaal\AppData\Local\resmon.resmoncfg
[2015/05/06 13:14:42 | 001,199,831 | ---- | C] () -- C:\Windows\unins000.exe
[2015/05/06 13:14:42 | 000,008,543 | ---- | C] () -- C:\Windows\unins000.dat
[2015/05/06 12:50:54 | 001,561,362 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2015/05/06 12:46:41 | 000,015,232 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsIO.sys
[2015/05/06 08:09:00 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini
[2015/05/06 08:08:54 | 000,054,155 | ---- | C] () -- C:\Windows\Ascd_tmp.ini

========== ZeroAccess Check ==========

[2009/07/14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2015/02/13 07:22:33 | 014,177,280 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2015/02/13 07:26:18 | 012,875,264 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2015/05/30 10:27:13 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\.minecraft
[2015/07/06 22:36:48 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\112b48
[2015/05/20 14:02:27 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\AnkhHeart
[2015/05/07 08:27:42 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\AVAST Software
[2015/07/05 23:38:21 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\BSplayer
[2015/07/05 23:37:23 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\BSplayer Pro
[2015/05/06 18:59:35 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\Corsair
[2015/07/05 17:29:25 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\Day 1 Studios
[2015/07/06 22:40:41 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\Dropbox
[2015/06/23 12:40:22 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\FileZilla
[2015/05/15 14:06:40 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\GoPro
[2015/05/26 00:35:19 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\Image-Line
[2015/05/18 20:40:02 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\java
[2015/05/07 07:50:58 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\Leadertech
[2015/05/29 14:18:29 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\Need for Speed World
[2015/07/07 13:19:15 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\OBS
[2015/06/03 16:39:36 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\Origin
[2015/05/29 14:17:02 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\PunkBuster
[2015/05/16 12:09:19 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\Scooter Software
[2015/05/18 06:14:36 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\Screaming Bee
[2015/05/22 15:53:26 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\Shooter
[2015/05/19 14:27:47 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\TeamViewer
[2015/07/03 05:36:29 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\TownOfSalem
[2015/05/31 10:43:40 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\Trine1
[2015/07/06 22:54:35 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\TS3Client
[2015/06/23 21:05:59 | 000,000,000 | ---D | M] -- C:\Users\Randaal\AppData\Roaming\uTorrent

========== Purity Check ==========



========== Custom Scans ==========

< >
[2009/07/14 07:08:49 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT
[2009/07/14 07:08:49 | 000,014,920 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2015/05/06 12:41:12 | 000,000,948 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
[2015/05/06 12:41:13 | 000,000,952 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
[2015/06/13 18:52:13 | 000,000,874 | ---- | C] () -- C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-516098057-2350176401-1669302986-1000Core.job
[2015/06/13 18:52:14 | 000,000,926 | ---- | C] () -- C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-516098057-2350176401-1669302986-1000UA.job
[2015/06/24 11:29:21 | 000,000,914 | ---- | C] () -- C:\Windows\Tasks\Adobe Flash Player Updater.job

< End of report >
Nahoru
Uživatelský avatar
Randaal
Návštěvník
Návštěvník
Příspěvky: 58
Registrován: 20 říj 2008 22:57
Bydliště: Praha

Re: Podezření na malware v PC

#12 Příspěvek od Randaal »

Extras.txt

OTL Extras logfile created on: 07/07/2015 6:47:05 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Randaal\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.17843)
Locale: 00001009 | Country: Kanada | Language: ENC | Date Format: dd/MM/yyyy

31.87 Gb Total Physical Memory | 25.31 Gb Available Physical Memory | 79.41% Memory free
63.74 Gb Paging File | 57.18 Gb Available in Paging File | 89.71% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 447.04 Gb Total Space | 315.46 Gb Free Space | 70.57% Space Free | Partition Type: NTFS
Drive X: | 5588.91 Gb Total Space | 4113.46 Gb Free Space | 73.60% Space Free | Partition Type: NTFS

Computer Name: RANDAAL-PC | User Name: Randaal | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 7 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)

[HKEY_USERS\S-1-5-21-516098057-2350176401-1669302986-1000\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02B9628B-00C7-480A-B466-CBFD95D43994}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{06A6987A-E133-416D-973E-08178848C7D2}" = lport=139 | protocol=6 | dir=in | app=system |
"{08F557E2-42B6-4EE8-92CF-0C32CC8F5377}" = rport=445 | protocol=6 | dir=out | app=system |
"{13DB1A4D-56CE-450F-814C-B6B819D1F55E}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{1AB25BC2-1DDE-4EE0-89D4-D9EF41FC7875}" = lport=137 | protocol=17 | dir=in | app=system |
"{2237DA25-6406-46E0-9F95-C629670BBFE6}" = lport=5353 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamnetworkservice.exe |
"{3071DDFF-8573-44A3-9321-0748D3B27D22}" = lport=48000 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{30B1B00D-C7FB-4365-9B42-D3125D61F6C6}" = lport=54045 | protocol=17 | dir=in | app=c:\program files\logitech gaming software\lcore.exe |
"{3207B099-3A67-470E-BA5C-BE4213613EDD}" = lport=7437 | protocol=17 | dir=in | name=tp-link usb printer controller udp port |
"{4353468E-CBAB-4CF3-B255-57366D089345}" = lport=7437 | protocol=17 | dir=in | name=tp-link usb printer controller udp port |
"{520FCA28-A182-4BA6-9DBA-F4E1833AE608}" = rport=137 | protocol=17 | dir=out | app=system |
"{5699691B-99FE-4091-93D4-EDCAE588B099}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{5750B7F2-A0B2-4AAC-B82C-A94ED32194CC}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{60D3D158-3714-400D-BBDE-FCB01B2DE095}" = lport=10243 | protocol=6 | dir=in | app=system |
"{6176D724-A95D-4CDC-A324-2B5E387F1D3E}" = lport=47984 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamnetworkservice.exe |
"{62A80EFF-CEC5-4E1E-9C6D-C8FC21BAB358}" = lport=443 | protocol=6 | dir=in | app=c:\program files (x86)\nvidia corporation\netservice\nvnetworkservice.exe |
"{7459E46F-00F0-40AB-AAB0-87026A97B389}" = rport=10243 | protocol=6 | dir=out | app=system |
"{8C82AEE9-A4E7-44CE-A0A7-7E6B7FD58540}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{8E9FEBC9-56A0-4662-A38C-A0F2F8E2A575}" = lport=80 | protocol=6 | dir=in | app=c:\program files (x86)\nvidia corporation\netservice\nvnetworkservice.exe |
"{983960CD-5C3B-4469-84A8-DD4862A671A6}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{9C4EB9A3-665E-4598-B3E4-D497B02B2D20}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{9DEF75A5-17EE-4767-8E92-6313B2673A79}" = lport=138 | protocol=17 | dir=in | app=system |
"{B1661F11-2A3B-4CD7-BE02-772204C0F434}" = lport=2869 | protocol=6 | dir=in | app=system |
"{B8894393-C3AE-44BC-87F6-030C3191E2C5}" = lport=445 | protocol=6 | dir=in | app=system |
"{C3718B53-6724-4D5C-882C-8DE3FDDB17BD}" = lport=5353 | protocol=17 | dir=in | app=c:\program files (x86)\google\chrome\application\chrome.exe |
"{CABE61ED-3898-4591-ADB1-449B08D5B487}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D22B0907-2214-4BDA-8266-F2143279C4B6}" = rport=139 | protocol=6 | dir=out | app=system |
"{D6899890-1DE0-4136-AB8F-9052B14DF673}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{DBE9D016-EBBC-431D-9D20-4AEDB1CD0164}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{EBB8F298-8A98-44A1-9F13-D37850C2F280}" = lport=47995 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{F814A686-11C1-4E6E-A5FA-7712C483F8CF}" = rport=138 | protocol=17 | dir=out | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00DA9743-B232-4263-B1DA-31DA5BCA4102}" = dir=out | name=blocksgp |
"{014A9E6F-B1AF-46A6-BA77-97B0BF459946}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\mk10\binaries\retail\mkxlauncher.exe |
"{01EBC744-02D6-4E78-AD26-F75B20FAD856}" = protocol=6 | dir=in | app=x:\games\uplay\assassin's creed rogue\acc.exe |
"{0300CC20-9956-404C-A7B2-FB7D359E3821}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\iambread\iambread.exe |
"{033C5508-FC22-40DE-A46A-41813BE4C54C}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{045DF092-AAF9-4742-BD4D-8019A0A19F6D}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\portal 2\portal2.exe |
"{05F67588-B851-4630-B50D-77E8A904428D}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{07C96D81-998E-40FD-89CB-F2733A6C9707}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\batman arkham asylum goty\binaries\bmlauncher.exe |
"{07D97C47-6E8D-43D7-821B-EDD8F3F3CFF2}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\dirty bomb\binaries\win32\shootergame-win32-shipping.exe |
"{0928D4DA-7807-4CE6-BA7E-37D7CF8AA1BA}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\grand theft auto san andreas\gta-sa.exe |
"{0B67E8B1-93D3-4E13-9BC6-76C34EC3E488}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\five nights at freddy's\fivenightsatfreddys.exe |
"{0C139B22-9075-4B2B-9C48-6D0A3B00547F}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\h1z1 test\launchpad.exe |
"{0C4C46C6-E642-4BA7-A395-D4E697781981}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{0DE049DC-8C17-496E-BEF7-24C9496C0E32}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\surgeon simulator 2013\ss2013.exe |
"{0E84BE60-2157-497B-85A7-9F0CEAB65D3A}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\edna and harvey harvey's new eyes\visionaireconfigurationtool.exe |
"{0EAF37B4-8FCE-4D19-AD90-42E8F42AB292}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\counter-strike source\hl2.exe |
"{11AB33A6-4E50-4AF8-8850-660FB62E8F0D}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\team fortress 2\hl2.exe |
"{13208BA1-9B5C-43AA-B5B3-8B7CD3467A4C}" = protocol=17 | dir=in | app=x:\games\origin\battlefield 4\bf4.exe |
"{1342D4DD-6A48-45CB-A393-B33E81CFD84B}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\left 4 dead\left4dead.exe |
"{1626CF7E-7D80-42CF-B21C-E454C981C0C1}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\h1z1\launchpad.exe |
"{1662D332-0160-4B7F-900D-DC723215640C}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\edna and harvey harvey's new eyes\visionaireconfigurationtool.exe |
"{185BCCF5-9DF5-4F7A-9C22-C15BA78AC8B2}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\ori\ori.exe |
"{19C399A3-F108-4E2B-BEB6-6D4ADC3676BE}" = protocol=17 | dir=in | app=x:\games\origin\ultima 8\game\game\dosbox\dosbox.exe |
"{1B8D75A6-8CA3-4CEA-97BE-FDB06B141681}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\wormsxhd\launcher.exe |
"{1CBCC6D0-E1E4-4039-9095-D356F9E9285E}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\edna & harvey the breakout\edna.exe |
"{1CF18CAA-A232-4795-987F-89FDCFAEB4BA}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\half-life\hl.exe |
"{1D834F01-6850-4C43-8DF9-59A7CE94AB52}" = protocol=6 | dir=out | app=system |
"{2042B4D2-5AAD-484E-9B34-30E9301D04A1}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\bin\steamwebhelper.exe |
"{21E33C0D-1A93-48E8-A04C-2522CFF74F54}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\left 4 dead 2\left4dead2.exe |
"{25D548EA-DDF7-494D-A153-F6564E74EB7C}" = protocol=17 | dir=in | app=x:\games\origin\syndicate (1993)\data\game\dosbox\launcher.exe |
"{26EB7D87-0887-4DB9-8EF8-1FE4CF7C335C}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\left 4 dead 2 beta\left4dead2_beta.exe |
"{27DCA8B3-0E1D-4EE6-A700-D383CF10EE10}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\ark\shootergame\binaries\win64\shootergame.exe |
"{293A57B3-AFE6-4D29-B17C-4710C99D2492}" = protocol=6 | dir=in | app=c:\program files (x86)\tp-link\usb printer controller\usb printer controller.exe |
"{2957D259-3A8D-41EE-B2DD-D652F5FA0956}" = protocol=17 | dir=in | app=c:\users\randaal\appdata\roaming\utorrent\utorrent.exe |
"{2E38B3EA-B6FC-4D46-B0D9-5C842C280F09}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\dota 2 beta\dota.exe |
"{2E65BA39-98B3-43DE-AFB4-D14144A6ED83}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\edna and harvey harvey's new eyes\harvey.exe |
"{2FBA5D5C-8660-4550-830F-C9FEBE5126CF}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\path of exile\pathofexilesteam.exe |
"{30280D24-69A7-4F3D-91B7-8682BD6A4E84}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\counter-strike global offensive\csgo.exe |
"{31379FA0-F44D-4A84-AAD8-E982109DBF3A}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\ori\ori.exe |
"{3591A41E-69F5-48CD-BF0C-2C86E8CBBA85}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\ark\shootergame\binaries\win64\shootergameserver.exe |
"{368376F4-3E51-48CD-A25D-52D8611685A4}" = protocol=6 | dir=in | app=c:\program files (x86)\winamp\winamp.exe |
"{38ADE8B9-18FA-43F1-9D4E-6581BC63E38E}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\teamviewer.exe |
"{393B476A-8675-41CD-8EEF-009EBDFF6A42}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\the witcher enhanced edition\digital comic\digitalcomic.exe |
"{3A5F24E9-977B-4743-8364-BB5264F99796}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\f.e.a.r. 3\f.e.a.r. 3.exe |
"{3A6DC18C-F42C-4160-AFE5-BA0694ED64C0}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\worms clan wars\wormsclanwars.exe |
"{3FBA8218-115D-4256-8380-C4700A196C28}" = protocol=17 | dir=in | app=x:\games\uplay\assassin's creed rogue\acc.exe |
"{417F07E0-4259-480B-9822-88ED570A6E37}" = protocol=17 | dir=in | app=x:\games\origin\need for speed world\gamelauncher.exe |
"{43B99871-69FD-40F3-B025-7C66317B954F}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\of orcs and men\oforcsandmen_steam.exe |
"{44DE0CF3-B066-491A-9F63-13114E9ABBF7}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\grand theft auto v\gtavlauncher.exe |
"{45E59265-93C8-48AA-AC52-57805247DE4E}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\mk10\binaries\retail\mk10.exe |
"{45F6921D-8484-46A6-AF02-0695B9568BE3}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\wormsrevolution\wormsrevolution.exe |
"{4AC9569E-E97D-4BC8-9B17-183621EEDC24}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{4CCE0576-9F7A-4F50-92C6-688EE0832A2E}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\outlast\outlastlauncher.exe |
"{4D0A941B-3AC5-49A8-A499-3F65BDE6410E}" = protocol=6 | dir=in | app=c:\program files (x86)\tp-link\usb printer controller\usb printer controller.exe |
"{4DD16631-C6A7-45D7-AE55-95625EBC9A3A}" = protocol=6 | dir=in | app=x:\games\origin\syndicate (1993)\data\game\dosbox\launcher.exe |
"{4F54979B-3215-4003-8839-541001FA947A}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\grand theft auto v\gtavlauncher.exe |
"{50C687D5-696F-4E7D-8C8D-85E4A06B7660}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\run and fire\launchpoint.exe |
"{51DB06E3-60B3-4D29-BDA8-F94FDF147F01}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\iambread\iambread.exe |
"{534D9D67-F69B-43E0-8D07-2476D01AE04E}" = protocol=17 | dir=in | app=x:\games\uplay\assassin's creed revelations\acrmp.exe |
"{56803EA1-91C4-444D-BFF6-AEF27F19CD5B}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\heroes of might & magic iii - hd edition\homm3launcher.exe |
"{57A4FCAB-63C6-4EFB-8875-C2EAB2D06800}" = protocol=17 | dir=in | app=x:\games\origin\battlefield 4\bf4_x86.exe |
"{57F167DC-D33A-492D-B6B5-162DA57CCFE9}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{58D05490-7FF5-42AA-91EB-67BCDACA2661}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{5A777D2A-98D2-4E1D-A78E-4610D62CA7BD}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\goatsimulator\binaries\win32\goatgame-win32-shipping.exe |
"{5B626619-971F-4E76-9318-0D3E19E9A480}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{5B90EA92-A4D4-4A5B-A42E-2AADDA64F157}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\skyrim\skyrimlauncher.exe |
"{5FC67D0D-4E35-46CC-8D05-5538300E9BBA}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{6252C24B-7567-48BE-9B07-B3A90A7DDA9C}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\worms blast\main.exe |
"{62B1FA2B-E3FE-4EEB-9FF5-F7928539EFB9}" = protocol=17 | dir=in | app=c:\program files (x86)\tp-link\usb printer controller\usb printer controller.exe |
"{62D1253F-72E4-40EA-AA53-7C5FD4B2B3B0}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\grand theft auto san andreas\gta-sa.exe |
"{634F606E-A295-49D3-B4E6-B9D4267D3EDA}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\bridgeproject\bridge.exe |
"{63AF76B2-8940-4423-AB39-06BB1AD4A742}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\half-life\hl.exe |
"{65024CA2-8E92-42AF-A9DA-226D693FC8BB}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\portal\hl2.exe |
"{661054A8-5DED-48B0-B028-BB24866FDB46}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\the witcher enhanced edition\system\djinni!.exe |
"{67512394-1AF0-490F-B71A-D8926E506AA3}" = protocol=6 | dir=in | app=x:\games\origin\battlefield 4\bf4.exe |
"{67E6558E-979F-4FB3-898A-29E09489DC84}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\h1z1\launchpad.exe |
"{68427D38-CB0B-4A94-92B9-8EE9F088131F}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\worms pinball\mmlauncher.exe |
"{69233D33-AFE1-42D9-86BC-AF433B277CB1}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\five nights at freddy's\fivenightsatfreddys.exe |
"{6BDCC5AB-A0B1-4D66-B507-6F651F34E7F7}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\rust\rust.exe |
"{6CF1A8C6-0D14-4BFA-A24E-7A027B22D9BC}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\counter-strike global offensive\csgo.exe |
"{6E65577C-B073-4CFD-8926-AC83F2265C04}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\half-life 1 source deathmatch\hl2.exe |
"{71FD81B0-E8D1-49A8-8565-18EDF6CDFA57}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\ark\shootergame\binaries\win64\shootergame.exe |
"{726326B8-D6CA-4EF7-B1F3-8F34EBA222D2}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\garrysmod\hl2.exe |
"{72684329-ADE0-479F-B334-80171C425F74}" = protocol=17 | dir=in | app=x:\games\uplay\assassin's creed revelations\acrsp.exe |
"{72DF7AEA-07B8-4F3B-98AB-75D37D97AAA8}" = protocol=6 | dir=in | app=c:\users\randaal\appdata\roaming\utorrent\utorrent.exe |
"{74015D30-8201-4725-9B3E-FEF6F28544D7}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\worms armageddon\wa.exe |
"{74E39F34-1862-4479-982E-AD222D64DDE0}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\edna & harvey the breakout\edna.exe |
"{7781537A-6BF3-46AA-B13C-DFF2F9FF6042}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\orion dino beatdown\binaries\win32\dinohordegame.exe |
"{78D9CFDC-8D44-454B-B184-B8B4DCA5AD3C}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\half-life 2\hl2.exe |
"{78E18190-38DD-497F-921E-B3F6E4EA7158}" = protocol=6 | dir=in | app=x:\games\origin\battlefield 4\bf4_x86.exe |
"{78E57940-9D26-4D2B-8C14-19492642ADB7}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\the witcher enhanced edition\system\witcher.exe |
"{798CF297-64F0-45ED-96A7-F114D20E6C6C}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\terraria\terraria.exe |
"{79FF3CBB-6CC5-4D7C-A643-2C64C1D913C4}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\f.e.a.r. 3\f.e.a.r. 3.exe |
"{7BE57521-EA31-4C32-8907-BBF30EFC52CB}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\teamviewer.exe |
"{7C07264D-51BE-4BA7-9070-16CFCCC68C1F}" = protocol=6 | dir=in | app=x:\games\origin\ultima 8\game\game\dosbox\dosbox.exe |
"{820C9FDE-BD75-4621-A4D9-C916816C5F85}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\h1z1 test\launchpad.exe |
"{83D1EBC1-5866-4275-96C2-41BC4674B7AD}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\squishy\bin\squishy.exe |
"{83EFD969-DC1D-4228-B030-F2AF502E79B2}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\wormsrevolution\wormsrevolution.exe |
"{85A5BD96-CA0D-43D8-B53F-FCA2A5B9F4F3}" = protocol=17 | dir=in | app=c:\users\randaal\appdata\roaming\dropbox\bin\dropbox.exe |
"{860BB36E-9C20-4F6B-A127-423E3769EA34}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\wormsgolf2010\wormscrazygolf.exe |
"{8804F045-CD93-4CC1-B064-21CD450D98E9}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\mk10\binaries\retail\mk10.exe |
"{8B24CB33-551C-445E-A7B1-32B7B1DC8075}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\batman arkham knight\binaries\win64\batmanak.exe |
"{8CD67501-4A18-411D-8693-7C5D0421455A}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\dota 2 beta\dota.exe |
"{8E95A074-8746-43D4-91FB-6CCB8119D3DF}" = protocol=17 | dir=in | app=x:\games\uplay\assassin's creed revelations\assassinscreedrevelations.exe |
"{8EBE4CCB-8E29-4BDF-9704-7659589266EA}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\dirty bomb\binaries\win32\shootergame-win32-shipping.exe |
"{9418BD71-43AE-4F91-8851-8056E4B6CD5A}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{9468D618-C04B-4063-B91F-978103B80530}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\teamviewer_service.exe |
"{948E87C7-28AC-4329-AC1C-68E03747EC44}" = protocol=17 | dir=in | app=x:\games\origin\titanfall\titanfall.exe |
"{9BCB9D45-87CE-44FE-8F00-221F6B4308D2}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\chaos on deponia\deponia2.exe |
"{9D22B85F-6EE3-44DD-BD13-0306B006D630}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\half-life 1 source deathmatch\hl2.exe |
"{9D9D3277-E2B3-4F3C-B7C2-C6BDCCAC684A}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{9DE383B2-0974-48B2-ACAC-618E123C9C52}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\randal's monday\randals.exe |
"{9F0783D7-4B5C-4532-A8E0-C9B252672C49}" = protocol=6 | dir=in | app=x:\games\uplay\assassin's creed revelations\assassinscreedrevelations.exe |
"{9F34AF1C-7DB7-496C-81C0-3A37B5FF80B2}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\day of defeat source\hl2.exe |
"{A0586A8F-54C9-4AE8-969D-0F7758A935CF}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{A0ADAEC1-00B2-4D9B-9298-4BAF3A9B2EA4}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\skyrim\skyrimlauncher.exe |
"{A0CB02F2-2D13-4069-8EFC-0C974BEB8158}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\portal 2\portal2.exe |
"{A11BAA1C-8B4A-4F86-92F8-82B2577EF9AE}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\counter-strike global offensive\bin\sdklauncher.exe |
"{A1DECE91-B53A-472A-A52E-EB1ABCCB6F82}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\chaos on deponia\deponia2.exe |
"{A3187FD7-5432-4828-AB0D-A900564AD9BC}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\chaos on deponia\visionaireconfigurationtool.exe |
"{A31E85DC-DD14-47FC-BB10-A6AD431A6A47}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\town of salem\townofsalem.exe |
"{A38B45AB-6D88-4579-90F1-1ACB8FBE3741}" = protocol=6 | dir=in | app=c:\program files\logitech gaming software\lcore.exe |
"{A39E3BE7-C5AE-4303-928C-3CB7D4880430}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\half-life 2 deathmatch\hl2.exe |
"{A4824B89-AACD-40DC-849D-960732E4F822}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\ark\shootergame\binaries\win64\shootergameserver.exe |
"{A580EFE3-503D-4D42-9A48-6F31DA560430}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\rust\rust.exe |
"{A6925067-8361-4A80-8033-CA6DE87F4A8E}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\worms armageddon\wa.exe |
"{A7D03A80-5784-486B-B168-98E938745CFE}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\theimpossiblegame\impossiblegame.exe |
"{A8385846-53D7-4DB2-BFB0-47161F8A48E1}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\trine\_enchanted_edition_\trine1_launcher.exe |
"{A865E159-D764-4D27-987F-A3F74CD80D8A}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{A8AE4ED9-0D32-466F-B8FA-45AE202CF0D2}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{AB0A2FCB-44F1-4339-A9A1-92AF291EA0E5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{ABCE3B26-9CEA-4442-B384-B27FF0E0BB08}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{AC4079F6-6046-4DC9-AC56-73C0BC71FD1B}" = protocol=6 | dir=in | app=x:\games\uplay\assassin's creed revelations\acrmp.exe |
"{AD21A92B-D27E-47D0-8097-B75A079DA2B8}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\randal's monday\randals.exe |
"{AED1359A-99D8-43B6-A0AB-AA0F9CAC66EF}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\squishy\bin\squishy.exe |
"{AFCB7E0C-4D19-4177-99D1-793EA1B83CF5}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\half-life 2\hl2.exe |
"{B030C55E-0C07-4CA0-B9E0-431A1411C928}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\team fortress 2\hl2.exe |
"{B23E069D-A37C-466B-AC36-EA11B2916005}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\heroes of might & magic iii - hd edition\homm3launcher.exe |
"{B2E3A664-1B23-4B0D-AA1A-2B77D48B98E8}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\worms clan wars\wormsclanwars.exe |
"{B30EB568-1DB4-4D1F-A982-FDE6628CA290}" = protocol=6 | dir=in | app=x:\games\origin\theme hospital\data\game\dosbox\launcher.exe |
"{B39B9D23-D797-4516-8A7F-7AA422EF344D}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\mk10\binaries\retail\mkxlauncher.exe |
"{B5433233-4CCF-49CA-9866-B116763009CD}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\the witcher enhanced edition\system\djinni!.exe |
"{B835A171-E715-415E-9130-7917CA3DFA53}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\worms reloaded\wormsreloaded.exe |
"{B83CC6C5-C255-41F6-9F01-8E396206DE71}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\the witcher enhanced edition\system\witcher.exe |
"{B99DC269-8889-4CE8-97A1-4A17BD1EA8C7}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\counter-strike global offensive\bin\sdklauncher.exe |
"{B9ACEE6B-AEFB-4BD5-9364-15CD4269E058}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\day of defeat source\hl2.exe |
"{BA3FD870-9FF8-43EE-A45B-A2C44D572653}" = protocol=17 | dir=in | app=c:\program files (x86)\winamp\winamp.exe |
"{BAAB4EA0-182B-41AD-AE83-25BD3B688BA2}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\half-life 2 deathmatch\hl2.exe |
"{BC5CE391-DB47-4603-A786-1F085FAB87A4}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\town of salem\townofsalem.exe |
"{BE470491-C3BF-4CB1-A33F-E4465CF04B26}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\bin\steamwebhelper.exe |
"{BF1EA244-1488-484F-B574-A009FCC971F0}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\left 4 dead 2\left4dead2.exe |
"{BFDAE8FA-180C-44E2-9908-78A29560FEE3}" = dir=out | name=blockeun |
"{C0984D1F-6B93-4139-AA55-1303D29A4585}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{C26EE50F-D3C5-4025-8EC0-26F26FD99AF8}" = protocol=17 | dir=in | app=c:\program files (x86)\tp-link\usb printer controller\usb printer controller.exe |
"{C4468C9B-484C-4678-8DF2-406BB7469A6A}" = dir=out | name=blockdxb |
"{C6FD2255-D29D-4C85-813A-A170D714135A}" = protocol=6 | dir=in | app=x:\games\origin\need for speed world\gamelauncher.exe |
"{C7295E2A-0A2B-4657-9D3B-4BB1AD911FCA}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\bridgeproject\bridge.exe |
"{C84249F1-6241-4AB4-B242-F7BCB50AB2A9}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\terraria\terraria.exe |
"{CC2CB8C1-2079-417F-BCD3-73CD962D2225}" = dir=out | name=blockcpt |
"{D0A738C0-7056-4329-B584-01FE43C18CAA}" = dir=out | name=blockaus |
"{D0E9DB6F-664C-49A9-8E0E-4F1A589B55F3}" = dir=out | name=blockbrz |
"{D1281E17-A1AA-4084-AF36-509635306B71}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{D15E8ECE-B4E2-45AC-A7C9-F935B6F83C45}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\portal\hl2.exe |
"{D21ED822-D803-457B-9D06-C80198195EA6}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\assassins creed\assassinscreed_game.exe |
"{D3648CE0-04FE-4952-A733-5535931AC837}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\theimpossiblegame\impossiblegame.exe |
"{D448510E-9DAD-421A-8647-F9C1D2620D25}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\run and fire\launchpoint.exe |
"{D4B354DE-CBC6-4105-B92D-4A11CFE2CD74}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{D4D9969A-1DA1-4D5A-B098-47DB37994629}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{D4E82B4F-28E1-4D10-8A4D-797F8EE7725E}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\edna and harvey harvey's new eyes\harvey.exe |
"{D7A652BF-FA57-4CD3-99F9-9742A68962AF}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\the witcher enhanced edition\digital comic\digitalcomic.exe |
"{DA1D20E7-FBAE-45DA-A78E-F916869F7A75}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\of orcs and men\oforcsandmen_steam.exe |
"{DC57541D-56F2-452E-BC21-D630D1EB28F3}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\wormsgolf2010\wormscrazygolf.exe |
"{DE0EA9B4-54D4-4B63-8B18-1DDA77A7ED07}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\counter-strike source\hl2.exe |
"{E0135B1E-4E96-4C63-89B7-33D7F93BDC57}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\outlast\outlastlauncher.exe |
"{E0E520CE-2237-460D-8662-4BD81BFF2878}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\left 4 dead 2 beta\left4dead2_beta.exe |
"{E25E3E3E-F66D-4944-AE9E-1599C24930E4}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\worms reloaded\wormsreloaded.exe |
"{E574B0B3-C663-413F-8F89-E58FDA86BF9F}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\trine\_enchanted_edition_\trine1_launcher.exe |
"{E59740E9-26FC-49F2-9EF8-81B7D0838217}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\left 4 dead\left4dead.exe |
"{E5F41B7F-43AA-45DB-AF23-91282BBA46A0}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{E71168CD-EAB7-4477-9997-2C1180A12BC6}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{E810F5B6-9008-4947-9DD6-562B77E62915}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{E84FE033-CA6C-4640-A24F-4C6284DDD548}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{E97B429A-3B40-4C6F-B88F-54C4EDB45A4C}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\worms pinball\mmlauncher.exe |
"{E9AD341F-467A-4DCB-8954-26E5D6C421CA}" = protocol=6 | dir=in | app=c:\users\randaal\appdata\roaming\dropbox\bin\dropbox.exe |
"{E9FCB181-A558-49E5-ADD7-21C0ACAC14D3}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{EAABE104-D2A3-4378-A988-38BAEE6E9F1B}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\path of exile\pathofexilesteam.exe |
"{EC2BE070-3C89-4891-9027-9E0AC1B6B67E}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\orion dino beatdown\binaries\win32\dinohordegame.exe |
"{ED94DB19-855A-48BD-9441-EA3D835A39BE}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\chaos on deponia\visionaireconfigurationtool.exe |
"{EDAFEF98-259C-4AC3-9706-8DAA2B247541}" = dir=out | name=blockind |
"{EDEF5821-C784-4A78-88A0-FDC8D641095C}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\surgeon simulator 2013\ss2013.exe |
"{EF2A288B-1571-4345-839C-A88BBD227475}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F388256E-DEEF-418D-B072-1740040B3E58}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\batman arkham asylum goty\binaries\bmlauncher.exe |
"{F3888A16-6E94-4213-AF82-3111347F7FA2}" = protocol=6 | dir=in | app=x:\games\origin\titanfall\titanfall.exe |
"{F3C783C2-36AC-4AEB-B884-6F7D24B2C620}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\worms blast\main.exe |
"{F3E04FD5-DDA6-4CEB-A171-79BB95929A19}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\lyne\lyne.exe |
"{F6892C9C-3100-4E6C-A4DB-838B6ECDDD69}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\assassins creed\assassinscreed_game.exe |
"{F6C97D57-3BE9-43D5-B59C-36CC7FCC5164}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\garrysmod\hl2.exe |
"{F839B33F-D30B-4A75-9474-E83122E2EB82}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\batman arkham knight\binaries\win64\batmanak.exe |
"{F84CC3ED-6AA8-4371-9A28-A6046551972E}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\goatsimulator\binaries\win32\goatgame-win32-shipping.exe |
"{FC61EA7A-517A-450C-8149-B3042199D782}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{FDEEEDA8-7765-40F8-91F6-797AE19470A1}" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\wormsxhd\launcher.exe |
"{FDF41034-6B51-44E1-8175-F96BC92E82F5}" = protocol=17 | dir=in | app=x:\games\origin\theme hospital\data\game\dosbox\launcher.exe |
"{FDFA2A02-FB9F-4909-954C-F52FFA27DED0}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\teamviewer_service.exe |
"{FE2633E2-4128-484B-9DCD-6E6F998907F5}" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\lyne\lyne.exe |
"{FF0225CF-EE63-4758-A515-3A33D235AFC9}" = protocol=6 | dir=in | app=x:\games\uplay\assassin's creed revelations\acrsp.exe |
"TCP Query User{136A219A-0203-4C62-9386-B9112C860BFC}C:\program files (x86)\vencrypt-0.2.6\vencviewer.exe" = protocol=6 | dir=in | app=c:\program files (x86)\vencrypt-0.2.6\vencviewer.exe |
"TCP Query User{2B2859CE-8371-4221-ACD6-8DB4DF9FE2F2}X:\games\steamlibrary\steamapps\common\h1z1 test\h1z1.exe" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\h1z1 test\h1z1.exe |
"TCP Query User{858BBD06-52BC-48EE-B403-BF6CC80C62CC}C:\program files (x86)\vencrypt-0.2.6\vencviewer.exe" = protocol=6 | dir=in | app=c:\program files (x86)\vencrypt-0.2.6\vencviewer.exe |
"TCP Query User{AA1E14BD-387A-4EE3-8C24-C8CC61A7CB7A}X:\games\steamlibrary\steamapps\common\grand theft auto v\gta5.exe" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\grand theft auto v\gta5.exe |
"TCP Query User{BEDE0557-A371-4FFA-8ECF-C0FB911488F6}C:\programdata\electronic arts\need for speed world\data\nfsw.exe" = protocol=6 | dir=in | app=c:\programdata\electronic arts\need for speed world\data\nfsw.exe |
"TCP Query User{C51C1239-1FAC-4044-86D1-C1C48E7C8EFB}X:\games\steamlibrary\steamapps\common\h1z1\h1z1.exe" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\h1z1\h1z1.exe |
"TCP Query User{D4CCBE41-15DD-4EB6-84BA-FEA3F86BBB1A}X:\games\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe" = protocol=6 | dir=in | app=x:\games\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe |
"TCP Query User{E74CD7C6-B7EE-4461-952F-538BA8DF68BC}X:\games\steamlibrary\steamapps\common\h1z1 test\h1z1.exe" = protocol=6 | dir=in | app=x:\games\steamlibrary\steamapps\common\h1z1 test\h1z1.exe |
"UDP Query User{05B87412-6E01-4139-9BE0-4606F783FBD3}X:\games\steamlibrary\steamapps\common\grand theft auto v\gta5.exe" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\grand theft auto v\gta5.exe |
"UDP Query User{1112ED05-E44B-4DFE-8DCA-C1CB4CA68F94}X:\games\steamlibrary\steamapps\common\h1z1 test\h1z1.exe" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\h1z1 test\h1z1.exe |
"UDP Query User{543A4BA0-3A83-4957-8B86-587F7AD803EE}C:\programdata\electronic arts\need for speed world\data\nfsw.exe" = protocol=17 | dir=in | app=c:\programdata\electronic arts\need for speed world\data\nfsw.exe |
"UDP Query User{85ADA2BC-FB02-4A82-9B8C-A97372C03A15}X:\games\steamlibrary\steamapps\common\h1z1\h1z1.exe" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\h1z1\h1z1.exe |
"UDP Query User{AF8D89B7-F5DA-4527-AB37-48BFA6BE7B45}X:\games\steamlibrary\steamapps\common\h1z1 test\h1z1.exe" = protocol=17 | dir=in | app=x:\games\steamlibrary\steamapps\common\h1z1 test\h1z1.exe |
"UDP Query User{B78BED63-EE77-4CD6-BCC2-53927F85323D}C:\program files (x86)\vencrypt-0.2.6\vencviewer.exe" = protocol=17 | dir=in | app=c:\program files (x86)\vencrypt-0.2.6\vencviewer.exe |
"UDP Query User{C0C2E607-EB50-4D7E-AB04-77755A4C6323}C:\program files (x86)\vencrypt-0.2.6\vencviewer.exe" = protocol=17 | dir=in | app=c:\program files (x86)\vencrypt-0.2.6\vencviewer.exe |
"UDP Query User{DC682B38-CED6-4ADC-9DA1-FD703741DC72}X:\games\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe" = protocol=17 | dir=in | app=x:\games\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{1F786739-2766-4149-8926-D732A50FC574}" = M-Audio M-Track Plus 1.0.3 (x64)
"{203BCA8D-BC00-4DD5-85DF-2F84DB803B57}" = Sonic Radar II
"{26784146-6E05-3FF9-9335-786C7C0FB5BE}" = Microsoft .NET Framework 4.5.2
"{26A24AE4-039D-4CA4-87B4-2F86418045F0}" = Java 8 Update 45 (64-bit)
"{37B8F9C7-03FB-3253-8781-2517C99D7C00}" = Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61030
"{409CB30E-E457-4008-9B1A-ED1B9EA21140}" = Intel(R) Rapid Storage Technology
"{46C478DE-C381-4200-9627-0DA025B555EB}" = Intel(R) Chipset Device Software
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{692E20FD-F1EC-415E-8591-8A9145174B41}" = VFW_Codec64
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{929FBD26-9020-399B-9A7A-751D61F0B942}" = Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1029" = Microsoft .NET Framework 4.5.2 (čeština)
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" = Microsoft .NET Framework 4.5.2
"{9495AEB4-AB97-39DE-8C42-806EEF75ECA7}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64)
"{A1439D4F-FD46-47F2-A1D3-FEE097C29A09}" = WIDCOMM Bluetooth Software
"{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}" = Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA Ovladač 3D Vision 353.30
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = Ovládací panel NVIDIA 353.30
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Ovladače grafiky 353.30
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience" = NVIDIA GeForce Experience 2.4.5.44
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA Ovladač řídící jednotky 3D Vision 352.65
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA Systémový software PhysX 9.15.0428
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = Aktualizace NVIDIA 2.4.5.44
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_GFExperience.LEDVisualizer" = NVIDIA LED Visualizer 1.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_GFExperience.NvStreamSrv" = SHIELD Streaming
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_GfExperienceService" = NVIDIA GeForce Experience Service
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA Ovladač HD audia 1.3.34.3
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Network.Service" = NVIDIA Network Service
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_ShadowPlay" = NVIDIA ShadowPlay 2.4.5.44
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_ShieldWirelessController" = SHIELD Wireless Controller Driver
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Update.Core" = NVIDIA Update Core
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver" = NVIDIA Virtual Audio 1.2.28
"{C48AF3CF-C632-3C19-838E-7DAB7283D46A}" = Microsoft .NET Framework 4.5.2 (CSY)
"{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" = Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.61030
"{EAF826C0-245E-4D02-9D51-BA4C98717EAE}" = Intel(R) Rapid Storage Technology
"{FD42EE05-18F9-459F-935D-770E75B3BEE5}" = Intel(R) Network Connections 19.1.51.0
"0B624A43DD66DBF5CF3EDFA9741A364E688062A4" = Windows Driver Package - GoPro (WinUSB) Universal Serial Bus devices (03/07/2012 )
"CCleaner" = CCleaner
"Logitech Gaming Software" = Logitech Gaming Software 8.58
"Microsoft Visual Studio 2010 Tools for Office Runtime (x64)" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64)
"PROSetDX" = Intel(R) Network Connections 19.1.51.0
"Speccy" = Speccy
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"WinRAR archiver" = WinRAR 5.21 (64-bit)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{050d4fc8-5d48-4b8f-8972-47c82c46020f}" = Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501
"{08610298-29AE-445B-B37D-EFBE05802967}" = LWS Pictures And Video
"{08D3C5BB-C492-4916-B111-725081845380}_is1" = AnkhBotR2 version 1.0.0.9
"{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}" = Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005
"{15634701-BACE-4449-8B25-1567DA8C9FD3}" = CameraHelperMsi
"{1651216E-E7AD-4250-92A1-FB8ED61391C9}" = LWS Help_main
"{174A3B31-4C43-43DD-866F-73C9DB887B48}" = LWS Twitter
"{19D12628-7654-4354-A305-9AB0A34F8677}" = digiCamControl
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{21DF0294-6B9D-4741-AB6F-B2ABFBD2387E}" = LWS YouTube Plugin
"{240C3DDD-C5E9-4029-9DF7-95650D040CF2}" = Intel(R) USB 3.0 eXtensible Host Controller Driver
"{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}" = Skype™ 7.5
"{26A24AE4-039D-4CA4-87B4-2F83217000FF}" = Java(TM) 7
"{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}" = Microsoft XNA Framework Redistributable 4.0
"{30D6B6ED-E039-4D62-8E07-E058D17A9372}" = AVerMedia RECentral
"{33A22B2D-55BA-4508-B767-BF2E9C21A73F}" = Assassin's Creed Revelations
"{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" = Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030
"{347EE0C3-0690-48F6-A231-53853C2A80D6}" = Titanfall™
"{3AF1B16A-7DC9-4C80-BAEC-70B088A7C5B8}" = Need For Speed™ World
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = erLT
"{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}" = Microsoft ASP.NET MVC 4 Runtime
"{428C6B01-D292-46F9-9321-75668ED17DA2}" = Ultima 8
"{46F044A5-CE8B-4196-984E-5BD6525E361D}" = Apple Application Support
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4a87bd28-a855-4a8d-b133-60ca8ccffd30}" = Intel® Chipset Device Software
"{5118A4C2-C8A4-4CE5-AC37-F3E51C25402F}" = Theme Hospital
"{5d43231e-c765-405a-a122-81de16acd8b4}" = GoPro Studio 2.5.5
"{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}" = Google Update Helper
"{61942EF5-2CD8-47D4-869C-2E9A8BB085F1}" = Asmedia ASM106x SATA Host Controller Driver
"{627FFC10-CE0A-497F-BA2B-208CAC638010}" = QuickTime 7
"{64CFBAAB-46F7-4628-8D9B-E656A8C11CDB}" = Syndicate
"{6AB01791-CD6D-4A46-A298-CA2439422985}" = TP-LINK USB Printer Controller
"{6F76EC3C-34B1-436E-97FB-48C58D7BEDCD}" = LWS Gallery
"{70A76031-FDC6-4F9B-BB5C-33776703F45A}_is1" = Snaz version 1.9.2.6
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71E66D3F-A009-44AB-8784-75E2819BA4BA}" = LWS Motion Detection
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{83C8FA3C-F4EA-46C4-8392-D3CE353738D6}" = LWS Launcher
"{8937D274-C281-42E4-8CDB-A0B2DF979189}" = LWS Webcam Software
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9DAEA76B-E50F-4272-A595-0124E826553D}" = LWS WLM Plugin
"{A2804FE8-4101-48a0-AE1A-575B99014BF4}-Mio-7.50" = MioMore Desktop 7.50
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{ABADE36E-EC37-413B-8179-B432AD3FACE7}" = Battlefield 4™
"{AC76BA86-0804-1033-1959-001824144531}" = Adobe Refresh Manager
"{AC76BA86-7AD7-1029-7B44-AC0F074E4100}" = Adobe Acrobat Reader DC - Czech
"{B175520C-86A2-35A7-8619-86DC379688B9}" = Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030
"{BCD00339-66CE-424C-8C17-B94C678368B9}" = Corsair Utility Engine
"{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}" = Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030
"{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" = Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030
"{CAF8EA09-7C5D-4E95-B487-2100E8C40A9F}" = GoPro App
"{CC304298-4AF7-46E7-9F5B-84A58758000B}_is1" = Corsair K95 Firmware Update Application
"{D3FDCF37-1BDF-437A-9D95-5F5DBEE3E865}}_is1" = VeNCrypt 0.2.6
"{D40EB009-0499-459c-A8AF-C9C110766215}" = Logitech Webcam Software
"{EC8C32B0-3AF0-4CEF-B9A1-2C133FFAB160}" = VFW_Codec32
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{f65db027-aff3-4070-886a-0d87064aabb1}" = Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501
"{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}" = Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005
"{FF167195-9EE4-46C0-8CD7-FBA3457E88AB}" = LWS Facebook
"1207664643_is1" = The Witcher 3 - Wild Hunt
"Adobe Flash Player ActiveX" = Adobe Flash Player 18 ActiveX
"ASIO4ALL" = ASIO4ALL
"Avast" = Avast Free Antivirus
"AVerMedia Live Gamer HD Series" = AVerMedia Live Gamer HD Series 3.3.64.42
"BeyondCompare3_is1" = Beyond Compare version 3.0.4
"BSPlayerf" = BS.Player FREE
"FileZilla Client" = FileZilla Client 3.11.0.2
"FL Studio 12" = FL Studio 12
"FL Studio ASIO" = FL Studio ASIO
"Google Chrome" = Google Chrome
"IL Download Manager" = IL Download Manager
"InstallShield_{30D6B6ED-E039-4D62-8E07-E058D17A9372}" = AVerMedia RECentral
"LogMeIn Hamachi" = LogMeIn Hamachi
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Open Broadcaster Software" = Open Broadcaster Software
"Origin" = Origin
"PunkBusterSvc" = PunkBuster Services
"Rockstar Games Social Club" = Rockstar Games Social Club
"Steam" = Steam
"Steam App 10" = Counter-Strike
"Steam App 100" = Counter-Strike: Condition Zero Deleted Scenes
"Steam App 104900" = ORION: Prelude
"Steam App 105600" = Terraria
"Steam App 12120" = Grand Theft Auto: San Andreas
"Steam App 130" = Half-Life: Blue Shift
"Steam App 15100" = Assassin's Creed
"Steam App 20" = Team Fortress Classic
"Steam App 200170" = Worms Revolution
"Steam App 208650" = Batman™: Arkham Knight
"Steam App 20900" = The Witcher: Enhanced Edition
"Steam App 21100" = F.E.A.R. 3
"Steam App 216910" = Of Orcs And Men
"Steam App 217200" = Worms Armageddon
"Steam App 219910" = Edna & Harvey: Harvey's New Eyes
"Steam App 220" = Half-Life 2
"Steam App 220740" = Chaos on Deponia
"Steam App 223530" = Left 4 Dead 2 Beta
"Steam App 22600" = Worms Reloaded
"Steam App 232950" = Bridge Project
"Steam App 233720" = Surgeon Simulator
"Steam App 233840" = Worms Clan Wars
"Steam App 238320" = Outlast
"Steam App 238960" = Path of Exile
"Steam App 240" = Counter-Strike: Source
"Steam App 251630" = The Impossible Game
"Steam App 252490" = Rust
"Steam App 255320" = Edna & Harvey: The Breakout
"Steam App 261570" = Ori and the Blind Forest
"Steam App 265930" = Goat Simulator
"Steam App 266010" = LYNE
"Steam App 271590" = Grand Theft Auto V
"Steam App 280" = Half-Life: Source
"Steam App 295110" = H1Z1
"Steam App 297000" = Heroes of Might & Magic III - HD Edition
"Steam App 30" = Day of Defeat
"Steam App 300" = Day of Defeat: Source
"Steam App 307780" = Mortal Kombat X
"Steam App 314810" = Randal's Monday
"Steam App 318430" = Squishy the Suicidal Pig
"Steam App 319510" = Five Nights at Freddy's
"Steam App 320" = Half-Life 2: Deathmatch
"Steam App 327890" = I am Bread
"Steam App 333930" = Dirty Bomb
"Steam App 334230" = Town of Salem
"Steam App 340" = Half-Life 2: Lost Coast
"Steam App 346110" = ARK: Survival Evolved
"Steam App 35140" = Batman: Arkham Asylum GOTY Edition
"Steam App 35700" = Trine
"Steam App 360" = Half-Life Deathmatch: Source
"Steam App 360760" = Run and Fire
"Steam App 362300" = H1Z1 Test Server
"Steam App 376030" = ARK: Survival Evolved Dedicated Server
"Steam App 380" = Half-Life 2: Episode One
"Steam App 40" = Deathmatch Classic
"Steam App 400" = Portal
"Steam App 4000" = Garry's Mod
"Steam App 420" = Half-Life 2: Episode Two
"Steam App 440" = Team Fortress 2
"Steam App 50" = Half-Life: Opposing Force
"Steam App 500" = Left 4 Dead
"Steam App 550" = Left 4 Dead 2
"Steam App 570" = Dota 2
"Steam App 60" = Ricochet
"Steam App 620" = Portal 2
"Steam App 70" = Half-Life
"Steam App 70600" = Worms Ultimate Mayhem
"Steam App 70620" = Worms Crazy Golf
"Steam App 70640" = Worms
"Steam App 70650" = Worms Blast
"Steam App 70660" = Worms Pinball
"Steam App 72850" = The Elder Scrolls V: Skyrim
"Steam App 730" = Counter-Strike: Global Offensive
"Steam App 745" = Counter-Strike: Global Offensive - SDK
"Steam App 80" = Counter-Strike: Condition Zero
"TeamViewer" = TeamViewer 10
"Uplay" = Uplay
"Uplay Install 274" = Watch_Dogs
"Uplay Install 895" = Assassin's Creed Rogue
"uTorrent" = µTorrent
"Winamp" = Winamp

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-516098057-2350176401-1669302986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"fb3f6ca9b67f53a3" = TwitchAlerts

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 29/06/2015 11:53:03 AM | Computer Name = Randaal-PC | Source = Adobe Reader | ID = 1048592
Description =

Error - 29/06/2015 8:35:58 PM | Computer Name = Randaal-PC | Source = WinMgmt | ID = 10
Description =

Error - 29/06/2015 8:35:59 PM | Computer Name = Randaal-PC | Source = .NET Runtime | ID = 1026
Description =

Error - 29/06/2015 8:36:00 PM | Computer Name = Randaal-PC | Source = Application Error | ID = 1000
Description = Název chybující aplikace: GoPro Importer.exe, verze: 2.5.5.56, časové
razítko: 0x555cbd4c Název chybujícího modulu: KERNELBASE.dll, verze: 6.1.7601.18869,
časové razítko: 0x556363bc Kód výjimky: 0xe0434352 Posun chyby: 0x0000c42d ID chybujícího
procesu: 0x1080 Čas spuštění chybující aplikace: 0x01d0b2ccbb0b5a39 Cesta k chybující
aplikaci: C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe Cesta k
chybujícímu modulu: C:\Windows\syswow64\KERNELBASE.dll ID zprávy: fab079b2-1ebf-11e5-8ccd-40e23013bea2

Error - 30/06/2015 8:26:54 PM | Computer Name = Randaal-PC | Source = Application Hang | ID = 1002
Description = Program csgo.exe verze 0.0.0.0 přestal spolupracovat se systémem Windows
a byl ukončen. Chcete-li zjistit, zda je k dispozici více informací o tomto problému,
vyhledejte historii problému v ovládacím panelu Centrum akcí. ID procesu: 2d84 Čas
spuštění: 01d0b36ae5385b49 Čas ukončení: 131 Cesta k aplikaci: X:\Games\SteamLibrary\steamapps\common\Counter-Strike
Global Offensive\csgo.exe ID hlášení:

Error - 06/07/2015 4:36:28 PM | Computer Name = Randaal-PC | Source = Application Hang | ID = 1002
Description = Program csgo.exe verze 0.0.0.0 přestal spolupracovat se systémem Windows
a byl ukončen. Chcete-li zjistit, zda je k dispozici více informací o tomto problému,
vyhledejte historii problému v ovládacím panelu Centrum akcí. ID procesu: 3d7c Čas
spuštění: 01d0b7daacc9f772 Čas ukončení: 180 Cesta k aplikaci: X:\Games\SteamLibrary\steamapps\common\Counter-Strike
Global Offensive\csgo.exe ID hlášení: a8cbe026-241e-11e5-8ccd-40e23013bea2

Error - 06/07/2015 4:40:30 PM | Computer Name = Randaal-PC | Source = WinMgmt | ID = 10
Description =

Error - 06/07/2015 4:40:33 PM | Computer Name = Randaal-PC | Source = .NET Runtime | ID = 1026
Description =

Error - 06/07/2015 4:40:34 PM | Computer Name = Randaal-PC | Source = Application Error | ID = 1000
Description = Název chybující aplikace: GoPro Importer.exe, verze: 2.5.5.56, časové
razítko: 0x555cbd4c Název chybujícího modulu: KERNELBASE.dll, verze: 6.1.7601.18869,
časové razítko: 0x556363bc Kód výjimky: 0xe0434352 Posun chyby: 0x0000c42d ID chybujícího
procesu: 0x1bd0 Čas spuštění chybující aplikace: 0x01d0b82c014964e8 Cesta k chybující
aplikaci: C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe Cesta k
chybujícímu modulu: C:\Windows\syswow64\KERNELBASE.dll ID zprávy: 3fd2f39b-241f-11e5-adbc-40e23013bea2

Error - 06/07/2015 7:56:56 PM | Computer Name = Randaal-PC | Source = Application Error | ID = 1000
Description = Název chybující aplikace: OBS.exe, verze: 0.6.5.1, časové razítko:
0x5512515f Název chybujícího modulu: KERNELBASE.dll, verze: 6.1.7601.18869, časové
razítko: 0x556366fd Kód výjimky: 0x80000003 Posun chyby: 0x0000000000033c62 ID chybujícího
procesu: 0x1fcc Čas spuštění chybující aplikace: 0x01d0b838a4445c5b Cesta k chybující
aplikaci: C:\Program Files\OBS\OBS.exe Cesta k chybujícímu modulu: C:\Windows\system32\KERNELBASE.dll
ID
zprávy: ae17e362-243a-11e5-adbc-40e23013bea2

[ System Events ]
Error - 06/07/2015 4:47:31 PM | Computer Name = Randaal-PC | Source = Schannel | ID = 36887
Description = Byla přijata následující výstraha o závažné chybě: 80.

Error - 06/07/2015 4:47:32 PM | Computer Name = Randaal-PC | Source = Schannel | ID = 36887
Description = Byla přijata následující výstraha o závažné chybě: 80.

Error - 06/07/2015 4:48:33 PM | Computer Name = Randaal-PC | Source = Schannel | ID = 36887
Description = Byla přijata následující výstraha o závažné chybě: 80.

Error - 06/07/2015 4:48:37 PM | Computer Name = Randaal-PC | Source = Schannel | ID = 36887
Description = Byla přijata následující výstraha o závažné chybě: 80.

Error - 06/07/2015 4:48:37 PM | Computer Name = Randaal-PC | Source = Schannel | ID = 36887
Description = Byla přijata následující výstraha o závažné chybě: 80.

Error - 06/07/2015 4:48:40 PM | Computer Name = Randaal-PC | Source = Schannel | ID = 36887
Description = Byla přijata následující výstraha o závažné chybě: 80.

Error - 06/07/2015 4:52:43 PM | Computer Name = Randaal-PC | Source = Schannel | ID = 36887
Description = Byla přijata následující výstraha o závažné chybě: 80.

Error - 06/07/2015 4:52:43 PM | Computer Name = Randaal-PC | Source = Schannel | ID = 36887
Description = Byla přijata následující výstraha o závažné chybě: 80.

Error - 06/07/2015 4:52:43 PM | Computer Name = Randaal-PC | Source = Schannel | ID = 36887
Description = Byla přijata následující výstraha o závažné chybě: 80.

Error - 06/07/2015 5:06:45 PM | Computer Name = Randaal-PC | Source = Schannel | ID = 36887
Description = Byla přijata následující výstraha o závažné chybě: 80.


< End of report >
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: Podezření na malware v PC

#13 Příspěvek od vyosek »

Do spodniho okna "Vlastni skenovani\opravy" jste nevlozil pozadovany skript (ten zeleny text). Takze jets jednou prosim - nyni se vytvori pouze log OTL.txt
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Uživatelský avatar
Randaal
Návštěvník
Návštěvník
Příspěvky: 58
Registrován: 20 říj 2008 22:57
Bydliště: Praha

Re: Podezření na malware v PC

#14 Příspěvek od Randaal »

ted jsem si všiml, že kod, který jsem měl vložit do programu je mnohem delší, než se mi prvotně zobrazilo při nastavení jiného phpBB skinu. Projedu test znovu s celým kodem a změním oba příspěvky
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: Podezření na malware v PC

#15 Příspěvek od vyosek »

Needitujte ty predchozi, vlozte to jako nove prispevky...
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Zamčeno

Zpět na „Řešení problémů, logy“