Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 14-05-2017 Ran by stvdd (administrator) on STIJN (19-05-2017 12:35:48) Running from C:\Users\stvdd\Downloads Loaded Profiles: stvdd (Available Profiles: stvdd & Admin & Ward B) Platform: Windows 8.1 Pro (Update) (X64) Language: English (United States) Internet Explorer Version 11 (Default browser: "C:\Program Files (x86)\Footjane\Application\chrome.exe" "%1") Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgrsa.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgcsrva.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvscpapisvr.exe (AMD) C:\Windows\System32\atiesrxx.exe (Intel Corporation) C:\Windows\System32\igfxCUIService.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe (Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgidsagent.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe (Digital Wave Ltd.) C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\app_updater.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgnsa.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgemca.exe () C:\Windows\SysWOW64\PnkBstrA.exe () C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe (Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe () C:\Program Files (x86)\D-Link\DWA-131\WlanWpsSvc.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe (Elex do Brasil Participações Ltda) C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe (Elex do Brasil Participações Ltda) C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc2.exe () C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe (Dropbox, Inc.) C:\Windows\System32\DbxSvc.exe () C:\Program Files\Gramblr\gramblr.exe (AMD) C:\Windows\System32\atieclxx.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.18384_none_fa1d93c39b41b41a\TiWorker.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer.exe (Intel Corporation) C:\Windows\System32\igfxEM.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_w32.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_x64.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Elex do Brasil Participações Ltda) C:\Program Files (x86)\Elex-tech\YAC\iSafeTray.exe (Spotify Ltd) C:\Users\stvdd\AppData\Roaming\Spotify\Spotify.exe (Spotify Ltd) C:\Users\stvdd\AppData\Roaming\Spotify\Spotify.exe (Spotify Ltd) C:\Users\stvdd\AppData\Roaming\Spotify\SpotifyWebHelper.exe (Spotify Ltd) C:\Users\stvdd\AppData\Roaming\Spotify\Spotify.exe (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe (Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\cnext.exe (Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe (Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AdobeGCClient.exe (Spotify Ltd) C:\Users\stvdd\AppData\Roaming\Spotify\SpotifyWebHelper.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\ShadowPlay\nvspcaps64.exe (Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe (Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Hyperdesktop) C:\Users\stvdd\AppData\Roaming\Hyperdesktop\hyperdesktop.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\ShadowPlay\nvsphelper64.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe () C:\Program Files (x86)\puush\puush.exe (Node.js) C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe (D-Link Corp.) C:\Program Files (x86)\D-Link\DWA-131 revA\wirelesscm.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe (Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgui.exe (Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe (Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD Utilities\WDDriveUtilitiesHelper.exe (Razer Inc.) C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\CCXProcess.exe (Node.js) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\libs\node.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\CCLibrary.exe (Node.js) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\libs\node.exe (Electronic Arts) C:\Program Files (x86)\Origin\Origin.exe (Google Inc.) C:\Program Files (x86)\Footjane\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Footjane\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Footjane\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Footjane\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Footjane\Application\chrome.exe (Electronic Arts) C:\Program Files (x86)\Origin\OriginWebHelperService.exe () C:\Program Files (x86)\Origin\QtWebEngineProcess.exe () C:\Program Files (x86)\Origin\QtWebEngineProcess.exe (NVIDIA Corporation) C:\Users\stvdd\AppData\Local\NVIDIA\NvBackend\ApplicationOntology\NvOAWrapperCache.exe ==================== Registry (Whitelisted) ==================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-10-16] (Apple Inc.) HKLM\...\Run: [StartCN] => C:\Program Files\AMD\CNext\CNext\cnext.exe [4867784 2015-12-04] (Advanced Micro Devices, Inc.) HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508128 2016-07-01] (Adobe Systems Incorporated) HKLM\...\Run: [ShadowPlay] => "C:\Windows\system32\rundll32.exe" C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [597040 2015-10-06] (Oracle Corporation) HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [28734456 2017-05-16] (Dropbox, Inc.) HKLM-x32\...\Run: [AvgUi] => C:\Program Files (x86)\AVG\Framework\Common\avguix.exe [1130408 2015-10-16] (AVG Technologies CZ, s.r.o.) HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\Av\avgui.exe [3826600 2015-10-23] (AVG Technologies CZ, s.r.o.) HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2404952 2017-03-27] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Nikon Message Center 2] => C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe [570880 2013-12-27] (Nikon Corporation) HKLM-x32\...\Run: [DriveUtilitiesHelper] => C:\Program Files (x86)\Western Digital\WD Utilities\WDDriveUtilitiesHelper.exe [1890664 2015-07-31] (Western Digital Technologies, Inc.) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [Razer Synapse] => C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe [596640 2017-04-13] (Razer Inc.) HKU\S-1-5-21-3221389058-4040619027-2354313775-1002\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3019552 2017-04-26] (Valve Corporation) HKU\S-1-5-21-3221389058-4040619027-2354313775-1002\...\Run: [Spotify Web Helper] => C:\Users\stvdd\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1449584 2017-05-13] (Spotify Ltd) HKU\S-1-5-21-3221389058-4040619027-2354313775-1002\...\Run: [Spotify] => C:\Users\stvdd\AppData\Roaming\Spotify\Spotify.exe [6997104 2017-05-13] (Spotify Ltd) HKU\S-1-5-21-3221389058-4040619027-2354313775-1002\...\Run: [GoogleChromeAutoLaunch_0890905F9E7760D6A0510AB859DB442D] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [1111896 2017-03-29] (Google Inc.) HKU\S-1-5-21-3221389058-4040619027-2354313775-1002\...\Run: [Hyperdesktop] => C:\Users\stvdd\AppData\Roaming\Hyperdesktop\hyperdesktop.exe [188880 2015-11-16] (Hyperdesktop) HKU\S-1-5-21-3221389058-4040619027-2354313775-1002\...\Run: [puush] => C:\Program Files (x86)\puush\puush.exe [568904 2015-11-18] () HKU\S-1-5-21-3221389058-4040619027-2354313775-1002\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3048312 2017-05-11] (Electronic Arts) HKU\S-1-5-21-3221389058-4040619027-2354313775-1002\...\Run: [AdobeBridge] => [X] HKU\S-1-5-21-3221389058-4040619027-2354313775-1002\...\RunOnce: [Application Restart #2] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2404952 2017-03-27] (Adobe Systems Incorporated) HKU\S-1-5-21-3221389058-4040619027-2354313775-1002\...\RunOnce: [Application Restart #3] => C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe [2380888 2017-03-27] (Adobe Systems Incorporated) HKLM\...\Providers\jkyb6cri: C:\Program Files (x86)\Zerbas Host\local64spl.dll [307200 2017-03-27] () IFEO\GoogleUpdate.exe: [Debugger] 324095823984.exe IFEO\GoogleUpdaterService.exe: [Debugger] 8736459873644.exe ShellExecuteHooks: No Name - {2CED3980-0D60-11E7-89DE-64006A5CFC23} - C:\Users\stvdd\AppData\Roaming\Cocussajuge\Bezdomduray.dll -> No File ShellIconOverlayIdentifiers: [ DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.16.0.dll [2017-05-16] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.16.0.dll [2017-05-16] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.16.0.dll [2017-05-16] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.16.0.dll [2017-05-16] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.16.0.dll [2017-05-16] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.16.0.dll [2017-05-16] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.16.0.dll [2017-05-16] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.16.0.dll [2017-05-16] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.16.0.dll [2017-05-16] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.16.0.dll [2017-05-16] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google) ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google) ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google) ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-10-25] () ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-10-25] () ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-10-25] () ShellIconOverlayIdentifiers-x32: [ DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.16.0.dll [2017-05-16] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.16.0.dll [2017-05-16] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.16.0.dll [2017-05-16] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.16.0.dll [2017-05-16] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.16.0.dll [2017-05-16] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.16.0.dll [2017-05-16] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.16.0.dll [2017-05-16] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.16.0.dll [2017-05-16] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.16.0.dll [2017-05-16] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.16.0.dll [2017-05-16] (Dropbox, Inc.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Wireless Connection Manager.lnk [2015-11-09] ShortcutTarget: Wireless Connection Manager.lnk -> C:\Program Files (x86)\D-Link\DWA-131 revA\wirelesscm.exe (D-Link Corp.) GroupPolicy: Restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 Tcpip\..\Interfaces\{A134907D-B8BD-4E4D-81E2-AD0D540979E1}: [DhcpNameServer] 192.168.1.1 Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.ourluckysites.com/?type=hp&ts=1495009935&z=6a208b5d717919177bbe012gezetcw7e2edtbt2c3q&from=che0812&uid=CrucialXCT256MX100SSD1_14450DB1A59F0DB1A59F HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.ourluckysites.com/?type=hp&ts=1495009935&z=6a208b5d717919177bbe012gezetcw7e2edtbt2c3q&from=che0812&uid=CrucialXCT256MX100SSD1_14450DB1A59F0DB1A59F HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.ourluckysites.com/search/?type=ds&ts=1495009935&z=6a208b5d717919177bbe012gezetcw7e2edtbt2c3q&from=che0812&uid=CrucialXCT256MX100SSD1_14450DB1A59F0DB1A59F&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.ourluckysites.com/search/?type=ds&ts=1495009935&z=6a208b5d717919177bbe012gezetcw7e2edtbt2c3q&from=che0812&uid=CrucialXCT256MX100SSD1_14450DB1A59F0DB1A59F&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.ourluckysites.com/?type=hp&ts=1495009935&z=6a208b5d717919177bbe012gezetcw7e2edtbt2c3q&from=che0812&uid=CrucialXCT256MX100SSD1_14450DB1A59F0DB1A59F HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.ourluckysites.com/?type=hp&ts=1495009935&z=6a208b5d717919177bbe012gezetcw7e2edtbt2c3q&from=che0812&uid=CrucialXCT256MX100SSD1_14450DB1A59F0DB1A59F HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.ourluckysites.com/search/?type=ds&ts=1495009935&z=6a208b5d717919177bbe012gezetcw7e2edtbt2c3q&from=che0812&uid=CrucialXCT256MX100SSD1_14450DB1A59F0DB1A59F&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.ourluckysites.com/search/?type=ds&ts=1495009935&z=6a208b5d717919177bbe012gezetcw7e2edtbt2c3q&from=che0812&uid=CrucialXCT256MX100SSD1_14450DB1A59F0DB1A59F&q={searchTerms} HKU\S-1-5-21-3221389058-4040619027-2354313775-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.ourluckysites.com/?type=hp&ts=1495009935&z=6a208b5d717919177bbe012gezetcw7e2edtbt2c3q&from=che0812&uid=CrucialXCT256MX100SSD1_14450DB1A59F0DB1A59F HKU\S-1-5-21-3221389058-4040619027-2354313775-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.ourluckysites.com/?type=hp&ts=1495009935&z=6a208b5d717919177bbe012gezetcw7e2edtbt2c3q&from=che0812&uid=CrucialXCT256MX100SSD1_14450DB1A59F0DB1A59F SearchScopes: HKU\S-1-5-21-3221389058-4040619027-2354313775-1002 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.ourluckysites.com/search/?type=ds&ts=1495009935&z=6a208b5d717919177bbe012gezetcw7e2edtbt2c3q&from=che0812&uid=CrucialXCT256MX100SSD1_14450DB1A59F0DB1A59F&q={searchTerms} SearchScopes: HKU\S-1-5-21-3221389058-4040619027-2354313775-1002 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.ourluckysites.com/search/?type=ds&ts=1495009935&z=6a208b5d717919177bbe012gezetcw7e2edtbt2c3q&from=che0812&uid=CrucialXCT256MX100SSD1_14450DB1A59F0DB1A59F&q={searchTerms} BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2017-05-12] (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_65\bin\ssv.dll [2015-11-10] (Oracle Corporation) BHO: AVG Web TuneUp -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files\AVG Web TuneUp\4.3.7.452\AVG Web TuneUp.dll => No File BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2017-05-12] (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_65\bin\jp2ssv.dll [2015-11-10] (Oracle Corporation) BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2017-05-12] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_65\bin\ssv.dll [2015-11-10] (Oracle Corporation) BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2015-09-03] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL [2017-05-12] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_65\bin\jp2ssv.dll [2015-11-10] (Oracle Corporation) Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-05-12] (Microsoft Corporation) Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-05-12] (Microsoft Corporation) Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-05-12] (Microsoft Corporation) Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-05-12] (Microsoft Corporation) FireFox: ======== FF DefaultProfile: o5e90ae2.default FF ProfilePath: C:\Users\stvdd\AppData\Roaming\Mozilla\Firefox\Profiles\o5e90ae2.default [not found] FF ProfilePath: C:\Users\stvdd\AppData\Roaming\Firefox\Firefox\Profiles\o5e90ae2.default [not found] FF Plugin: @java.com/DTPlugin,version=11.65.2 -> C:\Program Files\Java\jre1.8.0_65\bin\dtplugin\npDeployJava1.dll [2015-11-10] (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.65.2 -> C:\Program Files\Java\jre1.8.0_65\bin\plugin2\npjp2.dll [2015-11-10] (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation) FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-16] (VideoLAN) FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2017-03-27] (Adobe Systems) FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-10-08] () FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 -> C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll [2011-11-03] (ESN Social Software AB) FF Plugin-x32: @esn/esnlaunch,version=2.3.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.0\npesnlaunch.dll [2013-09-16] (ESN Social Software AB) FF Plugin-x32: @java.com/DTPlugin,version=11.65.2 -> C:\Program Files (x86)\Java\jre1.8.0_65\bin\dtplugin\npDeployJava1.dll [2015-11-10] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.65.2 -> C:\Program Files (x86)\Java\jre1.8.0_65\bin\plugin2\npjp2.dll [2015-11-10] (Oracle Corporation) FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2017-03-06] (Microsoft Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2017-03-06] (Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2016-06-03] (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2016-06-03] (NVIDIA Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.3\npGoogleUpdate3.dll [2017-04-20] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.3\npGoogleUpdate3.dll [2017-04-20] (Google Inc.) FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2017-03-27] (Adobe Systems) Chrome: ======= CHR DefaultProfile: ChromeDefaultData CHR HomePage: ChromeDefaultData -> hxxp://google.be/ CHR StartupUrls: ChromeDefaultData -> "hxxp://www.google.com/","hxxp://www.istartsurf.com/?type=hp&ts=1434726208&z=60811b67a1c36f64155b899gfz3c3zam7o8q7odg4o&from=cor&uid=CrucialXCT256MX100SSD1_14450DB1A59F0DB1A59F","hxxp://www.youndoo.com/?z=13267bafb40d7dcf9f28271g5zet8e7w1q6bbw4m0m&from=amz&uid=CrucialXCT256MX100SSD1_14450DB1A59F0DB1A59F&type=hp","hxxp://www.startpageing123.com/?type=hp&ts=1490960581&z=7df98778fb1113e0be6ca2fg7zbt1e9t1qee4w7baz&from=che0812&uid=CrucialXCT256MX100SSD1_14450DB1A59F0DB1A59F","hxxp://www.ourluckysites.com/?type=hp&ts=1495009935&z=6a208b5d717919177bbe012gezetcw7e2edtbt2c3q&from=che0812&uid=CrucialXCT256MX100SSD1_14450DB1A59F0DB1A59F" CHR DefaultSearchURL: ChromeDefaultData -> hxxp://www.ourluckysites.com/search/?type=ds&ts=1495009935&z=6a208b5d717919177bbe012gezetcw7e2edtbt2c3q&from=che0812&uid=CrucialXCT256MX100SSD1_14450DB1A59F0DB1A59F&q={searchTerms} CHR DefaultSearchKeyword: ChromeDefaultData -> ourluckysites CHR Profile: C:\Users\stvdd\AppData\Local\Google\Chrome\User Data\ChromeDefaultData [2017-05-19] <==== ATTENTION CHR Extension: (Google Slides) - C:\Users\stvdd\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-11-10] CHR Extension: (JavaScript Injector: Nicholas Workshop) - C:\Users\stvdd\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\abdogfafejmdomllalkdegagoehgbdbk [2015-11-10] CHR Extension: (Google Docs) - C:\Users\stvdd\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\aohghmighlieiainnegkcijnfilokake [2015-11-10] CHR Extension: (Google Drive) - C:\Users\stvdd\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-10] CHR Extension: (YouTube) - C:\Users\stvdd\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-10] CHR Extension: (Google Cast) - C:\Users\stvdd\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2017-04-23] CHR Extension: (Google Search) - C:\Users\stvdd\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-10] CHR Extension: (Google Sheets) - C:\Users\stvdd\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-11-10] CHR Extension: (Facebook Friend Inviter) - C:\Users\stvdd\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\fojfflomljfbdfdcfmiihnijjfnnakdn [2015-11-10] CHR Extension: (Google Docs Offline) - C:\Users\stvdd\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-15] CHR Extension: (AdBlock) - C:\Users\stvdd\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2017-04-18] CHR Extension: (IE Tab) - C:\Users\stvdd\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\hehijbfgiekmjfkfjpbkbammjbdenadd [2017-05-13] CHR Extension: (Cookies) - C:\Users\stvdd\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\iphcomljdfghbkdcfndaijbokpgddeno [2015-11-10] CHR Extension: (DotVPN — a better way to VPN) - C:\Users\stvdd\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\kpiecbcckbofpmkkkdibbllpinceiihk [2017-01-31] CHR Extension: (Facebook Invite All Friends 2016) - C:\Users\stvdd\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\lkifjigoeilijkcnpfdjbpdjgnbfibec [2016-06-18] CHR Extension: (AVG SafePrice) - C:\Users\stvdd\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\mbckjcfnjmoiinpgddefodcighgikkgn [2016-12-16] CHR Extension: (Chrome Web Store Payments) - C:\Users\stvdd\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-13] CHR Extension: (Google Tone) - C:\Users\stvdd\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\nnckehldicaciogcbchegobnafnjkcne [2016-06-30] CHR Extension: (Stylebot) - C:\Users\stvdd\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\oiaejidbmkiecgbjeifoejpgmdaleoha [2016-12-07] CHR Extension: (Gmail) - C:\Users\stvdd\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-11-10] CHR Extension: (Chrome Media Router) - C:\Users\stvdd\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-04-20] CHR Profile: C:\Users\stvdd\AppData\Local\Google\Chrome\User Data\System Profile [2017-03-27] CHR HKU\S-1-5-21-3221389058-4040619027-2354313775-1002\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [mbckjcfnjmoiinpgddefodcighgikkgn] - hxxps://clients2.google.com/service/update2/crx HKU\S-1-5-21-3221389058-4040619027-2354313775-1002\...\StartMenuInternet\ChromeHTML: -> C:\Program Files (x86)\Footjane\Application\chrome.exe (Google Inc.) <==== ATTENTION ==================== Services (Whitelisted) ==================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [771672 2017-03-14] (Adobe Systems Incorporated) R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2227312 2017-02-27] (Adobe Systems, Incorporated) R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-10-07] (Apple Inc.) S3 AvgAMPS; C:\Program Files (x86)\AVG\Av\avgamps.exe [595376 2015-10-23] (AVG Technologies CZ, s.r.o.) R2 AVGIDSAgent; C:\Program Files (x86)\AVG\Av\avgidsagent.exe [3815648 2015-10-23] (AVG Technologies CZ, s.r.o.) R2 avgsvc; C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe [1046952 2015-10-16] (AVG Technologies CZ, s.r.o.) S2 avgwd; C:\Program Files (x86)\AVG\Av\avgwdsvcx.exe [579776 2015-10-23] (AVG Technologies CZ, s.r.o.) R2 BIT; C:\ProgramData\BIT\BIT.dll [1857536 2017-05-17] (BIT) [File not signed] <==== ATTENTION R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [3801280 2017-05-04] (Microsoft Corporation) S2 CWASRE; C:\Users\stvdd\AppData\Local\CWASRE\Snare.dll [828416 2017-05-17] (IntertSect Alliance Pty Ltd) [File not signed] <==== ATTENTION S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-07-05] (Dropbox, Inc.) S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-07-05] (Dropbox, Inc.) R2 DbxSvc; C:\Windows\system32\DbxSvc.exe [48944 2017-05-16] (Dropbox, Inc.) R2 DigitalWave.Update.Service; C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\app_updater.exe [440808 2017-03-03] (Digital Wave Ltd.) S2 DoeyeSU; C:\Users\stvdd\AppData\Local\Temp\9\wfjs.exe [115616 2017-04-25] (北京暴风科技股份有限公司) <==== ATTENTION R2 FirefoxU; C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe [95232 2017-05-17] () [File not signed] <==== ATTENTION R2 gramblrclient; C:\Program Files\Gramblr\gramblr.exe [10316368 2015-12-02] () [File not signed] R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [355232 2015-08-09] (Intel Corporation) R2 iSafeService; C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe [131024 2016-12-02] (Elex do Brasil Participações Ltda) R2 NvContainerLocalSystem; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [492480 2017-04-26] (NVIDIA Corporation) S3 NvContainerNetworkService; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [492480 2017-04-26] (NVIDIA Corporation) R2 NvTelemetryContainer; C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe [425408 2017-04-26] (NVIDIA Corporation) S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2162064 2017-05-11] (Electronic Arts) R2 Origin Web Helper Service; C:\Program Files (x86)\Origin\OriginWebHelperService.exe [3136920 2017-05-11] (Electronic Arts) R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76152 2015-11-17] () R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2016-07-04] () R2 Razer Game Scanner Service; C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [189264 2016-09-25] () R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5702416 2015-09-11] (TeamViewer GmbH) S3 VSStandardCollectorService140; C:\Program Files (x86)\Microsoft Visual Studio 14.0\Team Tools\DiagnosticsHub\Collector\StandardCollector.Service.exe [56040 2015-11-19] (Microsoft Corporation) R2 WDDriveService; C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe [307064 2015-07-31] (Western Digital Technologies, Inc.) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [361824 2017-01-12] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [119872 2017-01-12] (Microsoft Corporation) R2 WinSAPSvc; C:\Users\stvdd\AppData\Roaming\WinSAPSvc\WinSAP.dll [1873920 2017-05-17] (TODO: <公司名>) [File not signed] <==== ATTENTION R2 WlanWpsSvc; C:\Program Files (x86)\D-Link\DWA-131\WlanWpsSvc.exe [167936 2008-06-26] () [File not signed] S2 YeshatSU; C:\Windows\TEMP\hp8263.tmp\ttff.exe [71152 2016-10-11] (Synacast) S2 DohatSU; "C:\Users\stvdd\AppData\Local\Temp\6\amp.exe" /i [X] <==== ATTENTION ===================== Drivers (Whitelisted) ====================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21160 2012-09-23] (Advanced Micro Devices, Inc.) S3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [102912 2015-07-15] (Advanced Micro Devices) S0 Avgboota; C:\Windows\System32\DRIVERS\avgboota.sys [23152 2015-09-09] (AVG Technologies CZ, s.r.o.) R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [197040 2015-08-10] (AVG Technologies CZ, s.r.o.) R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [313776 2015-10-19] (AVG Technologies CZ, s.r.o.) R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [298416 2015-08-20] (AVG Technologies CZ, s.r.o.) R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [284080 2015-10-21] (AVG Technologies CZ, s.r.o.) R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [398256 2015-08-14] (AVG Technologies CZ, s.r.o.) R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [255408 2015-10-21] (AVG Technologies CZ, s.r.o.) R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [42416 2015-08-10] (AVG Technologies CZ, s.r.o.) R1 Avgwfpa; C:\Windows\system32\DRIVERS\avgwfpa.sys [306608 2015-10-08] (AVG Technologies CZ, s.r.o.) S3 dg_ssudbus; C:\Windows\system32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.) R1 iSafeKrnl; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnl.sys [262344 2016-05-23] (Elex do Brasil Participações Ltda) <==== ATTENTION S3 iSafeKrnlBoot; C:\Windows\System32\DRIVERS\iSafeKrnlBoot.sys [55056 2016-05-23] (Elex do Brasil Participações Ltda) <==== ATTENTION R1 iSafeKrnlKit; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlKit.sys [110112 2016-05-23] (Elex do Brasil Participações Ltda) <==== ATTENTION R1 iSafeKrnlMon; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlMon.sys [52440 2016-05-23] (Elex do Brasil Participações Ltda) <==== ATTENTION R1 iSafeKrnlR3; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlR3.sys [103904 2016-05-23] (Elex do Brasil Participações Ltda) <==== ATTENTION R1 iSafeNetFilter; C:\Windows\System32\DRIVERS\iSafeNetFilter.sys [52392 2016-05-19] (Elex do Brasil Participações Ltda) <==== ATTENTION R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [129312 2014-09-30] (Intel Corporation) S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [30144 2017-04-26] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [47552 2017-04-26] (NVIDIA Corporation) R3 nvvhci; C:\Windows\System32\drivers\nvvhci.sys [57792 2017-04-26] (NVIDIA Corporation) R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2012-06-22] (Corel Corporation) S3 RTL8192cu; C:\Windows\system32\DRIVERS\rtwlanu.sys [986728 2012-02-10] (Realtek Semiconductor Corporation ) R3 rzendpt; C:\Windows\System32\drivers\rzendpt.sys [50384 2015-10-26] (Razer Inc) R2 rzpmgrk; C:\Windows\system32\drivers\rzpmgrk.sys [44144 2016-09-17] (Razer, Inc.) R2 rzpnk; C:\Windows\system32\drivers\rzpnk.sys [137840 2016-10-08] (Razer, Inc.) R3 SensorsSimulatorDriver; C:\Windows\system32\DRIVERS\WUDFRd.sys [226304 2014-11-21] (Microsoft Corporation) S3 ssudmdm; C:\Windows\system32\DRIVERS\ssudmdm.sys [165504 2016-09-05] (Samsung Electronics Co., Ltd.) S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [46600 2017-02-10] (Microsoft Corporation) S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [274776 2017-01-12] (Microsoft Corporation) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [117592 2017-01-12] (Microsoft Corporation) S3 dbx; system32\DRIVERS\dbx.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2017-05-19 12:35 - 2017-05-19 12:35 - 02429952 _____ (Farbar) C:\Users\stvdd\Downloads\FRST64.exe 2017-05-19 12:35 - 2017-05-19 12:35 - 00039152 _____ C:\Users\stvdd\Downloads\FRST.txt 2017-05-19 12:35 - 2017-05-19 12:35 - 00000000 ____D C:\FRST 2017-05-19 12:34 - 2017-05-19 12:34 - 00000000 ___HD C:\Users\Public\Documents\AdobeGC 2017-05-17 21:24 - 2017-05-17 21:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox 2017-05-17 12:10 - 2017-05-17 12:10 - 63035592 _____ (Malwarebytes ) C:\Users\stvdd\Downloads\mb3-setup-26964.26964-3.1.2.1733.exe 2017-05-17 12:09 - 2017-05-17 12:09 - 00000000 ____D C:\Users\stvdd\AppData\Local\Footjane 2017-05-17 11:35 - 2017-05-17 11:35 - 00002178 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk 2017-05-17 11:30 - 2017-05-17 11:30 - 00000000 ____D C:\Users\stvdd\AppData\Roaming\Elex-tech 2017-05-17 11:30 - 2017-05-17 11:30 - 00000000 ____D C:\Program Files (x86)\Firefox 2017-05-17 11:30 - 2017-05-17 11:30 - 00000000 ____D C:\Program Files (x86)\Elex-tech 2017-05-17 11:30 - 2017-05-17 11:30 - 00000000 ____D C:\Program Files (x86)\Default Company Name 2017-05-17 11:30 - 2016-05-23 04:41 - 00055056 _____ (Elex do Brasil Participações Ltda) C:\Windows\system32\Drivers\iSafeKrnlBoot.sys 2017-05-17 11:30 - 2016-05-19 08:42 - 00052392 _____ (Elex do Brasil Participações Ltda) C:\Windows\system32\Drivers\iSafeNetFilter.sys 2017-05-16 23:01 - 2017-05-16 23:01 - 00048944 _____ (Dropbox, Inc.) C:\Windows\system32\DbxSvc.exe 2017-05-16 12:12 - 2017-05-18 11:53 - 00000000 _____ C:\Users\Public\Documents\report.dat 2017-05-16 12:12 - 2017-05-17 11:30 - 00000000 _____ C:\Users\Public\Documents\temp.dat 2017-05-16 12:12 - 2017-05-16 12:12 - 00000000 ____D C:\Users\stvdd\AppData\Roaming\Firefox 2017-05-16 12:12 - 2017-05-16 12:12 - 00000000 ____D C:\Users\stvdd\AppData\Local\Firefox 2017-05-16 12:12 - 2017-05-16 12:12 - 00000000 ____D C:\Program Files (x86)\Footjane 2017-05-15 18:55 - 2017-05-15 18:55 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsignd4e91b6cbdd85a98 2017-05-15 18:55 - 2017-05-15 18:55 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsign91fa6d5e7774b5c1 2017-05-15 18:55 - 2017-05-15 18:55 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsign8598a58fa368bd16 2017-05-15 18:45 - 2017-05-15 18:58 - 00000000 ____D C:\Users\stvdd\Desktop\Insta 2017-05-15 16:25 - 2017-05-15 16:25 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsign2a10166a52837664 2017-05-15 16:20 - 2017-05-15 16:20 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsign828e2b7935e8010d 2017-05-15 16:20 - 2017-05-15 16:20 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsign7f94f06b3fc4334f 2017-05-15 10:06 - 2017-05-17 11:30 - 00003600 _____ C:\Windows\System32\Tasks\Milimili 2017-05-15 10:06 - 2017-05-17 10:32 - 00000000 ____D C:\Users\stvdd\AppData\Local\CWASRE 2017-05-15 10:06 - 2017-05-16 12:12 - 00001916 _____ C:\Users\stvdd\Desktop\big_bang_empire.lnk 2017-05-15 10:06 - 2017-05-16 12:12 - 00001890 _____ C:\Users\stvdd\Desktop\BigFarm.lnk 2017-05-15 10:06 - 2017-05-15 10:06 - 00000000 ____D C:\ProgramData\BIT 2017-05-15 10:05 - 2017-05-17 11:30 - 00000000 ____D C:\Users\stvdd\AppData\Roaming\WinSAPSvc 2017-05-15 10:03 - 2017-05-15 10:03 - 00000000 ____D C:\Program Files\jkyb6cri 2017-05-11 16:12 - 2017-05-11 16:12 - 487831571 _____ C:\Users\stvdd\Desktop\tester.mp4 2017-05-11 12:59 - 2017-05-11 12:59 - 02469156 _____ C:\Users\stvdd\Desktop\neonite_logo.webp 2017-05-11 12:52 - 2017-05-11 12:52 - 00000000 _____ C:\Windows\SysWOW64\3333333 2017-05-11 12:52 - 2017-05-11 12:52 - 00000000 _____ C:\Windows\SysWOW64\1111111 2017-05-11 12:51 - 2017-05-11 12:51 - 00000000 _____ C:\Windows\SysWOW64\00 2017-05-11 12:49 - 2017-05-11 12:49 - 00000000 ____D C:\Reerdition 2017-05-10 19:47 - 2017-05-10 19:47 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsigne50149e23a968e23 2017-05-10 19:39 - 2017-05-10 19:39 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsignb701848948dd4992 2017-05-10 19:39 - 2017-05-10 19:39 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsign5b5a62e93444904e 2017-05-10 18:00 - 2017-05-10 18:00 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsignbee1fc4a0b2691cf 2017-05-10 18:00 - 2017-05-10 18:00 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsignb639a553a441b52a 2017-05-10 18:00 - 2017-05-10 18:00 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsigna54a9b73fb37cea3 2017-05-10 16:47 - 2017-05-10 16:47 - 106304311 _____ C:\Users\stvdd\Desktop\madam april.mp4 2017-05-10 12:10 - 2017-04-28 23:15 - 07444824 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2017-05-10 12:10 - 2017-04-26 16:06 - 04169216 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2017-05-10 12:10 - 2017-04-16 12:23 - 02176584 _____ (Microsoft Corporation) C:\Windows\system32\combase.dll 2017-05-10 12:10 - 2017-04-16 12:23 - 01662096 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll 2017-05-10 12:10 - 2017-04-16 12:23 - 01063464 _____ (Microsoft Corporation) C:\Windows\system32\WinTypes.dll 2017-05-10 12:10 - 2017-04-16 12:18 - 01135288 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll 2017-05-10 12:10 - 2017-04-16 12:18 - 00803192 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll 2017-05-10 12:10 - 2017-04-16 11:07 - 01566032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\combase.dll 2017-05-10 12:10 - 2017-04-16 11:07 - 01213792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll 2017-05-10 12:10 - 2017-04-16 11:07 - 00548032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinTypes.dll 2017-05-10 12:10 - 2017-04-16 11:05 - 00612096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll 2017-05-10 12:10 - 2017-04-16 10:54 - 00576512 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2017-05-10 12:10 - 2017-04-16 10:54 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2017-05-10 12:10 - 2017-04-16 10:51 - 02899456 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2017-05-10 12:10 - 2017-04-16 10:37 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2017-05-10 12:10 - 2017-04-16 10:36 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2017-05-10 12:10 - 2017-04-16 10:35 - 25741312 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2017-05-10 12:10 - 2017-04-16 10:18 - 05977600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2017-05-10 12:10 - 2017-04-16 10:16 - 00862720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll 2017-05-10 12:10 - 2017-04-16 10:10 - 00087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx 2017-05-10 12:10 - 2017-04-16 10:03 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2017-05-10 12:10 - 2017-04-16 10:02 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2017-05-10 12:10 - 2017-04-16 10:01 - 00499200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2017-05-10 12:10 - 2017-04-16 10:00 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2017-05-10 12:10 - 2017-04-16 10:00 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2017-05-10 12:10 - 2017-04-16 09:53 - 02290176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2017-05-10 12:10 - 2017-04-16 09:52 - 01033216 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll 2017-05-10 12:10 - 2017-04-16 09:49 - 20278272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2017-05-10 12:10 - 2017-04-16 09:47 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2017-05-10 12:10 - 2017-04-16 09:43 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2017-05-10 12:10 - 2017-04-16 09:40 - 00806912 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2017-05-10 12:10 - 2017-04-16 09:40 - 00725504 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2017-05-10 12:10 - 2017-04-16 09:40 - 00378880 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2017-05-10 12:10 - 2017-04-16 09:37 - 02132992 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2017-05-10 12:10 - 2017-04-16 09:29 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx 2017-05-10 12:10 - 2017-04-16 09:24 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2017-05-10 12:10 - 2017-04-16 09:23 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll 2017-05-10 12:10 - 2017-04-16 09:22 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll 2017-05-10 12:10 - 2017-04-16 09:22 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2017-05-10 12:10 - 2017-04-16 09:17 - 00880640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll 2017-05-10 12:10 - 2017-04-16 09:12 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll 2017-05-10 12:10 - 2017-04-16 09:10 - 15250944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2017-05-10 12:10 - 2017-04-16 09:10 - 00693248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2017-05-10 12:10 - 2017-04-16 09:10 - 00330752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2017-05-10 12:10 - 2017-04-16 09:08 - 04548608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2017-05-10 12:10 - 2017-04-16 09:08 - 02057216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2017-05-10 12:10 - 2017-04-16 09:04 - 03241472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2017-05-10 12:10 - 2017-04-16 09:02 - 00267776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincorlib.dll 2017-05-10 12:10 - 2017-04-16 08:53 - 13661184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2017-05-10 12:10 - 2017-04-16 08:50 - 01544704 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2017-05-10 12:10 - 2017-04-16 08:40 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2017-05-10 12:10 - 2017-04-16 08:37 - 02767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2017-05-10 12:10 - 2017-04-16 08:34 - 01314816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2017-05-10 12:10 - 2017-04-16 08:34 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2017-05-10 12:10 - 2017-04-10 00:00 - 01548640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys 2017-05-10 12:10 - 2017-04-10 00:00 - 00388448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys 2017-05-10 12:10 - 2017-04-08 01:20 - 01375960 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2017-05-10 12:10 - 2017-04-07 15:56 - 01094656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2017-05-10 12:10 - 2017-04-02 18:41 - 00684544 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys 2017-05-10 12:10 - 2017-04-02 18:41 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys 2017-05-10 12:10 - 2017-04-01 01:16 - 01968408 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2017-05-10 12:10 - 2017-03-31 23:59 - 01612504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2017-05-10 12:10 - 2017-03-13 18:38 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\wmitomi.dll 2017-05-10 12:10 - 2017-03-13 18:29 - 02609664 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll 2017-05-10 12:10 - 2017-03-13 18:25 - 00285184 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll 2017-05-10 12:10 - 2017-03-13 18:13 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmitomi.dll 2017-05-10 12:10 - 2017-03-13 18:07 - 02170880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll 2017-05-10 12:10 - 2017-03-13 18:06 - 00236032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll 2017-05-10 12:10 - 2017-03-11 21:34 - 00201728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys 2017-05-10 12:10 - 2017-03-11 21:32 - 00401408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys 2017-05-10 12:10 - 2017-03-11 21:32 - 00285184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys 2017-05-10 12:10 - 2017-03-11 20:49 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll 2017-05-10 12:10 - 2017-03-11 19:58 - 01437696 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2017-05-10 12:10 - 2017-03-11 19:54 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll 2017-05-10 12:10 - 2017-03-11 01:38 - 02017624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys 2017-05-10 12:10 - 2017-03-11 01:38 - 00275800 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys 2017-05-10 12:10 - 2017-03-09 22:52 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\wisp.dll 2017-05-10 12:10 - 2017-03-09 21:17 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wisp.dll 2017-05-10 12:10 - 2017-03-08 04:44 - 00448285 _____ C:\Windows\system32\ApnDatabase.xml 2017-05-09 23:13 - 2017-05-09 23:13 - 00000044 _____ C:\Users\stvdd\Desktop\00023.13260.130481.wav 2017-05-09 23:12 - 2017-05-09 23:12 - 00000000 _____ C:\Users\stvdd\Desktop\00023.13260.130482.aac 2017-05-09 23:12 - 2017-05-09 23:12 - 00000000 _____ C:\Users\stvdd\Desktop\00023.13260.130481.aac 2017-05-09 23:00 - 2017-05-09 23:00 - 00000000 _____ C:\Users\stvdd\Desktop\00023.13260.17761.aac 2017-05-09 13:35 - 2017-05-17 11:30 - 00000000 _____ C:\Windows\SysWOW64\1111 2017-05-09 13:33 - 2017-05-09 13:33 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsign8a1fc384ac3b5c31 2017-05-09 13:33 - 2017-05-09 13:33 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsign33d4cfe0ca8f7309 2017-05-09 13:33 - 2017-05-09 13:33 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsign1e3482f9e0a5d53c 2017-05-09 12:56 - 2017-05-09 12:56 - 00000000 ____D C:\Reaqapytegupy 2017-05-08 16:59 - 2017-05-08 16:59 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsign702b24a1e77a09e4 2017-05-08 16:11 - 2017-05-08 17:16 - 00000000 ____D C:\Users\stvdd\Desktop\Foto's Open Air 2017-05-08 16:09 - 2017-05-08 16:09 - 00000000 ____D C:\Users\stvdd\Desktop\logos 2017-05-08 15:30 - 2017-05-08 15:30 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsign871ac70e34c121a4 2017-05-08 15:29 - 2017-05-08 15:29 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsignd48e15293915a6ed 2017-05-08 15:29 - 2017-05-08 15:29 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsigncefad396e114badf 2017-05-08 15:26 - 2017-05-08 15:28 - 00000000 ____D C:\Users\stvdd\Desktop\17.04.30 - abstrkt 2017-05-08 15:21 - 2017-05-08 15:21 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsignf5edc1ea1d966b25 2017-05-08 15:20 - 2017-05-08 15:20 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsign95acdf6809e28e84 2017-05-08 15:20 - 2017-05-08 15:20 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsign1a304e5a85031e5b 2017-05-08 14:51 - 2017-05-08 14:51 - 00000000 ____D C:\Users\Public\Documents\chrome 2017-05-08 13:55 - 2017-05-08 13:55 - 00000000 ____D C:\Program Files (x86)\59105C9D_jumpeasy 2017-05-05 14:59 - 2017-05-05 14:59 - 13179800 _____ C:\Users\stvdd\Desktop\affiches a3.pdf 2017-05-05 14:57 - 2017-05-05 14:57 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsign5bc97a4ab2a0bafb 2017-05-05 14:51 - 2017-05-05 14:51 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsign5ea8056c78ef1494 2017-05-05 14:51 - 2017-05-05 14:51 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsign586a42709f7fe1d0 2017-05-04 14:10 - 2017-05-18 16:34 - 00000000 _____ C:\Windows\SysWOW64\1 2017-05-03 02:57 - 2017-05-05 15:00 - 20975256 _____ C:\Users\stvdd\Desktop\affiches a2.pdf 2017-05-03 02:56 - 2017-05-03 17:30 - 04149379 _____ C:\Users\stvdd\Desktop\flyers.pdf 2017-05-02 17:06 - 2017-05-02 17:06 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsignc567894475c1c364 2017-05-02 17:06 - 2017-05-02 17:06 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsign83be8f63659c6a3a 2017-05-02 17:06 - 2017-05-02 17:06 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsign192abfae11492dae 2017-04-29 17:39 - 2017-04-29 17:39 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsignd3864ca09c2601d4 2017-04-29 17:39 - 2017-04-29 17:39 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsign6beb9d6dc1ef4138 2017-04-29 17:39 - 2017-04-29 17:39 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsign116d6b68245c0412 2017-04-28 18:29 - 2017-04-28 18:29 - 00000000 _____ C:\Users\stvdd\Desktop\µ.368.80321.aac 2017-04-28 16:25 - 2017-04-28 16:25 - 00000000 _____ C:\Users\stvdd\Desktop\µ.1368.18441.aac 2017-04-28 14:10 - 2017-04-28 14:10 - 00000000 _____ C:\Users\stvdd\Desktop\hap foods.1368.126561.aac 2017-04-28 14:05 - 2017-04-28 14:05 - 00000000 _____ C:\Users\stvdd\Desktop\hap food.1368.83642.aac 2017-04-28 14:04 - 2017-04-28 14:04 - 00000000 _____ C:\Users\stvdd\Desktop\hap food.1368.83641.aac 2017-04-28 13:55 - 2017-04-26 07:40 - 00153536 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll 2017-04-28 13:55 - 2017-04-26 07:40 - 00127424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll 2017-04-28 13:55 - 2017-04-26 07:40 - 00057792 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvhci.sys 2017-04-28 13:55 - 2017-04-26 07:40 - 00047552 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys 2017-04-28 13:30 - 2017-04-26 15:42 - 00637772 _____ C:\Users\stvdd\Desktop\VLK paashaas2.prproj 2017-04-28 09:44 - 2017-04-28 09:44 - 00000000 ____D C:\Alitkojck 2017-04-27 19:00 - 2017-04-27 19:00 - 00000000 ____D C:\Users\stvdd\AppData\Local\RzStats 2017-04-27 18:59 - 2017-04-27 18:59 - 00000000 ____D C:\Users\stvdd\AppData\Local\AdvancedConfigurator 2017-04-27 18:56 - 2016-10-08 08:56 - 00137840 _____ (Razer, Inc.) C:\Windows\system32\Drivers\rzpnk.sys 2017-04-27 18:56 - 2016-09-17 02:12 - 00044144 _____ (Razer, Inc.) C:\Windows\system32\Drivers\rzpmgrk.sys 2017-04-27 18:53 - 2017-04-27 18:56 - 00000000 ____D C:\ProgramData\Razer 2017-04-27 18:53 - 2017-04-27 18:56 - 00000000 ____D C:\Program Files (x86)\Razer 2017-04-27 18:53 - 2017-04-27 18:53 - 00000000 ____D C:\Users\stvdd\AppData\Local\Razer 2017-04-27 18:53 - 2017-04-27 18:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razer 2017-04-26 18:37 - 2017-04-26 18:37 - 330046123 _____ C:\Users\stvdd\Desktop\VGK Finaal.mp4 2017-04-26 15:32 - 2017-04-26 15:32 - 353582214 _____ C:\Users\stvdd\Desktop\Inpetto - Million Miles_1.mp4 2017-04-26 12:50 - 2017-04-26 12:50 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsigna1b5b5fe8d9282df 2017-04-26 12:49 - 2017-05-05 12:49 - 00000000 ____D C:\Insist 2017-04-26 12:48 - 2017-04-26 12:48 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsignbdd01a6c277ab464 2017-04-26 12:48 - 2017-04-26 12:48 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsign5d69f94d39b455ae 2017-04-26 03:26 - 2017-04-26 03:26 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsign3bf751a233a44eda 2017-04-26 03:26 - 2017-04-26 03:26 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsign37448ea5cd9960c8 2017-04-26 03:26 - 2017-04-26 03:26 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsign34b142805c0f3366 2017-04-26 00:15 - 2017-04-26 00:15 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsign749ab67b7f556510 2017-04-26 00:14 - 2017-04-26 00:14 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsigne4e56c565567d3f2 2017-04-26 00:14 - 2017-04-26 00:14 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsign6b24920ee0bec2a0 2017-04-25 15:53 - 2017-05-11 12:51 - 00000000 _____ C:\Windows\SysWOW64\22 2017-04-25 15:53 - 2017-05-11 12:51 - 00000000 _____ C:\Windows\SysWOW64\11 2017-04-25 15:53 - 2017-04-25 15:53 - 00000007 _____ C:\Windows\SysWOW64\2915.tmp 2017-04-25 15:51 - 2017-05-17 11:30 - 00000000 ____D C:\Program Files\MK 2017-04-25 13:36 - 2017-04-25 02:58 - 342840194 _____ C:\Users\stvdd\Documents\Inpetto - Million Miles.mp4 2017-04-24 08:50 - 2017-04-24 08:50 - 00000000 ____D C:\Windows\psgo 2017-04-20 22:52 - 2017-04-20 22:52 - 00001237 _____ C:\Users\Public\Desktop\Wondershare Data Recovery.lnk 2017-04-20 22:52 - 2017-04-20 22:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare 2017-04-20 22:48 - 2017-04-20 22:52 - 00000000 ____D C:\Users\Public\Documents\Wondershare 2017-04-20 22:48 - 2017-04-20 22:52 - 00000000 ____D C:\ProgramData\Wondershare 2017-04-20 22:48 - 2017-04-20 22:52 - 00000000 ____D C:\Program Files (x86)\Wondershare 2017-04-20 22:48 - 2017-04-20 22:48 - 00000000 ____D C:\Users\stvdd\AppData\Local\Wondershare 2017-04-19 13:58 - 2017-04-19 13:58 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsignf4d3dd3e2b06d2d0 2017-04-19 13:58 - 2017-04-19 13:58 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsignbb6e8d04293c0345 2017-04-19 13:58 - 2017-04-19 13:58 - 00000000 ____D C:\Users\stvdd\AppData\Local\Tempzxpsign580c4117730251ad 2017-04-19 10:51 - 2017-04-19 10:51 - 00000000 ____D C:\Users\stvdd\AppData\Local\3DM 2017-04-19 10:51 - 2017-04-19 10:51 - 00000000 ____D C:\Program Files (x86)\58F72523_jumpeasy ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2017-05-19 12:35 - 2015-11-17 03:14 - 00000000 ____D C:\Users\stvdd\AppData\Roaming\Origin 2017-05-19 12:35 - 2015-11-17 03:13 - 00000000 ____D C:\ProgramData\Origin 2017-05-19 12:34 - 2017-01-09 19:44 - 00000000 ___RD C:\Users\stvdd\Creative Cloud Files 2017-05-19 12:34 - 2016-07-04 15:02 - 00000000 ____D C:\Program Files (x86)\Origin 2017-05-19 12:34 - 2016-07-01 13:04 - 00000000 ____D C:\ProgramData\NVIDIA 2017-05-19 12:34 - 2015-11-26 15:08 - 00000000 ____D C:\ProgramData\Gramblr 2017-05-19 12:34 - 2015-11-12 15:53 - 00000000 ____D C:\Users\stvdd\AppData\Local\Adobe 2017-05-19 12:34 - 2015-11-11 12:47 - 00000000 __SHD C:\Users\stvdd\IntelGraphicsProfiles 2017-05-19 12:34 - 2015-11-10 01:44 - 00001024 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job 2017-05-19 12:34 - 2015-11-10 01:44 - 00001020 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job 2017-05-19 12:34 - 2015-11-10 01:43 - 00000000 ____D C:\Users\stvdd\AppData\Roaming\Spotify 2017-05-19 12:34 - 2015-11-10 01:43 - 00000000 ____D C:\Users\stvdd\AppData\Local\Spotify 2017-05-19 12:34 - 2015-11-10 01:37 - 00000000 ____D C:\Program Files (x86)\Steam 2017-05-18 16:23 - 2015-11-17 02:01 - 00000000 ____D C:\AdwCleaner 2017-05-18 16:21 - 2015-11-08 07:24 - 00000000 ____D C:\Users\stvdd\AppData\Local\Packages 2017-05-18 16:05 - 2015-11-08 07:29 - 00003600 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3221389058-4040619027-2354313775-1002 2017-05-18 11:11 - 2015-11-09 09:12 - 00003914 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{23016F9D-4D2B-4A1E-9D45-4C1CC5E538A1} 2017-05-17 21:24 - 2015-11-10 01:44 - 00000000 ____D C:\Program Files (x86)\Dropbox 2017-05-17 11:35 - 2017-04-04 11:21 - 00002215 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2017-05-17 11:30 - 2017-04-14 12:27 - 00001946 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk 2017-05-17 11:30 - 2017-04-14 12:27 - 00000000 ____D C:\Windows\system32\log 2017-05-17 11:30 - 2015-11-10 01:36 - 00002016 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2017-05-17 10:32 - 2015-11-08 07:24 - 00001762 _____ C:\Users\stvdd\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2017-05-17 03:18 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\AppReadiness 2017-05-17 03:02 - 2017-01-19 00:03 - 00000000 ___RD C:\Users\stvdd\Dropbox 2017-05-16 19:49 - 2015-11-16 23:52 - 00000000 ____D C:\Users\stvdd\AppData\Roaming\vlc 2017-05-16 14:49 - 2013-08-22 17:36 - 00000000 ___HD C:\Program Files\WindowsApps 2017-05-16 12:52 - 2014-11-21 09:38 - 00913650 _____ C:\Windows\system32\PerfStringBackup.INI 2017-05-16 12:52 - 2013-08-22 15:36 - 00000000 ____D C:\Windows\Inf 2017-05-16 12:47 - 2015-11-12 15:56 - 00000000 ____D C:\ProgramData\boost_interprocess 2017-05-16 12:46 - 2013-08-22 16:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2017-05-16 12:06 - 2016-06-23 14:37 - 00000000 ____D C:\Users\stvdd\Desktop\screenshot 2017-05-16 03:58 - 2015-11-19 18:12 - 00000000 ____D C:\Users\stvdd\AppData\Local\CrashDumps 2017-05-15 10:03 - 2017-03-27 00:49 - 00000000 ____D C:\Program Files (x86)\Coepageatovry 2017-05-13 12:39 - 2015-11-10 17:00 - 00000000 ____D C:\ProgramData\MFAData 2017-05-13 12:39 - 2013-08-22 15:25 - 00262144 ___SH C:\Windows\system32\config\ELAM 2017-05-13 02:45 - 2017-04-17 13:27 - 00000000 ____D C:\Windows\Update 2017-05-12 20:13 - 2015-11-10 01:38 - 00000000 ____D C:\Program Files (x86)\TeamViewer 2017-05-12 10:03 - 2015-11-23 17:09 - 00000000 ____D C:\Program Files (x86)\Microsoft Office 2017-05-12 10:03 - 2013-08-22 17:36 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft 2017-05-12 02:47 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\rescache 2017-05-11 13:34 - 2013-08-22 16:44 - 05200592 _____ C:\Windows\system32\FNTCACHE.DAT 2017-05-11 13:33 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\PolicyDefinitions 2017-05-11 13:32 - 2015-11-08 07:24 - 00000000 ____D C:\Users\stvdd 2017-05-11 02:06 - 2015-09-10 23:14 - 156335152 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe 2017-05-11 02:06 - 2013-08-22 17:20 - 00000000 ____D C:\Windows\CbsTemp 2017-05-10 03:02 - 2013-08-22 15:25 - 00524288 ___SH C:\Windows\system32\config\BBI 2017-05-09 23:35 - 2016-05-19 17:18 - 00000000 ____D C:\Users\stvdd\AppData\Roaming\TeamViewer 2017-05-08 13:54 - 2017-03-29 13:42 - 00000000 ____D C:\Program Files (x86)\jkyb6cri 2017-05-04 13:52 - 2016-07-01 18:54 - 00000000 ____D C:\Users\stvdd\Desktop\Export 2017-05-03 02:43 - 2015-11-25 21:02 - 00000000 ____D C:\Windows\Minidump 2017-05-02 10:46 - 2017-04-13 11:48 - 00000000 ____D C:\Users\stvdd\AppData\Local\SNARE 2017-04-29 00:44 - 2016-12-17 15:52 - 00835576 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2017-04-29 00:44 - 2016-12-17 15:52 - 00177656 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2017-04-28 17:57 - 2015-11-23 16:37 - 00000000 ____D C:\Users\stvdd\AppData\Roaming\uTorrent 2017-04-28 13:55 - 2017-01-25 03:35 - 00004146 _____ C:\Windows\System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} 2017-04-28 13:55 - 2017-01-25 03:35 - 00003852 _____ C:\Windows\System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} 2017-04-28 13:55 - 2017-01-25 03:35 - 00003738 _____ C:\Windows\System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} 2017-04-28 13:55 - 2017-01-25 03:35 - 00003738 _____ C:\Windows\System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} 2017-04-28 13:55 - 2017-01-25 03:35 - 00003730 _____ C:\Windows\System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} 2017-04-28 13:55 - 2017-01-25 03:35 - 00003554 _____ C:\Windows\System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} 2017-04-28 13:55 - 2017-01-25 03:35 - 00003494 _____ C:\Windows\System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} 2017-04-28 13:55 - 2017-01-25 03:35 - 00001432 _____ C:\Users\Public\Desktop\GeForce Experience.lnk 2017-04-28 13:55 - 2016-07-01 13:04 - 00000000 ____D C:\ProgramData\NVIDIA Corporation 2017-04-28 13:55 - 2016-07-01 13:03 - 00000000 ____D C:\Program Files\NVIDIA Corporation 2017-04-28 13:55 - 2016-01-07 22:24 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation 2017-04-28 13:39 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\system32\NDF 2017-04-28 01:00 - 2017-02-04 18:40 - 00000000 ____D C:\Users\stvdd\AppData\LocalLow\uTorrent 2017-04-26 07:40 - 2016-07-01 13:05 - 01882048 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll 2017-04-26 07:40 - 2016-07-01 13:05 - 01755072 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll 2017-04-26 07:40 - 2016-07-01 13:05 - 01472960 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll 2017-04-26 07:40 - 2016-07-01 13:05 - 01317312 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll 2017-04-26 07:40 - 2016-07-01 13:05 - 00121280 _____ C:\Windows\system32\NvRtmpStreamer64.dll 2017-04-26 07:03 - 2017-01-25 03:35 - 00001951 _____ C:\Windows\NvTelemetryContainerRecovery.bat 2017-04-25 15:53 - 2015-11-10 01:47 - 00000000 ____D C:\ProgramData\Apple 2017-04-24 08:50 - 2017-04-13 11:48 - 00000000 ____D C:\Users\stvdd\AppData\Local\Kitty 2017-04-20 01:08 - 2015-11-10 01:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive 2017-04-20 01:03 - 2015-11-10 01:36 - 00003488 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2017-04-20 01:03 - 2015-11-10 01:36 - 00003360 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore ==================== Files in the root of some directories ======= 2015-12-23 17:27 - 2016-10-18 16:28 - 0000033 _____ () C:\Users\stvdd\AppData\Roaming\AdobeWLCMCache.dat 2016-01-05 18:54 - 2016-01-05 18:54 - 0000112 _____ () C:\Users\stvdd\AppData\Roaming\JP2K CS6 Prefs 2015-11-18 01:48 - 2015-11-18 01:48 - 0000268 ___RH () C:\Users\stvdd\AppData\Roaming\Sampler Instruments 2015-11-18 01:48 - 2015-11-18 01:48 - 0000268 ___RH () C:\Users\stvdd\AppData\Roaming\Sci-Fi 2016-12-28 21:25 - 2016-12-28 21:30 - 0001456 _____ () C:\Users\stvdd\AppData\Local\Adobe Salva per Web e dispositivi 13.0 Prefs 2016-04-12 19:21 - 2016-05-17 12:00 - 0001456 _____ () C:\Users\stvdd\AppData\Local\Adobe Save for Web 13.0 Prefs 2015-11-18 01:48 - 2015-11-18 01:48 - 0000012 ___RH () C:\ProgramData\Applause and Laugher 2015-11-18 01:48 - 2015-11-18 01:48 - 0000012 ___RH () C:\ProgramData\Application Support 2015-11-18 01:47 - 2015-11-18 01:51 - 0000020 ____H () C:\ProgramData\PKP_DLbx.DAT 2015-11-18 01:48 - 2015-11-18 01:48 - 0000020 ____H () C:\ProgramData\PKP_DLck.DAT 2015-11-18 01:48 - 2015-11-18 01:48 - 0000268 ___RH () C:\ProgramData\Scripts Menu 2015-11-18 01:48 - 2015-11-18 01:48 - 0000268 ___RH () C:\ProgramData\Services ==================== Bamital & volsnap ====================== (There is no automatic fix for files that do not pass verification.) C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\dnsapi.dll => File is digitally signed C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2017-05-13 13:44 ==================== End of FRST.txt ============================