OTL logfile created on: 9/12/2017 13:30:44 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = D:\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.18837)
Locale: 00000813 | Country: België | Language: NLB | Date Format: d/MM/yyyy
 
7,48 Gb Total Physical Memory | 5,20 Gb Available Physical Memory | 69,59% Memory free
12,70 Gb Paging File | 10,24 Gb Available in Paging File | 80,66% Paging File free
Paging file location(s): c:\pagefile.sys 5346 5346 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 237,37 Gb Total Space | 171,74 Gb Free Space | 72,35% Space Free | Partition Type: NTFS
Drive D: | 629,85 Gb Total Space | 21,35 Gb Free Space | 3,39% Space Free | Partition Type: NTFS
Drive Y: | 250,56 Gb Total Space | 35,67 Gb Free Space | 14,24% Space Free | Partition Type: NTFS
Drive Z: | 50,00 Gb Total Space | 26,93 Gb Free Space | 53,86% Space Free | Partition Type: NTFS
 
Computer Name: BUREAU-PC | User Name: Michael | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
[color=#E56717]========== Processes (SafeList) ==========[/color]
 
PRC - [2017/12/09 13:28:51 | 000,602,112 | ---- | M] (OldTimer Tools) -- D:\Desktop\OTL.exe
PRC - [2017/12/05 12:38:54 | 009,238,192 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2017/12/05 12:38:25 | 000,281,416 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2017/09/27 11:27:08 | 000,083,984 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2017/08/08 03:47:03 | 003,632,848 | ---- | M] (COMODO) -- C:\Program Files (x86)\COMODO\Internet Security Essentials\vkise.exe
PRC - [2017/08/08 03:46:57 | 000,133,840 | ---- | M] (COMODO) -- C:\Program Files (x86)\COMODO\Internet Security Essentials\isesrv.exe
PRC - [2017/03/03 09:16:06 | 003,885,592 | ---- | M] (devolo AG) -- C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe
PRC - [2016/09/30 14:24:30 | 003,800,125 | ---- | M] (TransIP) -- C:\Program Files (x86)\stack\stack.exe
PRC - [2013/06/18 22:23:58 | 000,270,192 | R--- | M] (Western Digital Technologies, Inc.) -- C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe
PRC - [2013/06/18 22:21:20 | 001,694,080 | R--- | M] (Western Digital Technologies, Inc.) -- C:\Program Files (x86)\Western Digital\WD Security\WDDriveAutoUnlock.exe
PRC - [2012/04/14 01:57:20 | 000,111,080 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
PRC - [2011/07/12 09:14:25 | 000,331,776 | R--- | M] (VIA Technologies, Inc.) -- C:\VIA_XHCI\usb3Monitor.exe
PRC - [2011/04/13 23:37:06 | 000,312,616 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
PRC - [2011/04/13 23:37:04 | 000,070,952 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
PRC - [2011/03/30 22:01:10 | 000,087,336 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
 
 
[color=#E56717]========== Modules (No Company Name) ==========[/color]
 
MOD - [2017/12/05 12:38:27 | 000,244,584 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\tasks_core.dll
MOD - [2017/12/05 12:38:27 | 000,237,808 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\event_routing_rpc.dll
MOD - [2017/12/05 12:38:25 | 000,167,096 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
MOD - [2017/12/05 12:38:25 | 000,059,040 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\module_lifetime.dll
MOD - [2017/12/05 12:38:18 | 000,235,816 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\gaming_mode_ui.dll
MOD - [2017/06/30 15:14:59 | 067,109,376 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\libcef.dll
MOD - [2016/09/30 14:22:22 | 002,033,436 | ---- | M] () -- C:\Program Files (x86)\stack\libstacksync.dll
MOD - [2016/09/30 14:21:32 | 001,195,072 | ---- | M] () -- C:\Program Files (x86)\stack\libocsync.dll
MOD - [2016/05/09 21:13:28 | 000,048,461 | ---- | M] () -- C:\Program Files (x86)\stack\libqt5keychain.dll
MOD - [2016/04/21 17:48:36 | 000,231,727 | ---- | M] () -- C:\Program Files (x86)\stack\libxslt-1.dll
MOD - [2016/04/21 17:07:42 | 000,097,326 | ---- | M] () -- C:\Program Files (x86)\stack\libgcc_s_sjlj-1.dll
MOD - [2016/04/21 17:07:26 | 000,922,727 | ---- | M] () -- C:\Program Files (x86)\stack\libstdc++-6.dll
MOD - [2016/04/21 16:10:18 | 000,247,540 | ---- | M] () -- C:\Program Files (x86)\stack\libwebp-4.dll
MOD - [2016/04/21 15:51:32 | 001,169,416 | ---- | M] () -- C:\Program Files (x86)\stack\libxml2-2.dll
MOD - [2016/04/21 15:49:26 | 000,209,711 | ---- | M] () -- C:\Program Files (x86)\stack\libpng16-16.dll
MOD - [2016/04/21 15:48:10 | 002,197,765 | ---- | M] () -- C:\Program Files (x86)\stack\icui18n53.dll
MOD - [2016/04/21 15:48:08 | 001,308,778 | ---- | M] () -- C:\Program Files (x86)\stack\icuuc53.dll
MOD - [2016/04/21 15:48:06 | 021,539,975 | ---- | M] () -- C:\Program Files (x86)\stack\icudata53.dll
MOD - [2016/04/21 15:47:22 | 001,366,986 | ---- | M] () -- C:\Program Files (x86)\stack\libGLESv2.dll
MOD - [2016/04/21 15:47:22 | 000,154,982 | ---- | M] () -- C:\Program Files (x86)\stack\libEGL.dll
MOD - [2016/04/21 15:46:14 | 000,689,339 | ---- | M] () -- C:\Program Files (x86)\stack\libsqlite3-0.dll
MOD - [2016/04/21 15:45:16 | 000,350,662 | ---- | M] () -- C:\Program Files (x86)\stack\libjpeg-8.dll
MOD - [2016/04/21 15:45:14 | 000,085,548 | ---- | M] () -- C:\Program Files (x86)\stack\zlib1.dll
MOD - [2016/04/21 15:44:46 | 000,148,117 | ---- | M] () -- C:\Program Files (x86)\stack\libpcre16-0.dll
MOD - [2012/04/14 02:18:24 | 000,016,360 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
MOD - [2012/04/14 02:08:50 | 000,623,080 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
 
 
[color=#E56717]========== Services (SafeList) ==========[/color]
 
SRV:[b]64bit:[/b] - [2017/12/05 12:38:25 | 000,281,416 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV:[b]64bit:[/b] - [2017/12/05 12:38:19 | 007,549,928 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe -- (aswbIDSAgent)
SRV:[b]64bit:[/b] - [2017/11/21 21:26:06 | 010,880,832 | ---- | M] (COMODO) [Auto | Running] -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe -- (CmdAgent)
SRV:[b]64bit:[/b] - [2017/11/21 21:19:35 | 002,876,096 | ---- | M] (COMODO) [On_Demand | Stopped] -- C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe -- (cmdvirth)
SRV:[b]64bit:[/b] - [2017/10/14 09:01:18 | 000,116,224 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)
SRV:[b]64bit:[/b] - [2017/08/07 09:25:08 | 006,058,960 | ---- | M] (Malwarebytes) [On_Demand | Stopped] -- C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe -- (MBAMService)
SRV:[b]64bit:[/b] - [2016/11/09 08:15:43 | 001,386,496 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\diagtrack.dll -- (DiagTrack)
SRV:[b]64bit:[/b] - [2013/05/27 06:50:47 | 001,011,712 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:[b]64bit:[/b] - [2012/03/29 09:49:16 | 000,361,984 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)
SRV:[b]64bit:[/b] - [2012/03/29 03:19:10 | 000,235,520 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2017/12/08 17:22:01 | 000,194,000 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2017/09/27 11:27:08 | 000,083,984 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2017/08/08 03:46:57 | 000,133,840 | ---- | M] (COMODO) [Auto | Running] -- C:\Program Files (x86)\COMODO\Internet Security Essentials\isesrv.exe -- (isesrv)
SRV - [2017/04/21 13:53:36 | 000,107,656 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2017/03/03 09:16:06 | 003,885,592 | ---- | M] (devolo AG) [Auto | Running] -- C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe -- (DevoloNetworkService)
SRV - [2016/08/27 10:42:38 | 000,754,784 | ---- | M] (DEVGURU Co., LTD.) [Disabled | Stopped] -- C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe -- (ss_conn_service)
SRV - [2015/01/08 16:20:56 | 000,067,224 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2013/06/18 22:23:58 | 000,270,192 | R--- | M] (Western Digital Technologies, Inc.) [Auto | Running] -- C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe -- (WDDriveService)
SRV - [2011/09/28 01:47:38 | 000,025,824 | ---- | M] (Memeo) [Auto | Running] -- C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe -- (MemeoBackgroundService)
SRV - [2011/04/13 23:37:06 | 000,312,616 | ---- | M] (CyberLink) [Auto | Running] -- C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe -- (CyberLink PowerDVD 10 MS Service)
SRV - [2011/04/13 23:37:04 | 000,070,952 | ---- | M] (CyberLink) [Auto | Running] -- C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe -- (CyberLink PowerDVD 10 MS Monitor Service)
SRV - [2010/12/20 19:30:26 | 000,153,176 | ---- | M] () [Disabled | Stopped] -- C:\Program Files (x86)\PURE Flow Server\twonkymediaserverwatchdog.exe -- (PURE Flow Server)
SRV - [2007/12/17 23:00:00 | 000,163,840 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE -- (EPSON_EB_RPCV4_01)
SRV - [2007/01/11 23:02:00 | 000,126,464 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE -- (EPSON_PM_RPCV4_01)
 
 
[color=#E56717]========== Driver Services (SafeList) ==========[/color]
 
DRV:[b]64bit:[/b] - [2017/12/09 09:16:22 | 000,252,232 | ---- | M] (Malwarebytes) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV:[b]64bit:[/b] - [2017/12/05 12:38:54 | 000,455,376 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSP.sys -- (aswSP)
DRV:[b]64bit:[/b] - [2017/12/05 12:38:35 | 000,203,976 | ---- | M] (AVAST Software) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\aswStm.sys -- (aswStm)
DRV:[b]64bit:[/b] - [2017/12/05 12:38:34 | 000,364,464 | ---- | M] (AVAST Software) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswVmm.sys -- (aswVmm)
DRV:[b]64bit:[/b] - [2017/12/05 12:38:34 | 000,183,584 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswArPot.sys -- (aswArPot)
DRV:[b]64bit:[/b] - [2017/12/05 12:38:34 | 000,148,288 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:[b]64bit:[/b] - [2017/12/05 12:38:34 | 000,110,376 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr)
DRV:[b]64bit:[/b] - [2017/12/05 12:38:34 | 000,084,416 | ---- | M] (AVAST Software) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswRvrt.sys -- (aswRvrt)
DRV:[b]64bit:[/b] - [2017/12/05 12:38:34 | 000,047,008 | ---- | M] (AVAST Software) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\aswHwid.sys -- (aswHwid)
DRV:[b]64bit:[/b] - [2017/12/05 12:38:20 | 001,026,232 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx)
DRV:[b]64bit:[/b] - [2017/12/05 12:38:17 | 000,343,288 | ---- | M] (AVAST Software s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\aswbloga.sys -- (aswblog)
DRV:[b]64bit:[/b] - [2017/12/05 12:38:17 | 000,321,032 | ---- | M] (AVAST Software s.r.o.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswbidsdrivera.sys -- (aswbidsdriver)
DRV:[b]64bit:[/b] - [2017/12/05 12:38:17 | 000,198,968 | ---- | M] (AVAST Software s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\aswbidsha.sys -- (aswbidsh)
DRV:[b]64bit:[/b] - [2017/12/05 12:38:17 | 000,057,728 | ---- | M] (AVAST Software s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\aswbuniva.sys -- (aswbuniv)
DRV:[b]64bit:[/b] - [2017/11/16 14:40:37 | 000,034,280 | ---- | M] (COMODO) [File_System | System | Running] -- C:\Windows\SysNative\drivers\cmderd.sys -- (cmderd)
DRV:[b]64bit:[/b] - [2017/08/08 03:46:27 | 000,050,856 | ---- | M] (COMODO) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\isedrv.sys -- (isedrv)
DRV:[b]64bit:[/b] - [2017/01/14 22:15:38 | 000,165,504 | ---- | M] (Samsung Electronics Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm)
DRV:[b]64bit:[/b] - [2017/01/14 22:14:40 | 000,131,712 | ---- | M] (Samsung Electronics Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus)
DRV:[b]64bit:[/b] - [2016/11/28 00:57:38 | 000,077,832 | ---- | M] (Advanced Card Systems Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\a38ccid.sys -- (A38CCID)
DRV:[b]64bit:[/b] - [2016/03/10 20:51:42 | 000,023,200 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wdcsam64.sys -- (WDC_SAM)
DRV:[b]64bit:[/b] - [2015/05/08 17:49:39 | 000,158,024 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadserd.sys -- (ssadserd)
DRV:[b]64bit:[/b] - [2015/05/08 17:49:38 | 000,188,232 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadmdm.sys -- (ssadmdm)
DRV:[b]64bit:[/b] - [2015/05/08 17:49:38 | 000,021,320 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadmdfl.sys -- (ssadmdfl)
DRV:[b]64bit:[/b] - [2015/05/08 17:49:37 | 000,169,288 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadbus.sys -- (ssadbus)
DRV:[b]64bit:[/b] - [2012/03/29 08:30:26 | 010,830,336 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:[b]64bit:[/b] - [2012/03/29 02:09:08 | 000,328,192 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:[b]64bit:[/b] - [2012/03/01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:[b]64bit:[/b] - [2012/02/23 13:32:04 | 000,095,760 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)
DRV:[b]64bit:[/b] - [2012/02/16 12:42:00 | 000,676,968 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:[b]64bit:[/b] - [2012/01/13 21:05:56 | 000,056,448 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbfilter.sys -- (usbfilter)
DRV:[b]64bit:[/b] - [2011/12/12 21:52:44 | 000,082,048 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amd_sata.sys -- (amd_sata)
DRV:[b]64bit:[/b] - [2011/12/12 21:52:44 | 000,042,624 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amd_xata.sys -- (amd_xata)
DRV:[b]64bit:[/b] - [2011/11/14 12:01:22 | 000,204,800 | R--- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ViaHub3.sys -- (VUSB3HUB)
DRV:[b]64bit:[/b] - [2011/11/14 12:01:12 | 000,256,000 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\xhcdrv.sys -- (xhcdrv)
DRV:[b]64bit:[/b] - [2011/10/26 04:16:46 | 000,219,776 | ---- | M] (Advanced Micro Devices, INC.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdxhc.sys -- (amdxhc)
DRV:[b]64bit:[/b] - [2011/10/26 04:16:46 | 000,102,528 | ---- | M] (Advanced Micro Devices, INC.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdhub30.sys -- (amdhub30)
DRV:[b]64bit:[/b] - [2011/03/11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:[b]64bit:[/b] - [2011/03/11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:[b]64bit:[/b] - [2010/11/25 14:59:00 | 000,694,888 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RTL8192su.sys -- (RTL8192su)
DRV:[b]64bit:[/b] - [2010/11/21 04:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:[b]64bit:[/b] - [2010/11/21 04:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:[b]64bit:[/b] - [2010/11/21 04:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:[b]64bit:[/b] - [2010/09/23 21:03:06 | 000,129,008 | ---- | M] (CyberLink) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wsvd.sys -- (wsvd)
DRV:[b]64bit:[/b] - [2010/02/18 17:18:24 | 000,046,136 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdiox64.sys -- (amdiox64)
DRV:[b]64bit:[/b] - [2009/07/14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:[b]64bit:[/b] - [2009/07/14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:[b]64bit:[/b] - [2009/07/14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:[b]64bit:[/b] - [2009/06/10 21:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:[b]64bit:[/b] - [2009/06/10 21:35:35 | 000,408,960 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvm62x64.sys -- (NVENETFD)
DRV:[b]64bit:[/b] - [2009/06/10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:[b]64bit:[/b] - [2009/06/10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:[b]64bit:[/b] - [2009/06/10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:[b]64bit:[/b] - [2009/06/10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2017/03/03 09:16:40 | 000,036,496 | ---- | M] (Riverbed Technology, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysWOW64\drivers\npf_devolo.sys -- (NPF_devolo)
DRV - [2009/07/14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
[color=#E56717]========== Standard Registry (SafeList) ==========[/color]
 
 
[color=#E56717]========== Internet Explorer ==========[/color]
 
IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3281580978-1972669021-3677266868-1001\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-3281580978-1972669021-3677266868-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.aldi.com/
IE - HKU\S-1-5-21-3281580978-1972669021-3677266868-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page_TIMESTAMP = 28 9C F7 07 0A 98 D1 01  [binary data]
IE - HKU\S-1-5-21-3281580978-1972669021-3677266868-1001\SOFTWARE\Microsoft\Internet Explorer\Main,SyncHomePage Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy = Reg Error: Value error.
IE - HKU\S-1-5-21-3281580978-1972669021-3677266868-1001\..\SearchScopes,DefaultScope = {177E3AFC-D91C-42BE-9FB1-431D57B668B6}
IE - HKU\S-1-5-21-3281580978-1972669021-3677266868-1001\..\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66}: "URL" = http://www.google.com/search?q={searchTerms}
IE - HKU\S-1-5-21-3281580978-1972669021-3677266868-1001\..\SearchScopes\{177E3AFC-D91C-42BE-9FB1-431D57B668B6}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7MDNE_enDE393
IE - HKU\S-1-5-21-3281580978-1972669021-3677266868-1001\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKU\S-1-5-21-3281580978-1972669021-3677266868-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
[color=#E56717]========== FireFox ==========[/color]
 
FF - prefs.js..browser.search.countryCode: "BE"
FF - prefs.js..browser.search.defaultengine: "Google (avast)"
FF - prefs.js..browser.search.defaultthis.engineName: "Google (avast)"
FF - prefs.js..browser.search.defaulturl: "https://www.google.com/search/?trackid=sp-006"
FF - prefs.js..browser.search.highlightCount: 4
FF - prefs.js..browser.search.order.1: "Google (avast)"
FF - prefs.js..browser.search.region: "BE"
FF - prefs.js..browser.search.selectedEngine: "Google (avast)"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.search.widget.inNavBar: true
FF - prefs.js..browser.startup.homepage: "about:home"
FF - prefs.js..keyword.URL: "https://www.google.com/search/?trackid=sp-006"
FF - user.js - File not found
 
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_27_0_0_187.dll File not found
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll ( Microsoft Corporation)
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_27_0_0_187.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1231201.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.2.1: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 57.0.2\extensions\\Components: C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\COMPONENTS
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 57.0.2\extensions\\Plugins: C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\PLUGINS [2017/08/25 15:54:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\belgiumeid@eid.belgium.be: C:\Program Files\Mozilla Firefox\extensions\belgiumeid@eid.belgium.be
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 57.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 57.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2017/08/25 15:54:49 | 000,000,000 | ---D | M]
 
[2014/04/07 22:47:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\Extensions
[2017/12/05 12:45:02 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\SystemExtensionsDev
[2017/09/17 18:00:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\Firefox\Profiles\5x1neyqd.default\browser-extension-data
[2017/09/17 18:00:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\Firefox\Profiles\5x1neyqd.default\browser-extension-data\screenshots@mozilla.org
[2017/12/09 09:15:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\Firefox\Profiles\5x1neyqd.default\browser-extension-data\wrc@avast.com
[2017/12/05 17:10:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\Firefox\Profiles\5x1neyqd.default\extensions
[2017/12/05 17:10:06 | 000,008,031 | ---- | M] () (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\5x1neyqd.default\extensions\belgiumeid@eid.belgium.be.xpi
[2017/10/06 11:12:30 | 000,707,252 | ---- | M] () (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\5x1neyqd.default\extensions\wrc@avast.com.xpi
[2017/12/05 17:10:07 | 000,005,507 | ---- | M] () (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\5x1neyqd.default\features\{db81b65b-1679-4dd2-aee1-8508334e29ef}\disable-media-wmf-nv12@mozilla.org.xpi
[2016/10/01 18:13:56 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2016/10/01 18:13:56 | 000,000,000 | ---D | M] (eID België) -- C:\Program Files (x86)\Mozilla Firefox\extensions\belgiumeid@eid.belgium.be
[2017/12/08 17:22:01 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions
 
[color=#E56717]========== Chrome  ==========[/color]
 
CHR - default_search_provider:  (Enabled)
CHR - default_search_provider: search_url = 
CHR - default_search_provider: suggest_url = 
CHR - plugin: Shockwave Flash () = C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\gcswf32.dll
CHR - plugin: Shockwave Flash () = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll
CHR - plugin: Adobe Acrobat () = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In () = c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll
CHR - plugin: Shockwave for Director () = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Chrome NaCl () = C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer () = C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\pdf.dll
CHR - plugin: Google Update () = C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 7 U3 () = C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: Windows Live™ Photo Gallery () = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Default Plug-in () = default_plugin
CHR - Extension: No name found = C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcdgjlkefibpdnepeljmlfkbbbpkoamf\0.1.4_0\
CHR - Extension: No name found = C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.3_0\
CHR - Extension: No name found = C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\6217.911.0.5_0\
 
O1 HOSTS File: ([2009/06/10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:[b]64bit:[/b] - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O2:[b]64bit:[/b] - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3:[b]64bit:[/b] - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:[b]64bit:[/b] - HKU\S-1-5-21-3281580978-1972669021-3677266868-1001\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O4:[b]64bit:[/b] - HKLM..\Run: [AvastUI.exe] C:\Program Files\AVAST Software\Avast\AvLaunch.exe (AVAST Software)
O4:[b]64bit:[/b] - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cistray.exe (COMODO)
O4:[b]64bit:[/b] - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:[b]64bit:[/b] - HKLM..\Run: [VIAxHCUtl] C:\VIA_XHCI\usb3Monitor.exe (VIA Technologies, Inc.)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [IseUI] C:\Program Files (x86)\COMODO\Internet Security Essentials\vkise.exe (COMODO)
O4 - HKLM..\Run: [RemoteControl10] C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [WD Drive Unlocker] C:\Program Files (x86)\Western Digital\WD Security\WDDriveAutoUnlock.exe (Western Digital Technologies, Inc.)
O4 - HKU\S-1-5-21-3281580978-1972669021-3677266868-1001..\Run: [stack] C:\Program Files (x86)\stack\stack.exe (TransIP)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SoftwareSASGeneration = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O13 - gopher Prefix: missing
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{88246C3E-2A13-4974-83C9-CA57F3D4EDA5}: DhcpNameServer = 192.168.1.1
O18:[b]64bit:[/b] - Protocol\Handler\ms-help - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\wlmailhtml - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\wlpg - No CLSID value found
O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{145981f7-e6fe-11e5-90ab-8c89a5e46ee0}\Shell - "" = AutoRun
O33 - MountPoints2\{145981f7-e6fe-11e5-90ab-8c89a5e46ee0}\Shell\AutoRun\command - "" = "L:\WD Drive Unlock.exe" autoplay=true
O33 - MountPoints2\{aab072aa-c22a-11e3-b0f3-8c89a5e46ee0}\Shell - "" = AutoRun
O33 - MountPoints2\{aab072aa-c22a-11e3-b0f3-8c89a5e46ee0}\Shell\AutoRun\command - "" = G:\unlock.exe autoplay=true
O33 - MountPoints2\{aab072b9-c22a-11e3-b0f3-8c89a5e46ee0}\Shell - "" = AutoRun
O33 - MountPoints2\{aab072b9-c22a-11e3-b0f3-8c89a5e46ee0}\Shell\AutoRun\command - "" = N:\unlock.exe autoplay=true
O33 - MountPoints2\{c73f0cb9-da64-11e7-87b7-8c89a5e46ee0}\Shell - "" = AutoRun
O33 - MountPoints2\{c73f0cb9-da64-11e7-87b7-8c89a5e46ee0}\Shell\AutoRun\command - "" = H:\unlock.exe autoplay=true
O33 - MountPoints2\{d652ca1e-bd09-11e3-8318-94dbc9aa712d}\Shell - "" = AutoRun
O33 - MountPoints2\{d652ca1e-bd09-11e3-8318-94dbc9aa712d}\Shell\AutoRun\command - "" = M:\Unlock.exe autoplay=true
O33 - MountPoints2\{ee4c63a5-981b-11e4-ba62-8c89a5e46ee0}\Shell - "" = AutoRun
O33 - MountPoints2\{ee4c63a5-981b-11e4-ba62-8c89a5e46ee0}\Shell\AutoRun\command - "" = "F:\WD Drive Unlock.exe" autoplay=true
O34 - HKLM BootExecute: (autocheck autochk *)
O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %*
O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %*
O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
 
[2017/12/09 13:28:41 | 000,602,112 | ---- | C] (OldTimer Tools) -- D:\Desktop\OTL.exe
[2017/12/09 12:55:06 | 000,000,000 | ---D | C] -- C:\ProgramData\SWCUTemp
[2017/12/09 09:16:22 | 000,252,232 | ---- | C] (Malwarebytes) -- C:\Windows\SysNative\drivers\mbamswissarmy.sys
[2017/12/08 19:15:27 | 000,000,000 | ---D | C] -- C:\FRST
[2017/12/07 18:43:42 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Local\{010FCFFF-CD0C-4147-BC8C-02B58CE6F947}
[2017/12/06 18:02:07 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Avast Software
[2017/12/05 12:38:50 | 000,183,584 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswArPot.sys
[2017/12/05 12:38:46 | 000,365,168 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe
[2017/12/05 11:09:10 | 005,979,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2017/12/05 11:09:09 | 014,635,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wmp.dll
[2017/12/05 11:09:09 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2017/12/05 11:09:08 | 011,410,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wmp.dll
[2017/12/05 11:09:08 | 002,319,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tquery.dll
[2017/12/05 11:09:08 | 002,134,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2017/12/05 11:09:08 | 002,058,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2017/12/05 11:09:08 | 002,058,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Query.dll
[2017/12/05 11:09:08 | 001,549,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tquery.dll
[2017/12/05 11:09:08 | 000,995,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ucrtbase.dll
[2017/12/05 11:09:08 | 000,968,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe
[2017/12/05 11:09:08 | 000,922,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ucrtbase.dll
[2017/12/05 11:09:08 | 000,807,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2017/12/05 11:09:08 | 000,662,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2017/12/05 11:09:08 | 000,576,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2017/12/05 11:09:08 | 000,382,696 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysNative\atmfd.dll
[2017/12/05 11:09:08 | 000,339,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msexcl40.dll
[2017/12/05 11:09:08 | 000,308,456 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\atmfd.dll
[2017/12/05 11:09:08 | 000,151,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\t2embed.dll
[2017/12/05 11:09:08 | 000,111,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\t2embed.dll
[2017/12/05 11:09:08 | 000,066,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-crt-private-l1-1-0.dll
[2017/12/05 11:09:08 | 000,022,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-crt-math-l1-1-0.dll
[2017/12/05 11:09:08 | 000,020,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-crt-math-l1-1-0.dll
[2017/12/05 11:09:08 | 000,017,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-crt-string-l1-1-0.dll
[2017/12/05 11:09:08 | 000,017,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-crt-string-l1-1-0.dll
[2017/12/05 11:09:08 | 000,017,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-crt-stdio-l1-1-0.dll
[2017/12/05 11:09:08 | 000,016,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-crt-runtime-l1-1-0.dll
[2017/12/05 11:09:08 | 000,015,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-crt-convert-l1-1-0.dll
[2017/12/05 11:09:08 | 000,014,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-crt-time-l1-1-0.dll
[2017/12/05 11:09:08 | 000,014,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-2-0.dll
[2017/12/05 11:09:08 | 000,014,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-2-0.dll
[2017/12/05 11:09:08 | 000,012,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-crt-process-l1-1-0.dll
[2017/12/05 11:09:08 | 000,012,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-crt-heap-l1-1-0.dll
[2017/12/05 11:09:08 | 000,012,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-crt-locale-l1-1-0.dll
[2017/12/05 11:09:08 | 000,012,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-crt-environment-l1-1-0.dll
[2017/12/05 11:09:08 | 000,012,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-crt-environment-l1-1-0.dll
[2017/12/05 11:09:08 | 000,012,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-2-0.dll
[2017/12/05 11:09:08 | 000,011,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l2-1-0.dll
[2017/12/05 11:09:08 | 000,011,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-timezone-l1-1-0.dll
[2017/12/05 11:09:08 | 000,011,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-2-0.dll
[2017/12/05 11:09:07 | 002,222,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mssrch.dll
[2017/12/05 11:09:07 | 001,359,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll
[2017/12/05 11:09:07 | 001,155,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmlmedia.dll
[2017/12/05 11:09:07 | 000,800,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll
[2017/12/05 11:09:07 | 000,778,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mssvp.dll
[2017/12/05 11:09:07 | 000,726,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2017/12/05 11:09:07 | 000,615,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2017/12/05 11:09:07 | 000,491,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mssph.dll
[2017/12/05 11:09:07 | 000,489,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll
[2017/12/05 11:09:07 | 000,417,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec
[2017/12/05 11:09:07 | 000,327,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\usbport.sys
[2017/12/05 11:09:07 | 000,315,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll
[2017/12/05 11:09:07 | 000,092,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2017/12/05 11:09:07 | 000,070,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\fontsub.dll
[2017/12/05 11:09:07 | 000,063,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-crt-private-l1-1-0.dll
[2017/12/05 11:09:07 | 000,019,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-crt-multibyte-l1-1-0.dll
[2017/12/05 11:09:07 | 000,019,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-crt-multibyte-l1-1-0.dll
[2017/12/05 11:09:07 | 000,017,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-crt-stdio-l1-1-0.dll
[2017/12/05 11:09:07 | 000,016,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-crt-runtime-l1-1-0.dll
[2017/12/05 11:09:07 | 000,015,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-crt-convert-l1-1-0.dll
[2017/12/05 11:09:07 | 000,014,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-crt-time-l1-1-0.dll
[2017/12/05 11:09:07 | 000,013,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-crt-filesystem-l1-1-0.dll
[2017/12/05 11:09:07 | 000,013,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-crt-filesystem-l1-1-0.dll
[2017/12/05 11:09:07 | 000,012,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-crt-process-l1-1-0.dll
[2017/12/05 11:09:07 | 000,012,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-crt-heap-l1-1-0.dll
[2017/12/05 11:09:07 | 000,012,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-crt-conio-l1-1-0.dll
[2017/12/05 11:09:07 | 000,012,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-crt-conio-l1-1-0.dll
[2017/12/05 11:09:07 | 000,012,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-crt-utility-l1-1-0.dll
[2017/12/05 11:09:07 | 000,012,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-crt-utility-l1-1-0.dll
[2017/12/05 11:09:07 | 000,012,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-crt-locale-l1-1-0.dll
[2017/12/05 11:09:07 | 000,012,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-2-0.dll
[2017/12/05 11:09:07 | 000,012,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-1.dll
[2017/12/05 11:09:07 | 000,012,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-1.dll
[2017/12/05 11:09:07 | 000,011,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l2-1-0.dll
[2017/12/05 11:09:07 | 000,011,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-timezone-l1-1-0.dll
[2017/12/05 11:09:07 | 000,011,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l2-1-0.dll
[2017/12/05 11:09:07 | 000,011,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l2-1-0.dll
[2017/12/05 11:09:07 | 000,011,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-2-0.dll
[2017/12/05 11:09:06 | 012,574,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wmploc.DLL
[2017/12/05 11:09:06 | 001,400,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mssrch.dll
[2017/12/05 11:09:06 | 000,814,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9diag.dll
[2017/12/05 11:09:06 | 000,710,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll
[2017/12/05 11:09:06 | 000,666,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mssvp.dll
[2017/12/05 11:09:06 | 000,620,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9diag.dll
[2017/12/05 11:09:06 | 000,476,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2017/12/05 11:09:06 | 000,341,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec
[2017/12/05 11:09:06 | 000,337,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mssph.dll
[2017/12/05 11:09:06 | 000,288,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mssphtb.dll
[2017/12/05 11:09:06 | 000,249,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SearchProtocolHost.exe
[2017/12/05 11:09:06 | 000,199,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll
[2017/12/05 11:09:06 | 000,168,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll
[2017/12/05 11:09:06 | 000,152,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\occache.dll
[2017/12/05 11:09:06 | 000,144,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2017/12/05 11:09:06 | 000,130,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll
[2017/12/05 11:09:06 | 000,116,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollector.exe
[2017/12/05 11:09:06 | 000,115,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2017/12/05 11:09:06 | 000,115,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mssitlb.dll
[2017/12/05 11:09:06 | 000,113,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SearchFilterHost.exe
[2017/12/05 11:09:06 | 000,107,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inseng.dll
[2017/12/05 11:09:06 | 000,104,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mssitlb.dll
[2017/12/05 11:09:06 | 000,100,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\fontsub.dll
[2017/12/05 11:09:06 | 000,099,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mssprxy.dll
[2017/12/05 11:09:06 | 000,091,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inseng.dll
[2017/12/05 11:09:06 | 000,088,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MshtmlDac.dll
[2017/12/05 11:09:06 | 000,087,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tdc.ocx
[2017/12/05 11:09:06 | 000,077,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\JavaScriptCollectionAgent.dll
[2017/12/05 11:09:06 | 000,076,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2017/12/05 11:09:06 | 000,075,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msscntrs.dll
[2017/12/05 11:09:06 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tdc.ocx
[2017/12/05 11:09:06 | 000,066,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2017/12/05 11:09:06 | 000,064,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MshtmlDac.dll
[2017/12/05 11:09:06 | 000,062,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2017/12/05 11:09:06 | 000,060,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
[2017/12/05 11:09:06 | 000,059,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msscntrs.dll
[2017/12/05 11:09:06 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwproxystub.dll
[2017/12/05 11:09:06 | 000,047,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieetwproxystub.dll
[2017/12/05 11:09:06 | 000,046,080 | ---- | C] (Adobe Systems) -- C:\Windows\SysNative\atmlib.dll
[2017/12/05 11:09:06 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\lpk.dll
[2017/12/05 11:09:06 | 000,034,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2017/12/05 11:09:06 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\SysWow64\atmlib.dll
[2017/12/05 11:09:06 | 000,030,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2017/12/05 11:09:06 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msshooks.dll
[2017/12/05 11:09:06 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dciman32.dll
[2017/12/05 11:09:06 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\spwmp.dll
[2017/12/05 11:09:06 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msshooks.dll
[2017/12/05 11:09:06 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\spwmp.dll
[2017/12/05 11:09:06 | 000,007,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\usbd.sys
[2017/12/05 11:09:06 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msdxm.ocx
[2017/12/05 11:09:06 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxmasf.dll
[2017/12/05 11:09:06 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msdxm.ocx
[2017/12/05 11:09:06 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dxmasf.dll
[2017/12/05 11:09:05 | 012,574,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wmploc.DLL
[2017/12/05 11:09:04 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollectorres.dll
[2017/12/05 11:08:31 | 002,023,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\aitstatic.exe
[2017/12/05 11:08:31 | 001,570,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\appraiser.dll
[2017/12/05 11:08:31 | 000,670,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\generaltel.dll
[2017/12/05 11:08:31 | 000,605,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\aeinv.dll
[2017/12/05 11:08:31 | 000,603,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\devinv.dll
[2017/12/05 11:08:31 | 000,407,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\centel.dll
[2017/12/05 11:08:31 | 000,370,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\invagent.dll
[2017/12/05 11:08:31 | 000,241,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\aepic.dll
[2017/12/05 11:08:31 | 000,181,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\acmigration.dll
[2017/12/05 11:08:31 | 000,134,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\CompatTelRunner.exe
[2017/11/25 01:09:57 | 002,390,528 | ---- | C] (Farbar) -- D:\Desktop\FRST64.exe
[1 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
 
[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
 
[2017/12/09 13:28:51 | 000,602,112 | ---- | M] (OldTimer Tools) -- D:\Desktop\OTL.exe
[2017/12/09 13:02:12 | 000,024,800 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2017/12/09 13:02:12 | 000,024,800 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2017/12/09 13:01:16 | 001,885,888 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2017/12/09 13:01:16 | 000,905,126 | ---- | M] () -- C:\Windows\SysNative\perfh013.dat
[2017/12/09 13:01:16 | 000,657,212 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2017/12/09 13:01:16 | 000,202,854 | ---- | M] () -- C:\Windows\SysNative\perfc013.dat
[2017/12/09 13:01:16 | 000,123,024 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2017/12/09 12:54:24 | 000,000,008 | RHS- | M] () -- C:\ProgramData\ntuser.pol
[2017/12/09 12:54:20 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2017/12/09 12:54:17 | 1726,803,967 | -HS- | M] () -- C:\hiberfil.sys
[2017/12/09 12:52:29 | 002,390,528 | ---- | M] (Farbar) -- D:\Desktop\FRST64.exe
[2017/12/09 09:16:22 | 000,252,232 | ---- | M] (Malwarebytes) -- C:\Windows\SysNative\drivers\mbamswissarmy.sys
[2017/12/08 20:58:14 | 000,000,583 | ---- | M] () -- D:\Desktop\Aanmelden bij je Microsoft-account.website
[2017/12/08 20:56:06 | 000,000,597 | ---- | M] () -- D:\Desktop\Gmail.website
[2017/12/08 13:22:19 | 000,000,558 | ---- | M] () -- D:\Desktop\BNP Paribas Fortis.website
[2017/12/05 13:04:25 | 000,001,078 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2017/12/05 13:00:14 | 000,002,155 | ---- | M] () -- C:\Users\Michael\Application Data\Microsoft\Internet Explorer\Quick Launch\Smart Switch.lnk
[2017/12/05 13:00:14 | 000,002,131 | ---- | M] () -- C:\Users\Public\Desktop\Smart Switch.lnk
[2017/12/05 12:58:17 | 000,002,188 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Digital Editions 4.5.lnk
[2017/12/05 12:53:11 | 000,000,830 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2017/12/05 12:50:42 | 000,803,328 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2017/12/05 12:50:42 | 000,144,896 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2017/12/05 12:42:36 | 000,003,424 | ---- | M] () -- C:\Windows\SysNative\drivers\fvstore.dat
[2017/12/05 12:38:54 | 000,455,376 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSP.sys
[2017/12/05 12:38:53 | 000,045,704 | ---- | M] () -- C:\Windows\SysNative\drivers\staport.sys
[2017/12/05 12:38:35 | 000,203,976 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswStm.sys
[2017/12/05 12:38:34 | 000,455,384 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSP.sys.151247393430604
[2017/12/05 12:38:34 | 000,365,168 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe
[2017/12/05 12:38:34 | 000,364,464 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswVmm.sys
[2017/12/05 12:38:34 | 000,183,584 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswArPot.sys
[2017/12/05 12:38:34 | 000,148,288 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswMonFlt.sys
[2017/12/05 12:38:34 | 000,110,376 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswRdr2.sys
[2017/12/05 12:38:34 | 000,084,416 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswRvrt.sys
[2017/12/05 12:38:34 | 000,047,008 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswHwid.sys
[2017/12/05 12:38:20 | 001,026,232 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSnx.sys
[2017/12/05 12:38:17 | 000,343,288 | ---- | M] (AVAST Software s.r.o.) -- C:\Windows\SysNative\drivers\aswbloga.sys
[2017/12/05 12:38:17 | 000,321,032 | ---- | M] (AVAST Software s.r.o.) -- C:\Windows\SysNative\drivers\aswbidsdrivera.sys
[2017/12/05 12:38:17 | 000,198,968 | ---- | M] (AVAST Software s.r.o.) -- C:\Windows\SysNative\drivers\aswbidsha.sys
[2017/12/05 12:38:17 | 000,057,728 | ---- | M] (AVAST Software s.r.o.) -- C:\Windows\SysNative\drivers\aswbuniva.sys
[2017/12/05 12:25:09 | 127,017,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\MRT-KB890830.exe
[2017/12/05 12:19:16 | 000,412,392 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2017/12/05 11:12:08 | 001,859,620 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2017/12/05 09:31:05 | 000,002,211 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2017/11/30 19:26:55 | 000,000,468 | ---- | M] () -- D:\Desktop\VDK.website
[2017/11/30 01:09:33 | 000,000,547 | ---- | M] () -- D:\Desktop\Facebook.website
[2017/11/29 18:57:43 | 000,000,704 | ---- | M] () -- D:\Desktop\Deezer.website
[2017/11/25 19:12:41 | 000,000,558 | ---- | M] () -- D:\Desktop\DOCCLE.website
[2017/11/24 20:07:26 | 000,000,513 | ---- | M] () -- D:\Desktop\Mijn Telenet.website
[2017/11/22 16:49:33 | 000,000,560 | ---- | M] () -- D:\Desktop\Proximus Forum.website
[2017/11/21 21:25:54 | 000,051,808 | ---- | M] (COMODO) -- C:\Windows\SysNative\cmdcsr.dll
[2017/11/21 21:25:42 | 000,702,376 | ---- | M] (COMODO) -- C:\Windows\SysWow64\guard32.dll
[2017/11/21 21:25:36 | 000,912,792 | ---- | M] (COMODO) -- C:\Windows\SysNative\guard64.dll
[2017/11/21 21:23:12 | 000,467,136 | ---- | M] (COMODO) -- C:\Windows\SysNative\cmdvrt64.dll
[2017/11/21 21:21:42 | 000,371,392 | ---- | M] (COMODO) -- C:\Windows\SysWow64\cmdvrt32.dll
[2017/11/17 02:02:24 | 000,000,441 | ---- | M] () -- D:\Desktop\Ivago.website
[2017/11/16 16:34:37 | 000,000,933 | ---- | M] () -- D:\Desktop\ExtractNow.lnk
[2017/11/16 14:40:37 | 000,034,280 | ---- | M] (COMODO) -- C:\Windows\SysNative\drivers\cmderd.sys
[1 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
 
[color=#E56717]========== Files Created - No Company Name ==========[/color]
 
[2017/12/05 12:38:53 | 000,045,704 | ---- | C] () -- C:\Windows\SysNative\drivers\staport.sys
[2017/12/05 08:19:56 | 1726,803,967 | -HS- | C] () -- C:\hiberfil.sys
[2017/08/09 07:36:36 | 000,518,144 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2016/10/18 14:18:46 | 000,038,453 | ---- | C] () -- C:\Users\Michael\AppData\Roaming\Door lijstscheidingstekens gescheiden waarden (DOS).ADR
[2016/06/01 11:06:01 | 000,024,064 | ---- | C] () -- C:\Windows\zoek-delete.exe
[2015/11/12 16:05:45 | 000,000,008 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2015/11/05 02:23:37 | 000,000,001 | ---- | C] () -- C:\Users\Michael\AppData\Local\llftool.4.40.agreement
[2015/04/08 13:49:32 | 000,007,610 | ---- | C] () -- C:\Users\Michael\AppData\Local\Resmon.ResmonCfg
 
[color=#E56717]========== ZeroAccess Check ==========[/color]
 
[2009/07/14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2017/08/15 16:29:44 | 014,182,400 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2017/08/15 16:10:54 | 012,880,896 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/21 04:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
[color=#E56717]========== Alternate Data Streams ==========[/color]
 
@Alternate Data Stream - 64 bytes -> D:\Documents\SSDcenter.be_Factuur_309948702.pdf:$CmdTcID
@Alternate Data Stream - 64 bytes -> D:\Documents\SKMBT_36315050513390.pdf:$CmdTcID
@Alternate Data Stream - 64 bytes -> D:\Documents\Sandra_Vermeulen[1].pdf:$CmdTcID
@Alternate Data Stream - 64 bytes -> D:\Documents\PDAshop.be_Factuur_448340202.pdf:$CmdTcID
@Alternate Data Stream - 64 bytes -> D:\Documents\PDAshop.be_Factuur_448340202 Samsung J5 (2016).pdf:$CmdTcID
@Alternate Data Stream - 64 bytes -> D:\Documents\MANUAL_KN-TTUSB100_COMP.PDF:$CmdTcID
@Alternate Data Stream - 64 bytes -> D:\Documents\lenco_l833dd_l830dd_turntable_service_manual.pdf:$CmdTcID
@Alternate Data Stream - 64 bytes -> D:\Documents\Labels Stad Gent.zip:$CmdTcID
@Alternate Data Stream - 64 bytes -> D:\Desktop\hjsplit.exe:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\zoek-delete.exe:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\WsmWmiPl.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\WsmSvc.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\WsmRes.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\wsmprovhost.exe:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\wsmplpxy.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\WsmAuto.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\WSManMigrationPlugin.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\WSManHTTPConfig.exe:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\WMVXENCD.DLL:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\WMVSENCD.DLL:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\WMVSDECD.DLL:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\WMVENCOD.DLL:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\WMVDECOD.DLL:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\WMSPDMOE.DLL:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\WMSPDMOD.DLL:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\wmpmde.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\WMPhoto.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\wmdrmsdk.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\WMADMOE.DLL:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\WMADMOD.DLL:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\winsta.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\WindowsCodecs.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\WebClnt.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\wdi.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\WcsPlugInService.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\VIDRESZR.DLL:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\user32.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\UIAnimation.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\ubpm.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\typeperf.exe:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\TsWpfWrp.exe:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\tracerpt.exe:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\tintlgnt.ime:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\tdh.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\sechost.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\scesrv.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\RESAMPLEDMO.DLL:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\relog.exe:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\rastls.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\quick.ime:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\qintlgnt.ime:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\qedit.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\qdvd.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\qasf.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\PresentationCFFRasterizerNative_v0300.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\poqexec.exe:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\pintlgnt.ime:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\phon.ime:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\packager.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\olepro32.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\nlsbres.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\nlaapi.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\ncsi.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\mtxoci.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\msxml6r.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\msxml6.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\msxml3r.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\msxml3.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\MSVidCtl.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\mstsc.exe:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\msscp.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\msorcl32.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\msnetobj.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\msmpeg2vdec.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\MSMPEG2ENC.DLL:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\msmpeg2adec.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\msimsg.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\msihnd.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\msiexec.exe:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\msi.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\mscms.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\MPG4DECD.DLL:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\MP4SDECD.DLL:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\MP43DECD.DLL:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\MP3DMOD.DLL:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\MFWMAAEC.DLL:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\mfvdsp.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\mfplat.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\logman.exe:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\ksuser.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\ksproxy.ax:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\KBDYAK.DLL:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\KBDTAT.DLL:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\KBDRU1.DLL:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\KBDRU.DLL:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\KBDBASH.DLL:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\input.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\InkEd.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\infocardapi.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\INETRES.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\inetcomm.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\imkr80.ime:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\IMJP10K.DLL:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\IMJP10.IME:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\icm32.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\icardres.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\icardagt.exe:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\hlink.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\explorer.exe:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\evr.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\EncDec.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\els.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\dwmcore.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\dwmapi.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\drmv2clt.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\drmmgrtn.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\diskperf.exe:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\devenum.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\davclnt.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\d3d10warp.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\cryptui.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\cryptsp.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\CPFilters.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\comsvcs.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\COLORCNV.DLL:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\clfsw32.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\cintlgnt.ime:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\charmap.exe:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\chajei.ime:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\catsrvut.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\blackbox.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\authui.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\AudioSes.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\AUDIOKSE.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\AudioEng.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\SysWow64\adsmsext.dll:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\explorer.exe:$CmdTcID
@Alternate Data Stream - 64 bytes -> C:\Windows\avastSS.scr:$CmdTcID
@Alternate Data Stream - 26 bytes -> D:\Documents\WD my book 6TB rechnung.pdf:$CmdZnID
@Alternate Data Stream - 26 bytes -> D:\Documents\TrueCrypt User Guide.pdf:$CmdZnID
@Alternate Data Stream - 26 bytes -> D:\Documents\Sandra_Vermeulen[1].pdf:$CmdZnID
@Alternate Data Stream - 26 bytes -> D:\Documents\PHILIPS_M_NL_BDP3380.pdf:$CmdZnID
@Alternate Data Stream - 26 bytes -> D:\Documents\PDAshop.be_Factuur_448340202 Samsung J5 (2016).pdf:$CmdZnID
@Alternate Data Stream - 26 bytes -> D:\Documents\PCMag207_smartphonetest.pdf:$CmdZnID
@Alternate Data Stream - 26 bytes -> D:\Documents\panasonic nieuwe dvdrecorder.pdf:$CmdZnID
@Alternate Data Stream - 26 bytes -> D:\Documents\ophaalkalender_Z4A_2017.pdf:$CmdZnID
@Alternate Data Stream - 26 bytes -> D:\Documents\Linux Mint Handleiding dutch_17.3.pdf:$CmdZnID
@Alternate Data Stream - 26 bytes -> D:\Documents\Linux mINT dutch_17.2.pdf:$CmdZnID
@Alternate Data Stream - 26 bytes -> D:\Documents\lenco_l833dd_l830dd_turntable_service_manual.pdf:$CmdZnID
@Alternate Data Stream - 26 bytes -> D:\Documents\Labels Stad Gent.zip:$CmdZnID
@Alternate Data Stream - 26 bytes -> D:\Documents\Frontblendentausch_DB3_(v1.0)_public.pdf:$CmdZnID
@Alternate Data Stream - 26 bytes -> D:\Documents\cSSHD-MQ02ABxxxxH-product-overview.pdf:$CmdZnID
@Alternate Data Stream - 26 bytes -> D:\Documents\clickx 331.pdf:$CmdZnID
@Alternate Data Stream - 26 bytes -> D:\Documents\bring-your-own-dilemma.pdf:$CmdZnID
@Alternate Data Stream - 26 bytes -> D:\Documents\bda_40057647.pdf:$CmdZnID
@Alternate Data Stream - 26 bytes -> D:\Documents\bda_40057580.pdf:$CmdZnID
@Alternate Data Stream - 26 bytes -> D:\Documents\bda_40036627.pdf:$CmdZnID
@Alternate Data Stream - 26 bytes -> D:\Documents\bda_20052345.pdf:$CmdZnID
@Alternate Data Stream - 26 bytes -> D:\Documents\av_familiale_052014_nl.pdf:$CmdZnID
@Alternate Data Stream - 26 bytes -> D:\Documents\av__cocoon_cw80_nl.pdf:$CmdZnID
@Alternate Data Stream - 26 bytes -> D:\Documents\779489MKPKPBAZJGHCXGN0-One_Flow_ML.pdf:$CmdZnID
@Alternate Data Stream - 26 bytes -> D:\Documents\[DUT]X14DVBEUH-1.114-0707.pdf:$CmdZnID
@Alternate Data Stream - 1150 bytes -> D:\Desktop\Facebook.website:TASKICON_3friends-215113587
@Alternate Data Stream - 1150 bytes -> D:\Desktop\Facebook.website:TASKICON_2events-250898981
@Alternate Data Stream - 1150 bytes -> D:\Desktop\Facebook.website:TASKICON_1messages-431041656
@Alternate Data Stream - 1150 bytes -> D:\Desktop\Facebook.website:TASKICON_0news-1751121550

< End of report >