Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

adware malware oursurfing.com still exists after reformating PC [Solve

Started by adriandallegrave , Jun 10 2015 04:27 PM

adware malware oursurfing reformat format

This topic is locked

#16
adriandallegrave

Posted 18 June 2015 - 02:24 PM

Member

Topic Starter
Member
29 posts

The last time I formatted the computer I only installed three drivers. The videocard straight from the NVIDIA website, the processor driver and chipset driver both straight from the Intel website. On device manager I still have a checkmark on "Other devices -> PCI Simple Communications Controller". I'm not sure which driver I should install there but since I still haven't fixed the issues with the computer I didn't bother to search for it.

From a malware perspective I attached three screenshots to show you how the ads appear on my browser. Whenever I open a new tab or go to a different website, the first time I click anywhere on the page, even the scroll bar, another tab with an ad opens up. One of the ads is shown on the png I attached called "ad 1". The other 2 files I attached as exemples, "ad 2" and "ad 3", are from geekstogo.com website. One of the images shows an ad on the bottom of the screen and the other on the bottom right. The AdBlock extension of Google Chrome blocks these last two ads but the box containing them appears either way. If I accidentaly click on any of them I usualy have a lot of trouble because they end up installing unwanted softwares or change the browser configurations.

Besides these weird ads, sometimes the computer starts to install lots of unwanted softwares. As soon as the computer is reboot those softwares start to multiply and change absolutely everything on the PC. When this happens there is no other choice but to reformat the computer once again. I'm not sure exactly what triggers this different behavior neither if it's the same malware causing it.

Since as I posted before my friend got the same malware on his computer even though he didn't have any connection with any files from my computer, is it possible that the malware is in my router?

Thanks for all your time.

Attached Thumbnails

#17
Biscuithd

Posted 19 June 2015 - 07:10 AM

Trusted Helper

Malware Removal
2,573 posts

In all honesty I'm starting to get a little confused here. In the first log(s) you had some issues, but be the time I addressed those you'd done a re-install. That part is fine, assuming that I've understood it correctly. Next, certainly trading files when there is active Malware on the machine will only spread the problems. Same with using the USB drive. That said, could you isolate the machine, don't use a USB or trade files until we get things stabilized.

Now, as a new starting point, let's do a FRST Scan and see what we've got. Also, just for completeness I'm going to check your Boot Record and System Files. Last, to answer your router question, I do not think the issue is lurking in there. In all honesty I only suspect a Browser based exploit, but these scans will tell me if I'm right or I'm wrong

Scan with aswMBR

Please download aswMBR by Avast! & Gmer and save it to your desktop.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

Right-click on the icon and select Run as Administrator to start the tool.
Allow virtualisation if offered.
If you are prompted to download the latest anti-virus definitions from avast!, click Yes.
Click the AV Scan: drop down box and select C:\.
Select scan.
Upon completion, you will see Scan finished successfully. Click Save log.

Do NOT click Fix or FixMBR!
A file (MBR.dat) will be created on your desktop. Do NOT click or delete it!

Copy the contents of the logfile ans paste in into your next reply.
Do not forget to re-enable your previously switched-off protection software!

Scan with Gmer

This type of scan often produces false positives. At any point do not take any action for any suspicious entries you may see there. Instead post the log to be analyzed.

Please download GMER by Gmer and save the file to your desktop.
It will come as a randomly named file (like a6ge38b4.exe) - that's absolutely normal.

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.
If you are a user of CD emulation software (like Daemon Tools or Alcohol) also disable it for the cleaning process - instructions here.

Right-click on randomly named icon and select Run as Administrator to start the tool.
It is very important that you do not use your computer while Gmer is running!
Gmer will open to the Rootkit/Malware tab and perform an automatic quick scan.
If you receive a warning about rootkit activity and are asked to fully scan your system click NO!

When the pre-scan is completed, please do the following:

Please check in the Quick scan box.
Please uncheck the IAT/EAT and Show All.
Click Scan.
If you see a rootkit warning window click OK.
When the scan is finished, Save the results to your desktop as gmer.log.

Please include the content of this file in your next reply.
Don't forget to re-enable previously switched-off protection software!

If you encounter any problems, try running GMER in Safe Mode.
If GMER crashes or keeps resulting in a Blue Screen of Death, uncheck Devices on the right side before scanning.

Scan with Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool x64 and save it to your Desktop.

Right-click on icon and select Run as Administrator to start the tool.
(XP users click run after receipt of Windows Security Warning - Open File).
When the tool opens click Yes to disclaimer.
Make sure that Addition option is checked.
Press Scan button and wait.
The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please copy and paste their content into your next reply.

#18
adriandallegrave

Posted 19 June 2015 - 02:06 PM

Member

Topic Starter
Member
29 posts

I left the PC scanning and went to work. I didn't have any problems with the scans.

Here are the logs. Sorry for the delay and thanks again.

Run date: 2015-06-19 11:49:33

-----------------------------

11:49:33.762 OS Version: Windows x64 6.2.9200

11:49:33.762 Number of processors: 8 586 0x3C03

11:49:33.762 ComputerName: DALLEGRAVE-PC UserName: Adrian

11:49:33.950 Initialize success

11:49:33.950 VM: initialized successfully

11:49:33.950 VM: Intel CPU supported

11:49:42.667 VM: disk I/O iaStorAV.sys

11:51:10.882 AVAST engine defs: 15061901

11:51:21.882 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000003a

11:51:21.882 Disk 0 Vendor: Intel___ 1.0. Size: 228942MB BusType: 8

11:51:21.882 Disk 1 \Device\Harddisk1\DR1 -> \Device\0000003c

11:51:21.882 Disk 1 Vendor: WDC_WD10EZEX-00BN5A0 01.01A01 Size: 953869MB BusType: 8

11:51:21.905 Disk 0 MBR read successfully

11:51:21.906 Disk 0 MBR scan

11:51:21.907 Disk 0 Windows 7 default MBR code

11:51:21.910 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 228840 MB offset 206848

11:51:21.915 Disk 0 scanning C:\WINDOWS\system32\drivers

11:51:23.884 Service scanning

11:51:29.988 Modules scanning

11:51:30.004 Disk 0 trace - called modules:

11:51:30.019 ntoskrnl.exe CLASSPNP.SYS disk.sys storport.sys hal.dll iaStorAV.sys

11:51:30.019 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xffffe00002dfd060]

11:51:30.035 3 CLASSPNP.SYS[fffff8000081dabb] -> nt!IofCallDriver -> \Device\0000003a[0xffffe000008f7060]

11:51:30.226 AVAST engine scan C:\

12:31:13.398 Disk 0 statistics 17263425/0/0 @ 21503,59 MB/s

12:31:13.398 Scan finished successfully

16:43:08.496 Disk 0 MBR has been saved successfully to "C:\Users\Adrian\Desktop\MBR.dat"

16:43:08.496 The log file has been saved successfully to "C:\Users\Adrian\Desktop\aswMBR.txt"

GMER 2.1.19357 - http://www.gmer.net

Rootkit scan 2015-06-19 16:51:17

Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\0000003a Intel___ rev.1.0. 223,58GB

Running: gmer.exe; Driver: C:\Users\Adrian\AppData\Local\Temp\kwddraog.sys

---- User code sections - GMER 2.1 ----

.text C:\WINDOWS\system32\dwm.exe[956] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ffc3e19169a 4 bytes [19, 3E, FC, 7F]

.text C:\WINDOWS\system32\dwm.exe[956] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ffc3e1916a2 4 bytes [19, 3E, FC, 7F]

.text C:\WINDOWS\system32\dwm.exe[956] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ffc3e19181a 4 bytes [19, 3E, FC, 7F]

.text C:\WINDOWS\system32\dwm.exe[956] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ffc3e191832 4 bytes [19, 3E, FC, 7F]

.text C:\WINDOWS\system32\nvvsvc.exe[100] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ffc3e19169a 4 bytes [19, 3E, FC, 7F]

.text C:\WINDOWS\system32\nvvsvc.exe[100] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ffc3e1916a2 4 bytes [19, 3E, FC, 7F]

.text C:\WINDOWS\system32\nvvsvc.exe[100] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ffc3e19181a 4 bytes [19, 3E, FC, 7F]

.text C:\WINDOWS\system32\nvvsvc.exe[100] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ffc3e191832 4 bytes [19, 3E, FC, 7F]

.text C:\Program Files\Windows Defender\MsMpEng.exe[1856] C:\WINDOWS\system32\psapi.dll!GetModuleBaseNameA + 506 00007ffc3e19169a 4 bytes [19, 3E, FC, 7F]

.text C:\Program Files\Windows Defender\MsMpEng.exe[1856] C:\WINDOWS\system32\psapi.dll!GetModuleBaseNameA + 514 00007ffc3e1916a2 4 bytes [19, 3E, FC, 7F]

.text C:\Program Files\Windows Defender\MsMpEng.exe[1856] C:\WINDOWS\system32\psapi.dll!QueryWorkingSet + 118 00007ffc3e19181a 4 bytes [19, 3E, FC, 7F]

.text C:\Program Files\Windows Defender\MsMpEng.exe[1856] C:\WINDOWS\system32\psapi.dll!QueryWorkingSet + 142 00007ffc3e191832 4 bytes [19, 3E, FC, 7F]

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1508] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ffc3e19169a 4 bytes [19, 3E, FC, 7F]

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1508] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ffc3e1916a2 4 bytes [19, 3E, FC, 7F]

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1508] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ffc3e19181a 4 bytes [19, 3E, FC, 7F]

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1508] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ffc3e191832 4 bytes [19, 3E, FC, 7F]

.text C:\WINDOWS\Explorer.EXE[764] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ffc3e19169a 4 bytes [19, 3E, FC, 7F]

.text C:\WINDOWS\Explorer.EXE[764] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ffc3e1916a2 4 bytes [19, 3E, FC, 7F]

.text C:\WINDOWS\Explorer.EXE[764] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ffc3e19181a 4 bytes [19, 3E, FC, 7F]

.text C:\WINDOWS\Explorer.EXE[764] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ffc3e191832 4 bytes [19, 3E, FC, 7F]

---- Threads - GMER 2.1 ----

Thread C:\WINDOWS\system32\csrss.exe [628:692] fffff960008784d0

---- Registry - GMER 2.1 ----

Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\RNG@RNGAuxiliarySeed 1352512543

Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{D5DA9376-0F53-4F28-8A00-F1A1F274362D}@LeaseObtainedTime 1434741174

Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{D5DA9376-0F53-4F28-8A00-F1A1F274362D}@T1 1434742974

Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{D5DA9376-0F53-4F28-8A00-F1A1F274362D}@T2 1434744324

Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{D5DA9376-0F53-4F28-8A00-F1A1F274362D}@LeaseTerminatesTime 1434744774

Reg HKCU\Software\Microsoft\Windows\DWM@ColorizationColor -2009684301

Reg HKCU\Software\Microsoft\Windows\DWM@ColorizationColorBalance 57

Reg HKCU\Software\Microsoft\Windows\DWM@ColorizationAfterglow -2009684301

Reg HKCU\Software\Microsoft\Windows\DWM@ColorizationBlurBalance 33

---- EOF - GMER 2.1 ----

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:13-06-2015

Ran by Adrian (administrator) on DALLEGRAVE-PC on 19-06-2015 16:51:57

Running from C:\Users\Adrian\Desktop\frst

Loaded Profiles: Adrian (Available Profiles: Adrian)

Platform: Windows 8.1 Pro (X64) OS Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

(Intel Corporation) C:\Windows\System32\igfxEM.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Microsoft Corporation) C:\Windows\System32\WWAHost.exe

(Microsoft Corporation) C:\Windows\WinStore\WSHost.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2754704 2015-06-03] (NVIDIA Corporation)

HKLM\...\Run: [ShadowPlay] => C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\nvspcap64.dll,ShadowPlayOnSystemStart

HKLM\...\Run: [XboxStat] => C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-09-30] (Microsoft Corporation)

HKU\S-1-5-21-3400116732-2033998285-2783747925-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2892992 2015-06-04] (Valve Corporation)

HKU\S-1-5-21-3400116732-2033998285-2783747925-1001\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3671872 2012-04-17] (DT Soft Ltd)

HKU\S-1-5-21-3400116732-2033998285-2783747925-1001\...\MountPoints2: {f0fd195e-1240-11e5-8253-74d435e68c45} - "G:\autorun.exe"

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

SearchScopes: HKU\S-1-5-21-3400116732-2033998285-2783747925-1001 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = http://www.google.co...q={searchTerms}

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2012-10-01] (Microsoft Corporation)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2012-10-01] (Microsoft Corporation)

BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2012-10-01] (Microsoft Corporation)

Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2012-10-01] (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 89.248.171.33 8.8.8.8

FireFox:

========

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-05-28] (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-05-28] (NVIDIA Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-06-12] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-06-12] (Google Inc.)

Chrome:

=======

CHR Profile: C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Drive) - C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-06-12]

CHR Extension: (YouTube) - C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-06-12]

CHR Extension: (Google Search) - C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-06-12]

CHR Extension: (AdBlock) - C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-06-18]

CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-06-12]

CHR Extension: (Google Wallet) - C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-06-12]

CHR Extension: (Gmail) - C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-06-12]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1152656 2015-06-03] (NVIDIA Corporation)

R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [344168 2015-05-29] (Intel Corporation)

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1893008 2015-06-03] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [23007376 2015-06-03] (NVIDIA Corporation)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation)

R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283200 2015-06-14] (DT Soft Ltd)

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-06-03] (NVIDIA Corporation)

R3 NVVADARM; C:\Windows\system32\drivers\nvvadarm.sys [39056 2015-05-28] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38032 2015-05-28] (NVIDIA Corporation)

R3 ScpVBus; C:\Windows\System32\drivers\ScpVBus.sys [39168 2013-05-19] (Scarlet.Crush Productions)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Corporation)

S3 xusb22; C:\Windows\System32\drivers\xusb22.sys [87040 2013-08-22] (Microsoft Corporation)

U3 aswMBR; \??\C:\Users\Adrian\AppData\Local\Temp\aswMBR.sys [X]

U3 aswVmm; \??\C:\Users\Adrian\AppData\Local\Temp\aswVmm.sys [X]

U3 kwddraog; \??\C:\Users\Adrian\AppData\Local\Temp\kwddraog.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-19 16:51 - 2015-06-19 16:51 - 00005406 _____ C:\Users\Adrian\Desktop\gmer.log

2015-06-19 16:43 - 2015-06-19 16:43 - 00001820 _____ C:\Users\Adrian\Desktop\aswMBR.txt

2015-06-19 16:43 - 2015-06-19 16:43 - 00000512 _____ C:\Users\Adrian\Desktop\MBR.dat

2015-06-19 11:47 - 2015-06-19 11:48 - 00380416 _____ C:\Users\Adrian\Desktop\gmer.exe

2015-06-19 11:47 - 2015-06-19 11:47 - 05198336 _____ (AVAST Software) C:\Users\Adrian\Desktop\aswMBR.exe

2015-06-18 20:08 - 2015-06-18 20:08 - 00000000 ____D C:\Users\Adrian\AppData\Local\Skyrim

2015-06-18 20:07 - 2015-06-18 20:07 - 00000000 ____D C:\Users\Adrian\Documents\My Games

2015-06-18 11:45 - 2015-06-18 11:45 - 00000207 _____ C:\WINDOWS\tweaking.com-regbackup-DALLEGRAVE-PC-Windows-8.1-Pro-(64-bit).dat

2015-06-18 11:45 - 2015-06-18 11:45 - 00000000 ____D C:\RegBackup

2015-06-18 11:44 - 2015-06-18 11:44 - 00000000 ____D C:\AdwCleaner

2015-06-18 09:44 - 2015-06-18 09:37 - 00024064 _____ C:\WINDOWS\zoek-delete.exe

2015-06-18 09:40 - 2015-06-18 11:40 - 00015027 _____ C:\zoek-results.log

2015-06-18 09:37 - 2015-06-18 09:44 - 00000000 ____D C:\zoek_backup

2015-06-17 21:12 - 2015-06-17 21:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InputMapper

2015-06-17 21:11 - 2015-06-17 21:11 - 00000000 ____D C:\Users\Adrian\AppData\Roaming\InputMapper

2015-06-17 21:11 - 2015-06-17 21:11 - 00000000 ____D C:\Users\Adrian\AppData\Roaming\DSDCS

2015-06-17 21:11 - 2015-06-17 21:11 - 00000000 ____D C:\ProgramData\DSDCS

2015-06-17 21:11 - 2015-06-17 21:11 - 00000000 ____D C:\ProgramData\Caphyon

2015-06-17 21:11 - 2015-06-17 21:11 - 00000000 ____D C:\Program Files (x86)\DSDCS

2015-06-17 19:52 - 2015-06-18 00:28 - 00000000 ____D C:\Users\Adrian\AppData\Local\Paint.NET

2015-06-17 19:52 - 2015-06-17 19:52 - 00001200 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Paint.NET.lnk

2015-06-17 19:52 - 2015-06-17 19:52 - 00000000 ____D C:\Program Files\Paint.NET

2015-06-17 19:39 - 2015-06-17 19:39 - 00002036 _____ C:\Users\Adrian\Desktop\Brasileirao A - Shortcut.lnk

2015-06-17 19:22 - 2015-06-17 19:22 - 00000000 ____D C:\ProgramData\KONAMI

2015-06-17 19:22 - 2015-06-17 19:22 - 00000000 ____D C:\Program Files (x86)\KONAMI

2015-06-17 17:49 - 2015-06-17 17:49 - 00000000 ____D C:\WINDOWS\SysWOW64\vbox

2015-06-17 17:49 - 2015-06-17 17:49 - 00000000 ____D C:\WINDOWS\system32\vbox

2015-06-17 17:42 - 2015-06-17 17:42 - 00000000 ____D C:\ProgramData\AVAST Software

2015-06-17 09:40 - 2015-06-17 09:40 - 00000000 ____D C:\WINDOWS\system32\appmgmt

2015-06-17 09:40 - 2015-06-17 09:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

2015-06-16 19:05 - 2015-06-16 19:05 - 00000000 ____D C:\Users\Adrian\Documents\Flight Simulator X Files

2015-06-16 19:04 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XAudio2_7.dll

2015-06-16 19:04 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\WINDOWS\system32\XAudio2_7.dll

2015-06-16 19:04 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine3_7.dll

2015-06-16 19:04 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine3_7.dll

2015-06-16 19:04 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\WINDOWS\system32\XAPOFX1_5.dll

2015-06-16 19:04 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XAPOFX1_5.dll

2015-06-16 19:04 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_43.dll

2015-06-16 19:04 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_43.dll

2015-06-16 19:04 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dcsx_43.dll

2015-06-16 19:04 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dcsx_43.dll

2015-06-16 19:04 - 2010-02-04 10:01 - 00530776 _____ (Microsoft Corporation) C:\WINDOWS\system32\XAudio2_6.dll

2015-06-16 19:04 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XAudio2_6.dll

2015-06-16 19:04 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine3_6.dll

2015-06-16 19:04 - 2010-02-04 10:01 - 00176984 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine3_6.dll

2015-06-16 19:04 - 2010-02-04 10:01 - 00078680 _____ (Microsoft Corporation) C:\WINDOWS\system32\XAPOFX1_4.dll

2015-06-16 19:04 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XAPOFX1_4.dll

2015-06-16 19:04 - 2010-02-04 10:01 - 00024920 _____ (Microsoft Corporation) C:\WINDOWS\system32\X3DAudio1_7.dll

2015-06-16 19:04 - 2010-02-04 10:01 - 00022360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\X3DAudio1_7.dll

2015-06-16 19:04 - 2009-09-04 17:44 - 00517960 _____ (Microsoft Corporation) C:\WINDOWS\system32\XAudio2_5.dll

2015-06-16 19:04 - 2009-09-04 17:44 - 00515416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XAudio2_5.dll

2015-06-16 19:04 - 2009-09-04 17:44 - 00238936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine3_5.dll

2015-06-16 19:04 - 2009-09-04 17:44 - 00176968 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine3_5.dll

2015-06-16 19:04 - 2009-09-04 17:44 - 00073544 _____ (Microsoft Corporation) C:\WINDOWS\system32\XAPOFX1_3.dll

2015-06-16 19:04 - 2009-09-04 17:44 - 00069464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XAPOFX1_3.dll

2015-06-16 19:04 - 2009-09-04 17:29 - 05554512 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dcsx_42.dll

2015-06-16 19:04 - 2009-09-04 17:29 - 05501792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dcsx_42.dll

2015-06-16 19:04 - 2009-09-04 17:29 - 02582888 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_42.dll

2015-06-16 19:04 - 2009-09-04 17:29 - 02475352 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DX9_42.dll

2015-06-16 19:04 - 2009-09-04 17:29 - 01974616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_42.dll

2015-06-16 19:04 - 2009-09-04 17:29 - 01892184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DX9_42.dll

2015-06-16 19:04 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx10_42.dll

2015-06-16 19:04 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx10_42.dll

2015-06-16 19:04 - 2009-09-04 17:29 - 00285024 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx11_42.dll

2015-06-16 19:04 - 2009-09-04 17:29 - 00235344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx11_42.dll

2015-06-16 19:04 - 2009-03-16 14:18 - 00521560 _____ (Microsoft Corporation) C:\WINDOWS\system32\XAudio2_4.dll

2015-06-16 19:04 - 2009-03-16 14:18 - 00517448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XAudio2_4.dll

2015-06-16 19:04 - 2009-03-16 14:18 - 00235352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine3_4.dll

2015-06-16 19:04 - 2009-03-16 14:18 - 00174936 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine3_4.dll

2015-06-16 19:04 - 2009-03-16 14:18 - 00024920 _____ (Microsoft Corporation) C:\WINDOWS\system32\X3DAudio1_6.dll

2015-06-16 19:04 - 2009-03-16 14:18 - 00022360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\X3DAudio1_6.dll

2015-06-16 19:04 - 2009-03-09 15:27 - 05425496 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DX9_41.dll

2015-06-16 19:04 - 2009-03-09 15:27 - 04178264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DX9_41.dll

2015-06-16 19:04 - 2009-03-09 15:27 - 02430312 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_41.dll

2015-06-16 19:04 - 2009-03-09 15:27 - 01846632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_41.dll

2015-06-16 19:04 - 2009-03-09 15:27 - 00520544 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx10_41.dll

2015-06-16 19:04 - 2009-03-09 15:27 - 00453456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx10_41.dll

2015-06-16 19:04 - 2008-10-27 10:04 - 00518480 _____ (Microsoft Corporation) C:\WINDOWS\system32\XAudio2_3.dll

2015-06-16 19:04 - 2008-10-27 10:04 - 00514384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XAudio2_3.dll

2015-06-16 19:04 - 2008-10-27 10:04 - 00235856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine3_3.dll

2015-06-16 19:04 - 2008-10-27 10:04 - 00175440 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine3_3.dll

2015-06-16 19:04 - 2008-10-27 10:04 - 00074576 _____ (Microsoft Corporation) C:\WINDOWS\system32\XAPOFX1_2.dll

2015-06-16 19:04 - 2008-10-27 10:04 - 00070992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XAPOFX1_2.dll

2015-06-16 19:04 - 2008-10-27 10:04 - 00025936 _____ (Microsoft Corporation) C:\WINDOWS\system32\X3DAudio1_5.dll

2015-06-16 19:04 - 2008-10-27 10:04 - 00023376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\X3DAudio1_5.dll

2015-06-16 19:04 - 2008-10-15 06:22 - 05631312 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DX9_40.dll

2015-06-16 19:04 - 2008-10-15 06:22 - 04379984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DX9_40.dll

2015-06-16 19:04 - 2008-10-15 06:22 - 02605920 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_40.dll

2015-06-16 19:04 - 2008-10-15 06:22 - 02036576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_40.dll

2015-06-16 19:04 - 2008-10-15 06:22 - 00519000 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx10_40.dll

2015-06-16 19:04 - 2008-10-15 06:22 - 00452440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx10_40.dll

2015-06-16 19:04 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine3_2.dll

2015-06-16 19:04 - 2008-07-31 10:41 - 00177672 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine3_2.dll

2015-06-16 19:04 - 2008-07-31 10:41 - 00072200 _____ (Microsoft Corporation) C:\WINDOWS\system32\XAPOFX1_1.dll

2015-06-16 19:04 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XAPOFX1_1.dll

2015-06-16 19:04 - 2008-07-31 10:40 - 00513544 _____ (Microsoft Corporation) C:\WINDOWS\system32\XAudio2_2.dll

2015-06-16 19:04 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XAudio2_2.dll

2015-06-16 19:04 - 2008-07-10 11:01 - 00467984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx10_39.dll

2015-06-16 19:04 - 2008-07-10 11:00 - 04992520 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DX9_39.dll

2015-06-16 19:04 - 2008-07-10 11:00 - 03851784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DX9_39.dll

2015-06-16 19:04 - 2008-07-10 11:00 - 01942552 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_39.dll

2015-06-16 19:04 - 2008-07-10 11:00 - 01493528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_39.dll

2015-06-16 19:04 - 2008-07-10 11:00 - 00540688 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx10_39.dll

2015-06-16 19:04 - 2008-05-30 14:19 - 00511496 _____ (Microsoft Corporation) C:\WINDOWS\system32\XAudio2_1.dll

2015-06-16 19:04 - 2008-05-30 14:19 - 00507400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XAudio2_1.dll

2015-06-16 19:04 - 2008-05-30 14:18 - 00238088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine3_1.dll

2015-06-16 19:04 - 2008-05-30 14:18 - 00177672 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine3_1.dll

2015-06-16 19:04 - 2008-05-30 14:17 - 00068104 _____ (Microsoft Corporation) C:\WINDOWS\system32\XAPOFX1_0.dll

2015-06-16 19:04 - 2008-05-30 14:17 - 00065032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XAPOFX1_0.dll

2015-06-16 19:04 - 2008-05-30 14:17 - 00025608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\X3DAudio1_4.dll

2015-06-16 19:04 - 2008-05-30 14:16 - 00028168 _____ (Microsoft Corporation) C:\WINDOWS\system32\X3DAudio1_4.dll

2015-06-16 19:04 - 2008-05-30 14:11 - 04991496 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DX9_38.dll

2015-06-16 19:04 - 2008-05-30 14:11 - 03850760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DX9_38.dll

2015-06-16 19:04 - 2008-05-30 14:11 - 01941528 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_38.dll

2015-06-16 19:04 - 2008-05-30 14:11 - 01491992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_38.dll

2015-06-16 19:04 - 2008-05-30 14:11 - 00540688 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx10_38.dll

2015-06-16 19:04 - 2008-05-30 14:11 - 00467984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx10_38.dll

2015-06-16 19:04 - 2008-03-05 16:04 - 00489480 _____ (Microsoft Corporation) C:\WINDOWS\system32\XAudio2_0.dll

2015-06-16 19:04 - 2008-03-05 16:03 - 00479752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XAudio2_0.dll

2015-06-16 19:04 - 2008-03-05 16:03 - 00238088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine3_0.dll

2015-06-16 19:04 - 2008-03-05 16:03 - 00177672 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine3_0.dll

2015-06-16 19:04 - 2008-03-05 16:00 - 00028168 _____ (Microsoft Corporation) C:\WINDOWS\system32\X3DAudio1_3.dll

2015-06-16 19:04 - 2008-03-05 16:00 - 00025608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\X3DAudio1_3.dll

2015-06-16 19:04 - 2008-03-05 15:56 - 04910088 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DX9_37.dll

2015-06-16 19:04 - 2008-03-05 15:56 - 03786760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DX9_37.dll

2015-06-16 19:04 - 2008-03-05 15:56 - 01860120 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_37.dll

2015-06-16 19:04 - 2008-03-05 15:56 - 01420824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_37.dll

2015-06-16 19:04 - 2008-02-05 23:07 - 00529424 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx10_37.dll

2015-06-16 19:04 - 2008-02-05 23:07 - 00462864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx10_37.dll

2015-06-16 19:04 - 2007-10-22 03:40 - 00411656 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine2_10.dll

2015-06-16 19:04 - 2007-10-22 03:39 - 00267272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine2_10.dll

2015-06-16 19:04 - 2007-10-22 03:37 - 00021000 _____ (Microsoft Corporation) C:\WINDOWS\system32\X3DAudio1_2.dll

2015-06-16 19:04 - 2007-10-22 03:37 - 00017928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\X3DAudio1_2.dll

2015-06-16 19:04 - 2007-10-12 15:14 - 05081608 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx9_36.dll

2015-06-16 19:04 - 2007-10-12 15:14 - 03734536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx9_36.dll

2015-06-16 19:04 - 2007-10-12 15:14 - 02006552 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_36.dll

2015-06-16 19:04 - 2007-10-12 15:14 - 01374232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_36.dll

2015-06-16 19:04 - 2007-10-02 09:56 - 00508264 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx10_36.dll

2015-06-16 19:04 - 2007-10-02 09:56 - 00444776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx10_36.dll

2015-06-16 19:04 - 2007-07-20 00:57 - 00411496 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine2_9.dll

2015-06-16 19:04 - 2007-07-20 00:57 - 00267112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine2_9.dll

2015-06-16 19:04 - 2007-07-19 18:14 - 05073256 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx9_35.dll

2015-06-16 19:04 - 2007-07-19 18:14 - 03727720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx9_35.dll

2015-06-16 19:04 - 2007-07-19 18:14 - 01985904 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_35.dll

2015-06-16 19:04 - 2007-07-19 18:14 - 01358192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_35.dll

2015-06-16 19:04 - 2007-07-19 18:14 - 00508264 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx10_35.dll

2015-06-16 19:04 - 2007-07-19 18:14 - 00444776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx10_35.dll

2015-06-16 19:04 - 2007-06-20 20:49 - 00409960 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine2_8.dll

2015-06-16 19:04 - 2007-06-20 20:46 - 00266088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine2_8.dll

2015-06-16 19:04 - 2007-05-16 16:45 - 04496232 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx9_34.dll

2015-06-16 19:04 - 2007-05-16 16:45 - 03497832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx9_34.dll

2015-06-16 19:04 - 2007-05-16 16:45 - 01401200 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_34.dll

2015-06-16 19:04 - 2007-05-16 16:45 - 01124720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_34.dll

2015-06-16 19:04 - 2007-05-16 16:45 - 00506728 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx10_34.dll

2015-06-16 19:04 - 2007-05-16 16:45 - 00443752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx10_34.dll

2015-06-16 12:10 - 2015-06-16 12:10 - 00000000 ____D C:\WINDOWS\SysWOW64\directx

2015-06-16 12:05 - 2015-06-16 12:05 - 00000000 ____D C:\Users\Adrian\Documents\KONAMI

2015-06-16 09:25 - 2015-06-16 09:25 - 00000000 ____D C:\Users\Adrian\AppData\Roaming\WinRAR

2015-06-16 09:25 - 2015-06-16 09:25 - 00000000 ____D C:\Users\Adrian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR

2015-06-16 09:25 - 2015-06-16 09:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR

2015-06-16 09:25 - 2015-06-16 09:25 - 00000000 ____D C:\Program Files\WinRAR

2015-06-15 19:38 - 2015-06-16 11:47 - 00000090 _____ C:\Users\Adrian\Desktop\pes 2013 serials.txt

2015-06-15 19:14 - 2007-04-04 18:54 - 00107368 _____ (Microsoft Corporation) C:\WINDOWS\system32\xinput1_3.dll

2015-06-15 19:13 - 2015-06-15 19:13 - 00000000 ____D C:\Program Files (x86)\Reference Assemblies

2015-06-15 19:13 - 2015-06-15 19:13 - 00000000 ____D C:\Program Files (x86)\MSBuild

2015-06-15 19:12 - 2015-06-15 19:12 - 00000000 ____D C:\Users\Adrian\AppData\Roaming\NVIDIA

2015-06-15 19:12 - 2015-06-15 19:12 - 00000000 ____D C:\Program Files\Reference Assemblies

2015-06-15 19:12 - 2015-06-15 19:12 - 00000000 ____D C:\Program Files\MSBuild

2015-06-15 19:12 - 2007-04-04 18:55 - 00403304 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine2_7.dll

2015-06-15 19:12 - 2007-04-04 18:55 - 00261480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine2_7.dll

2015-06-15 19:12 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xinput1_3.dll

2015-06-15 19:12 - 2007-03-15 16:57 - 00506728 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx10_33.dll

2015-06-15 19:12 - 2007-03-15 16:57 - 00443752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx10_33.dll

2015-06-15 19:12 - 2007-03-12 16:42 - 04494184 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx9_33.dll

2015-06-15 19:12 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx9_33.dll

2015-06-15 19:12 - 2007-03-12 16:42 - 01400176 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_33.dll

2015-06-15 19:12 - 2007-03-12 16:42 - 01123696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_33.dll

2015-06-15 19:12 - 2007-03-05 12:42 - 00017688 _____ (Microsoft Corporation) C:\WINDOWS\system32\x3daudio1_1.dll

2015-06-15 19:12 - 2007-03-05 12:42 - 00015128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\x3daudio1_1.dll

2015-06-15 19:12 - 2007-01-24 15:27 - 00393576 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine2_6.dll

2015-06-15 19:12 - 2007-01-24 15:27 - 00255848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine2_6.dll

2015-06-15 19:12 - 2006-12-08 12:02 - 00251672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine2_5.dll

2015-06-15 19:12 - 2006-12-08 12:00 - 00390424 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine2_5.dll

2015-06-15 19:12 - 2006-11-29 13:06 - 04398360 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx9_32.dll

2015-06-15 19:12 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx9_32.dll

2015-06-15 19:12 - 2006-11-29 13:06 - 00469264 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx10.dll

2015-06-15 19:12 - 2006-11-29 13:06 - 00440080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx10.dll

2015-06-15 19:12 - 2006-09-28 16:05 - 03977496 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx9_31.dll

2015-06-15 19:12 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx9_31.dll

2015-06-15 19:12 - 2006-09-28 16:05 - 00237848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine2_4.dll

2015-06-15 19:12 - 2006-09-28 16:04 - 00364824 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine2_4.dll

2015-06-15 19:12 - 2006-07-28 09:31 - 00083736 _____ (Microsoft Corporation) C:\WINDOWS\system32\xinput1_2.dll

2015-06-15 19:12 - 2006-07-28 09:30 - 00363288 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine2_3.dll

2015-06-15 19:12 - 2006-07-28 09:30 - 00236824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine2_3.dll

2015-06-15 19:12 - 2006-07-28 09:30 - 00062744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xinput1_2.dll

2015-06-15 19:12 - 2006-05-31 07:24 - 00230168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine2_2.dll

2015-06-15 19:12 - 2006-05-31 07:22 - 00354072 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine2_2.dll

2015-06-15 19:12 - 2006-03-31 12:41 - 03927248 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx9_30.dll

2015-06-15 19:12 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx9_30.dll

2015-06-15 19:12 - 2006-03-31 12:40 - 00352464 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine2_1.dll

2015-06-15 19:12 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine2_1.dll

2015-06-15 19:12 - 2006-03-31 12:39 - 00083664 _____ (Microsoft Corporation) C:\WINDOWS\system32\xinput1_1.dll

2015-06-15 19:12 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xinput1_1.dll

2015-06-15 19:12 - 2006-02-03 08:43 - 03830992 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx9_29.dll

2015-06-15 19:12 - 2006-02-03 08:43 - 02332368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx9_29.dll

2015-06-15 19:12 - 2006-02-03 08:42 - 00355536 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine2_0.dll

2015-06-15 19:12 - 2006-02-03 08:42 - 00230096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine2_0.dll

2015-06-15 19:12 - 2006-02-03 08:41 - 00016592 _____ (Microsoft Corporation) C:\WINDOWS\system32\x3daudio1_0.dll

2015-06-15 19:12 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\x3daudio1_0.dll

2015-06-15 19:12 - 2005-12-05 18:09 - 03815120 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx9_28.dll

2015-06-15 19:12 - 2005-12-05 18:09 - 02323664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx9_28.dll

2015-06-15 19:12 - 2005-07-22 19:59 - 03807440 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx9_27.dll

2015-06-15 19:12 - 2005-07-22 19:59 - 02319568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx9_27.dll

2015-06-15 19:12 - 2005-05-26 15:34 - 03767504 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx9_26.dll

2015-06-15 19:12 - 2005-05-26 15:34 - 02297552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx9_26.dll

2015-06-15 19:12 - 2005-03-18 17:19 - 03823312 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx9_25.dll

2015-06-15 19:12 - 2005-03-18 17:19 - 02337488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx9_25.dll

2015-06-15 19:12 - 2005-02-05 19:45 - 03544272 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx9_24.dll

2015-06-15 19:12 - 2005-02-05 19:45 - 02222800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx9_24.dll

2015-06-15 19:11 - 2013-08-03 01:48 - 01166520 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationNative_v0300.dll

2015-06-15 19:11 - 2013-08-03 01:48 - 00124112 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll

2015-06-15 19:11 - 2013-08-03 01:48 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe

2015-06-15 19:11 - 2013-08-03 01:41 - 00778936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationNative_v0300.dll

2015-06-15 19:11 - 2013-08-03 01:41 - 00102608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll

2015-06-15 19:11 - 2013-08-03 01:41 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe

2015-06-15 19:09 - 2015-06-18 20:07 - 00078317 _____ C:\WINDOWS\DirectX.log

2015-06-15 19:09 - 2015-06-15 19:09 - 00000175 _____ C:\WINDOWS\DXError.log

2015-06-15 19:09 - 2015-06-15 19:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Xbox 360 Accessories

2015-06-15 19:09 - 2015-06-15 19:09 - 00000000 ____D C:\Program Files\Microsoft Xbox 360 Accessories

2015-06-14 15:38 - 2015-06-14 15:38 - 00000000 ____D C:\ProgramData\Malwarebytes

2015-06-14 13:25 - 2015-06-14 13:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Enforcer Police Crime Action

2015-06-14 13:24 - 2015-06-14 13:24 - 00283200 _____ (DT Soft Ltd) C:\WINDOWS\system32\Drivers\dtsoftbus01.sys

2015-06-14 13:24 - 2015-06-14 13:24 - 00000000 ____D C:\Users\Adrian\AppData\Roaming\DAEMON Tools Lite

2015-06-14 13:24 - 2015-06-14 13:24 - 00000000 ____D C:\Program Files (x86)\DAEMON Tools Lite

2015-06-14 13:23 - 2015-06-14 13:24 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite

2015-06-12 18:31 - 2015-06-19 16:51 - 00000000 ____D C:\Users\Adrian\Desktop\frst

2015-06-12 18:31 - 2015-06-19 16:51 - 00000000 ____D C:\FRST

2015-06-12 09:47 - 2015-06-12 09:47 - 00000000 __SHD C:\Recovery

2015-06-12 09:33 - 2015-06-12 09:33 - 00000118 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat

2015-06-12 08:47 - 2015-06-19 11:42 - 00494590 _____ C:\WINDOWS\PFRO.log

2015-06-12 08:47 - 2015-06-12 08:47 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf

2015-06-12 08:47 - 2015-06-12 00:51 - 00000000 ____D C:\WINDOWS\Panther

2015-06-12 04:40 - 2015-06-12 04:40 - 00007597 _____ C:\Users\Adrian\AppData\Local\Resmon.ResmonCfg

2015-06-12 04:15 - 2015-06-12 04:15 - 00002709 _____ C:\Users\Adrian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\msinfo32.lnk

2015-06-12 03:28 - 2015-06-15 19:16 - 00000000 ____D C:\Users\Adrian\Documents\The Witcher 3

2015-06-12 03:24 - 2015-06-12 03:24 - 00000000 ____D C:\Users\Adrian\Documents\Game of Thrones

2015-06-12 03:19 - 2015-06-12 03:19 - 00000000 ____D C:\Users\Adrian\AppData\Local\Steam

2015-06-12 03:17 - 2015-06-19 00:51 - 00000000 ____D C:\Program Files (x86)\Steam

2015-06-12 03:17 - 2015-06-12 03:17 - 00000979 _____ C:\Users\Public\Desktop\Steam.lnk

2015-06-12 03:17 - 2015-06-12 03:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam

2015-06-12 01:41 - 2015-06-19 11:47 - 00003758 _____ C:\WINDOWS\System32\Tasks\AutoKMS

2015-06-12 01:41 - 2015-06-18 23:21 - 00177416 _____ C:\Users\Adrian\Desktop\calendário inter certo.xlsx.xlsm

2015-06-12 01:41 - 2015-06-12 09:33 - 00000000 ____D C:\WINDOWS\AutoKMS

2015-06-12 01:40 - 2015-06-12 01:40 - 00000000 ____D C:\ProgramData\Microsoft Toolkit

2015-06-12 01:40 - 2013-08-22 09:40 - 00040664 _____ (The OpenVPN Project) C:\WINDOWS\system32\Drivers\tap0901.sys

2015-06-12 01:34 - 2015-06-12 01:34 - 00000000 ____D C:\WINDOWS\PCHEALTH

2015-06-12 01:34 - 2015-06-12 01:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013

2015-06-12 01:34 - 2015-06-12 01:34 - 00000000 ____D C:\Program Files\Microsoft SQL Server

2015-06-12 01:34 - 2015-06-12 01:34 - 00000000 ____D C:\Program Files\Common Files\DESIGNER

2015-06-12 01:34 - 2015-06-12 01:34 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server

2015-06-12 01:32 - 2015-06-12 01:35 - 00000000 ____D C:\ProgramData\Microsoft Help

2015-06-12 01:32 - 2015-06-12 01:34 - 00000000 ____D C:\Program Files\Microsoft Office

2015-06-12 01:32 - 2015-06-12 01:32 - 00000000 ____D C:\Users\Adrian\AppData\Local\Microsoft Help

2015-06-12 01:32 - 2015-06-12 01:32 - 00000000 ____D C:\Program Files\Microsoft Analysis Services

2015-06-12 01:32 - 2015-06-12 01:32 - 00000000 ____D C:\Program Files (x86)\Microsoft Office

2015-06-12 01:32 - 2015-06-12 01:32 - 00000000 ____D C:\Program Files (x86)\Microsoft Analysis Services

2015-06-12 01:31 - 2015-06-12 01:31 - 00000000 __RHD C:\MSOCache

2015-06-12 01:19 - 2015-06-12 01:19 - 00000686 _____ C:\Users\Adrian\Desktop\downloads.lnk

2015-06-12 01:19 - 2015-06-12 01:19 - 00000657 _____ C:\Users\Adrian\Desktop\adrian.lnk

2015-06-12 01:04 - 2015-06-19 16:09 - 00001096 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job

2015-06-12 01:04 - 2015-06-19 11:46 - 00001092 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

2015-06-12 01:04 - 2015-06-12 01:04 - 00004068 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA

2015-06-12 01:04 - 2015-06-12 01:04 - 00003832 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore

2015-06-12 01:04 - 2015-06-12 01:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2015-06-12 01:04 - 2015-06-12 01:04 - 00000000 ____D C:\Program Files (x86)\Google

2015-06-12 01:03 - 2015-06-12 01:04 - 00000000 ____D C:\Users\Adrian\AppData\Local\Google

2015-06-12 01:03 - 2015-06-12 01:03 - 00000000 ____D C:\Users\Adrian\AppData\Roaming\Macromedia

2015-06-12 00:58 - 2015-06-12 00:58 - 00019634 _____ C:\WINDOWS\system32\results.xml

2015-06-12 00:58 - 2015-06-12 00:58 - 00000401 _____ C:\WINDOWS\system32\{F33C3B9B-72AF-418A-B3FD-560646F7CDA2}.bat

2015-06-12 00:57 - 2015-06-18 21:20 - 00003600 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3400116732-2033998285-2783747925-1001

2015-06-12 00:57 - 2015-06-12 00:57 - 00000728 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel® HD Graphics Control Panel.lnk

2015-06-12 00:57 - 2015-06-12 00:57 - 00000000 ____D C:\Program Files (x86)\Intel

2015-06-12 00:56 - 2015-06-12 00:58 - 00000000 ____D C:\Intel

2015-06-12 00:56 - 2015-06-12 00:57 - 00000000 ____D C:\Program Files\Intel

2015-06-12 00:55 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DX9_43.dll

2015-06-12 00:55 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DX9_43.dll

2015-06-12 00:55 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx10_43.dll

2015-06-12 00:55 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx10_43.dll

2015-06-12 00:55 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx11_43.dll

2015-06-12 00:55 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx11_43.dll

2015-06-12 00:54 - 2015-06-19 11:49 - 00863592 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2015-06-12 00:54 - 2015-06-19 11:42 - 00000000 ____D C:\ProgramData\NVIDIA

2015-06-12 00:54 - 2015-06-18 20:15 - 00000000 ____D C:\Users\Adrian\AppData\Local\NVIDIA Corporation

2015-06-12 00:54 - 2015-06-18 20:15 - 00000000 ____D C:\Users\Adrian\AppData\Local\NVIDIA

2015-06-12 00:54 - 2015-06-12 00:59 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation

2015-06-12 00:54 - 2015-06-12 00:54 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation

2015-06-12 00:54 - 2015-06-03 18:04 - 01756424 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvspbridge64.dll

2015-06-12 00:54 - 2015-06-03 18:04 - 01571696 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvspcap64.dll

2015-06-12 00:54 - 2015-06-03 18:04 - 01320304 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvspcap.dll

2015-06-12 00:54 - 2015-06-03 18:04 - 01316000 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvspbridge.dll

2015-06-12 00:54 - 2015-05-29 15:49 - 00086528 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.dll

2015-06-12 00:54 - 2015-05-29 15:49 - 00082432 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.dll

2015-06-12 00:54 - 2015-05-28 01:15 - 06872904 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcpl.dll

2015-06-12 00:54 - 2015-05-28 01:15 - 03491984 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvsvc64.dll

2015-06-12 00:54 - 2015-05-28 01:15 - 02558608 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvsvcr.dll

2015-06-12 00:54 - 2015-05-28 01:15 - 00937288 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvvsvc.exe

2015-06-12 00:54 - 2015-05-28 01:15 - 00385168 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvmctray.dll

2015-06-12 00:54 - 2015-05-28 01:15 - 00062608 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvshext.dll

2015-06-12 00:54 - 2015-05-28 00:52 - 00571024 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvStreaming.exe

2015-06-12 00:54 - 2015-05-27 07:48 - 04408727 _____ C:\WINDOWS\system32\nvcoproc.bin

2015-06-12 00:53 - 2015-06-18 20:15 - 00000000 ____D C:\ProgramData\NVIDIA Corporation

2015-06-12 00:53 - 2015-06-18 20:15 - 00000000 ____D C:\ProgramData\boost_interprocess

2015-06-12 00:53 - 2015-06-12 00:54 - 00000000 ____D C:\Program Files\NVIDIA Corporation

2015-06-12 00:53 - 2015-06-12 00:53 - 00000000 ____D C:\NVIDIA

2015-06-12 00:53 - 2015-05-28 04:04 - 42719888 _____ C:\WINDOWS\system32\nvcompiler.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 37741712 _____ C:\WINDOWS\SysWOW64\nvcompiler.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 30480528 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvoglv64.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 22946960 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvoglv32.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 17486856 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvwgf2umx.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 16185352 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvopencl.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 15864064 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvd3dumx.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 14987528 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvwgf2um.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 14495448 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuda.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 13304280 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvopencl.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 12852152 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvd3dum.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 11830512 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuda.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 10995528 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvlddmkm.sys

2015-06-12 00:53 - 2015-05-28 04:04 - 03379680 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvapi64.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 02986392 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvapi.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 02932368 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuvid.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 02599056 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuvid.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 01898312 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispco6435306.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 01558848 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvhdagenco6420103.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 01557832 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvmcvadgenco64.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 01557832 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispgenco6435306.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 01099808 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvumdshimx.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 01059984 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFR64.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 01050440 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvFBC64.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 00982856 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFR.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 00974480 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvFBC.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 00939080 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvumdshim.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 00878816 _____ C:\WINDOWS\system32\nvmcumd.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 00503408 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvEncodeAPI64.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 00408208 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFROpenGL.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 00407112 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvEncodeAPI.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 00364176 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFROpenGL.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 00195912 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvhda64v.sys

2015-06-12 00:53 - 2015-05-28 04:04 - 00175880 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvinitx.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 00154256 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvinit.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 00150648 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvoglshim64.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 00128512 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvoglshim32.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 00117576 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvaudcaparm.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 00052880 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvaudcap64v.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 00048784 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvaudcap32v.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 00039056 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvvadarm.sys

2015-06-12 00:53 - 2015-05-28 04:04 - 00038032 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvvad64v.sys

2015-06-12 00:53 - 2015-05-28 04:04 - 00031552 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvhdap64.dll

2015-06-12 00:53 - 2015-05-28 04:04 - 00030966 _____ C:\WINDOWS\system32\nvinfo.pb

2015-06-12 00:52 - 2015-06-19 12:04 - 00000000 ___RD C:\Users\Adrian\SkyDrive

2015-06-12 00:51 - 2015-06-19 11:58 - 00679571 _____ C:\WINDOWS\WindowsUpdate.log

2015-06-12 00:51 - 2015-06-14 16:27 - 00000000 ____D C:\Users\Adrian\AppData\Local\Packages

2015-06-12 00:51 - 2015-06-14 13:27 - 00000000 ____D C:\Users\Adrian\AppData\Local\VirtualStore

2015-06-12 00:51 - 2015-06-12 00:51 - 00001446 _____ C:\Users\Adrian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2015-06-12 00:51 - 2015-06-12 00:51 - 00000000 ____D C:\WINDOWS\CSC

2015-06-12 00:51 - 2015-06-12 00:51 - 00000000 ____D C:\Users\Adrian\AppData\Roaming\Adobe

2015-06-12 00:51 - 2013-08-22 02:17 - 02407936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll

2015-06-12 00:50 - 2015-06-12 00:58 - 00000000 ____D C:\Users\Adrian

2015-06-12 00:50 - 2015-06-12 00:50 - 00000020 ___SH C:\Users\Adrian\ntuser.ini

2015-06-12 00:50 - 2013-08-22 12:36 - 00000000 ___RD C:\Users\Adrian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2015-06-12 00:50 - 2013-08-22 12:36 - 00000000 ___RD C:\Users\Adrian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2015-06-12 00:50 - 2013-08-22 12:36 - 00000000 ___RD C:\Users\Adrian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility

2015-06-12 00:50 - 2013-08-22 12:36 - 00000000 ____D C:\Users\Adrian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

2015-05-29 15:49 - 2015-05-29 15:49 - 24846712 _____ (Intel Corporation) C:\WINDOWS\system32\igdumdim64.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 24048456 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdumdim32.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 17804608 _____ C:\WINDOWS\system32\igd11dxva64.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 17329224 _____ C:\WINDOWS\SysWOW64\igd11dxva32.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 15981056 _____ (Intel Corporation) C:\WINDOWS\system32\igdfcl64.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 10851840 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdfcl32.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 09528320 _____ (Intel Corporation) C:\WINDOWS\system32\ig75icd64.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 09422928 _____ (Intel Corporation) C:\WINDOWS\system32\igd10iumd64.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 08631888 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igd10iumd32.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 07500800 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\ig75icd32.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 06725162 _____ C:\WINDOWS\system32\igdclbif.bin

2015-05-29 15:49 - 2015-05-29 15:49 - 06160424 _____ (Intel Corporation) C:\WINDOWS\system32\igdusc64.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 04892088 _____ (Intel Corporation) C:\WINDOWS\system32\Drivers\igdkmd64.sys

2015-05-29 15:49 - 2015-05-29 15:49 - 04851848 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdusc32.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 03584512 _____ (Intel Corporation) C:\WINDOWS\system32\igdrcl64.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 03318272 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdrcl32.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 02944648 _____ (Intel Corporation) C:\WINDOWS\system32\IntelWiDiVAD64.exe

2015-05-29 15:49 - 2015-05-29 15:49 - 02813952 _____ C:\WINDOWS\system32\iglhxa64.cpa

2015-05-29 15:49 - 2015-05-29 15:49 - 02776408 _____ (Intel Corporation) C:\WINDOWS\system32\IntelWiDiAAC64.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 02039296 _____ (Intel Corporation) C:\WINDOWS\system32\igfxLHM.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 01540904 _____ (Intel Corporation) C:\WINDOWS\system32\igdmd64.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 01513304 _____ (Intel Corporation) C:\WINDOWS\system32\IntelWiDiSecureSourceFilter64.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 01402336 _____ (Intel Corporation) C:\WINDOWS\system32\iglhsip64.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 01399240 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\iglhsip32.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 01371136 _____ (Intel Corporation) C:\WINDOWS\system32\igfxcmjit64.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 01196336 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdmd32.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 01131008 _____ (Intel Corporation) C:\WINDOWS\system32\GfxResources.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 01063936 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igfxcmjit32.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 01036392 _____ (Intel Corporation) C:\WINDOWS\system32\Gfxv4_0.exe

2015-05-29 15:49 - 2015-05-29 15:49 - 01032808 _____ (Intel Corporation) C:\WINDOWS\system32\Gfxv2_0.exe

2015-05-29 15:49 - 2015-05-29 15:49 - 01014368 _____ (Intel Corporation) C:\WINDOWS\system32\IntelWiDiWinNextAgent64.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00698880 _____ (Intel Corporation) C:\WINDOWS\system32\igfxDH.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00671328 _____ (Intel Corporation) C:\WINDOWS\system32\IntelWiDiAudioFilter64.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00641530 _____ C:\WINDOWS\system32\FilmModeDetection.wmv

2015-05-29 15:49 - 2015-05-29 15:49 - 00623616 _____ (Intel Corporation) C:\WINDOWS\system32\MetroIntelGenericUIFramework.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00616280 _____ (Intel Corporation) C:\WINDOWS\system32\IntelWiDiMux64.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00472168 _____ (Intel Corporation) C:\WINDOWS\system32\IntelWiDiUMS64.exe

2015-05-29 15:49 - 2015-05-29 15:49 - 00460048 _____ (Intel® Corporation) C:\WINDOWS\system32\Drivers\IntcDAud.sys

2015-05-29 15:49 - 2015-05-29 15:49 - 00448104 _____ (Intel Corporation) C:\WINDOWS\system32\GfxUIEx.exe

2015-05-29 15:49 - 2015-05-29 15:49 - 00424960 _____ (Intel Corporation) C:\WINDOWS\system32\igdbcl64.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00403671 _____ C:\WINDOWS\system32\ImageStabilization.wmv

2015-05-29 15:49 - 2015-05-29 15:49 - 00392296 _____ C:\WINDOWS\system32\igfxTray.exe

2015-05-29 15:49 - 2015-05-29 15:49 - 00385024 _____ (Intel Corporation) C:\WINDOWS\system32\igfxOSP.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00375173 _____ C:\WINDOWS\system32\ColorImageEnhancement.wmv

2015-05-29 15:49 - 2015-05-29 15:49 - 00373760 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdbcl32.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00372224 _____ (Intel Corporation) C:\WINDOWS\system32\IntelOpenCL64.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00354136 _____ (Intel Corporation) C:\WINDOWS\system32\IntelWiDiSilenceFilter64.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00344168 _____ (Intel Corporation) C:\WINDOWS\system32\igfxCUIService.exe

2015-05-29 15:49 - 2015-05-29 15:49 - 00338536 _____ (Intel Corporation) C:\WINDOWS\system32\DPTopologyApp.exe

2015-05-29 15:49 - 2015-05-29 15:49 - 00338024 _____ (Intel Corporation) C:\WINDOWS\system32\DPTopologyAppv2_0.exe

2015-05-29 15:49 - 2015-05-29 15:49 - 00313448 _____ (Intel Corporation) C:\WINDOWS\system32\igfxEM.exe

2015-05-29 15:49 - 2015-05-29 15:49 - 00304128 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\IntelOpenCL32.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00286208 _____ (Intel Corporation) C:\WINDOWS\system32\igfxDI.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00282696 _____ (Intel Corporation) C:\WINDOWS\system32\igd10idpp64.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00279144 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\IntelCpHeciSvc.exe

2015-05-29 15:49 - 2015-05-29 15:49 - 00274776 _____ (Intel Corporation) C:\WINDOWS\system32\IntelWiDiUtils64.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00263120 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igd10idpp32.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00256000 _____ C:\WINDOWS\system32\igfxCPL.cpl

2015-05-29 15:49 - 2015-05-29 15:49 - 00248424 _____ (Intel Corporation) C:\WINDOWS\system32\igfxHK.exe

2015-05-29 15:49 - 2015-05-29 15:49 - 00229888 _____ (Intel Corporation) C:\WINDOWS\system32\igfxDTCM.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00220432 _____ (Intel Corporation) C:\WINDOWS\system32\iglhcp64.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00218728 _____ (Intel Corporation) C:\WINDOWS\system32\igfxext.exe

2015-05-29 15:49 - 2015-05-29 15:49 - 00213504 _____ (Intel Corporation) C:\WINDOWS\system32\igfx11cmrt64.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00213192 _____ (Intel Corporation) C:\WINDOWS\system32\igfxcmrt64.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00196704 _____ (Intel Corporation) C:\WINDOWS\system32\IntelWiDiDDEAgent64.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00192000 _____ C:\WINDOWS\system32\igdde64.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00184352 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\iglhcp32.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00183296 _____ (Intel Corporation) C:\WINDOWS\system32\igfxCoIn_v4222.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00179200 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igfx11cmrt32.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00178672 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igfxcmrt32.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00169984 _____ (Intel Corporation) C:\WINDOWS\system32\igdail64.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00156264 _____ (Intel Corporation) C:\WINDOWS\system32\difx64.exe

2015-05-29 15:49 - 2015-05-29 15:49 - 00153088 _____ C:\WINDOWS\SysWOW64\igdde32.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00152064 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdail32.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00135000 _____ (Intel Corporation) C:\WINDOWS\system32\IntelWiDiMCUMD64.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00127320 _____ (Intel Corporation) C:\WINDOWS\system32\IntelWiDiLogServer64.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00094208 _____ C:\WINDOWS\system32\IccLibDll_x64.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00086528 _____ C:\WINDOWS\system32\igfxCUIServicePS.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00086528 _____ (Khronos Group) C:\WINDOWS\SysWOW64\Intel_OpenCL_ICD32.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00082432 _____ (Khronos Group) C:\WINDOWS\system32\Intel_OpenCL_ICD64.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00073728 _____ ( ) C:\WINDOWS\system32\igfxDHLibv2_0.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00060416 _____ ( ) C:\WINDOWS\system32\igfxDHLib.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00044025 _____ C:\WINDOWS\system32\iglhxo64.vp

2015-05-29 15:49 - 2015-05-29 15:49 - 00043816 _____ C:\WINDOWS\system32\iglhxc64_dev.vp

2015-05-29 15:49 - 2015-05-29 15:49 - 00043494 _____ C:\WINDOWS\system32\iglhxc64.vp

2015-05-29 15:49 - 2015-05-29 15:49 - 00043298 _____ C:\WINDOWS\system32\iglhxg64_dev.vp

2015-05-29 15:49 - 2015-05-29 15:49 - 00043256 _____ C:\WINDOWS\system32\iglhxg64.vp

2015-05-29 15:49 - 2015-05-29 15:49 - 00042079 _____ C:\WINDOWS\system32\iglhxo64_dev.vp

2015-05-29 15:49 - 2015-05-29 15:49 - 00036616 _____ (Intel Corporation) C:\WINDOWS\system32\igfxexps.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00035328 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igfxexps32.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00010752 _____ ( ) C:\WINDOWS\system32\igfxDILibv2_0.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00010752 _____ ( ) C:\WINDOWS\system32\igfxDILib.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00010240 _____ ( ) C:\WINDOWS\system32\igfxEMLibv2_0.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00010240 _____ ( ) C:\WINDOWS\system32\igfxEMLib.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00005120 _____ ( ) C:\WINDOWS\system32\igfxLHMLibv2_0.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00005120 _____ ( ) C:\WINDOWS\system32\igfxLHMLib.dll

2015-05-29 15:49 - 2015-05-29 15:49 - 00004008 _____ C:\WINDOWS\system32\iglhxs64.vp

2015-05-29 15:49 - 2015-05-29 15:49 - 00001125 _____ C:\WINDOWS\system32\iglhxa64.vp

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-19 15:00 - 2013-08-22 12:36 - 00000000 ____D C:\WINDOWS\system32\sru

2015-06-19 11:42 - 2013-08-22 11:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2015-06-18 20:15 - 2013-08-22 11:46 - 00016238 _____ C:\WINDOWS\setupact.log

2015-06-18 09:44 - 2013-08-22 12:36 - 00000000 ___HD C:\WINDOWS\system32\GroupPolicy

2015-06-16 09:05 - 2013-08-22 12:36 - 00000000 ____D C:\WINDOWS\rescache

2015-06-15 19:13 - 2013-08-22 12:20 - 00000000 ____D C:\WINDOWS\CbsTemp

2015-06-15 02:15 - 2013-08-22 10:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI

2015-06-14 16:31 - 2013-08-22 12:36 - 00000000 ____D C:\WINDOWS\AppReadiness

2015-06-14 15:44 - 2013-08-22 12:36 - 00000000 ____D C:\WINDOWS\Vss

2015-06-12 09:47 - 2013-08-22 12:36 - 00262144 _____ C:\WINDOWS\system32\config\BCD-Template

2015-06-12 09:47 - 2013-08-22 12:36 - 00000000 ____D C:\WINDOWS\system32\Recovery

2015-06-12 09:33 - 2013-08-22 11:44 - 00409848 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2015-06-12 08:47 - 2013-08-22 12:37 - 00001720 _____ C:\WINDOWS\DtcInstall.log

2015-06-12 04:41 - 2013-08-22 12:36 - 00000000 ____D C:\WINDOWS\Registration

2015-06-12 01:34 - 2013-08-22 12:36 - 00000000 ____D C:\Program Files\Common Files\microsoft shared

2015-06-12 01:32 - 2013-08-22 16:11 - 00000000 ____D C:\WINDOWS\ShellNew

2015-06-12 00:54 - 2013-08-22 12:36 - 00000000 ____D C:\WINDOWS\system32\restore

2015-06-12 00:54 - 2013-08-22 12:36 - 00000000 ____D C:\WINDOWS\Help

2015-06-12 00:51 - 2013-08-22 12:36 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel

2015-06-12 00:51 - 2013-08-22 12:36 - 00000000 ____D C:\WINDOWS\WinStore

2015-06-12 00:51 - 2013-08-22 12:36 - 00000000 ____D C:\WINDOWS\FileManager

2015-06-12 00:51 - 2013-08-22 12:36 - 00000000 ____D C:\WINDOWS\Camera

==================== Files in the root of some directories =======

2015-06-12 04:40 - 2015-06-12 04:40 - 0007597 _____ () C:\Users\Adrian\AppData\Local\Resmon.ResmonCfg

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-06-12 08:47

==================== End of log ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version:13-06-2015

Ran by Adrian at 2015-06-19 16:52:08

Running from C:\Users\Adrian\Desktop\frst

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-3400116732-2033998285-2783747925-500 - Administrator - Disabled)

Adrian (S-1-5-21-3400116732-2033998285-2783747925-1001 - Administrator - Enabled) => C:\Users\Adrian

Guest (S-1-5-21-3400116732-2033998285-2783747925-501 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Assassin's Creed IV Black Flag (HKLM-x32\...\Steam App 242050) (Version: - Ubisoft Montreal)

DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.45.4.0315 - DT Soft Ltd)

Enforcer Police Crime Action (HKLM-x32\...\Enforcer Police Crime Action_is1) (Version: - )

Game of Thrones (HKLM-x32\...\Steam App 208730) (Version: - Cyanide Studios)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.124 - Google Inc.)

Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden

InputMapper (HKLM-x32\...\{1A44056A-C7D8-4561-BC43-A0AA7D7AAA64}) (Version: 1.5.31.0 - DSDCS)

Intel® Chipset Device Software (x32 Version: 10.0.27 - Intel® Corporation) Hidden

Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.14.4222 - Intel Corporation)

METAL GEAR SOLID V: GROUND ZEROES (HKLM-x32\...\Steam App 311340) (Version: - Kojima Productions)

Microsoft Flight Simulator SimConnect Client v10.0.61259.0 (HKLM-x32\...\{D61CA184-3F6D-4A50-B2CC-7A18447D6A8D}) (Version: 10.0.61259.0 - Microsoft Corporation)

Microsoft Flight Simulator SimConnect Client v10.0.62613.0 (HKLM-x32\...\{33D89314-361A-4495-A1E1-0ACBCE08F78D}) (Version: 10.0.62613.0 - Microsoft Corporation)

Microsoft Flight Simulator X: Steam Edition (HKLM-x32\...\Steam App 314160) (Version: - Microsoft Game Studios)

Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4420.1017 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Xbox 360 Accessories 1.2 (HKLM\...\{D9C50188-12D5-4D3E-8F00-682346C2AA5F}) (Version: 1.20.146.0 - Microsoft)

MSXML 4.0 SP2 Parser and SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)

NVIDIA 3D Vision Controller Driver 352.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 352.65 - NVIDIA Corporation)

NVIDIA 3D Vision Driver 353.06 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 353.06 - NVIDIA Corporation)

NVIDIA GeForce Experience 2.4.5.44 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.4.5.44 - NVIDIA Corporation)

NVIDIA Graphics Driver 353.06 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 353.06 - NVIDIA Corporation)

NVIDIA HD Audio Driver 1.3.34.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.34.3 - NVIDIA Corporation)

NVIDIA Miracast Virtual Audio 353.06 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Miracast.VirtualAudio) (Version: 353.06 - NVIDIA Corporation)

NVIDIA PhysX System Software 9.15.0428 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.15.0428 - NVIDIA Corporation)

Outils de vérification linguistique 2013 de Microsoft Office - Français (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Paint.NET v3.5.10 (HKLM\...\{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}) (Version: 3.60.0 - dotPDN LLC)

Pro Evolution Soccer 2013 (HKLM-x32\...\{C2523AE6-F335-4D0B-BC15-1C07E4ACE629}) (Version: 1.00.0000 - KONAMI)

SHIELD Streaming (Version: 4.1.2000 - NVIDIA Corporation) Hidden

SHIELD Wireless Controller Driver (Version: 2.4.5.44 - NVIDIA Corporation) Hidden

Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)

The Witcher 3: Wild Hunt (HKLM-x32\...\Steam App 292030) (Version: - CD PROJEKT RED)

Two Worlds II (HKLM-x32\...\Steam App 7520) (Version: - Reality Pump Studios)

WinRAR 5.01 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-3400116732-2033998285-2783747925-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)

==================== Restore Points =========================

12-06-2015 00:54:59 Installed DirectX

15-06-2015 19:09:16 Installed DirectX

17-06-2015 17:43:57 avast! antivirus system restore point

18-06-2015 20:07:39 Installed DirectX

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 10:25 - 2015-06-18 09:40 - 00000753 ____A C:\WINDOWS\system32\Drivers\etc\hosts

127.0.0.1 localhost

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {1CA8609E-58D1-42BB-8F58-6D70C08BE3C9} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)

Task: {48D573F6-1290-4B13-91E8-8B1380996D02} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-06-12] (Google Inc.)

Task: {4ADBD9D3-EC2E-443D-A027-82E5FC877451} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2012-10-01] (Microsoft Corporation)

Task: {5688CAED-C607-4B5D-BCC2-2E7AB6C7ACA6} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-06-12] (Google Inc.)

Task: {668B5C4C-D929-41D8-A98D-DEDD35370040} - System32\Tasks\AutoKMS => C:\WINDOWS\AutoKMS\AutoKMS.exe [2015-06-12] ()

Task: {FE202C94-B1E8-4624-B8D8-09FB0ABF0916} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2015-06-12 00:54 - 2015-05-28 01:15 - 00116368 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll

2015-06-12 00:54 - 2015-06-03 18:06 - 00011920 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\Adrian\SkyDrive:ms-properties

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3400116732-2033998285-2783747925-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Adrian\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper

DNS Servers: 89.248.171.33 - 8.8.8.8

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run: => "NvBackend"

HKLM\...\StartupApproved\Run: => "ShadowPlay"

HKLM\...\StartupApproved\Run: => "XboxStat"

HKU\S-1-5-21-3400116732-2033998285-2783747925-1001\...\StartupApproved\Run: => "Steam"

HKU\S-1-5-21-3400116732-2033998285-2783747925-1001\...\StartupApproved\Run: => "DAEMON Tools Lite"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppextcomobj.exe

FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppextcomobj.exe

FirewallRules: [{77F72464-78B3-48B0-B0F2-0F363AC17787}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

FirewallRules: [{89BD8F87-F23E-4E7E-88A8-BDE83A4C9B3F}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

FirewallRules: [{7FF0D0F4-4780-44A1-A184-1CE2ED4353A0}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe

FirewallRules: [{06D7F422-37F6-4E90-B842-2F1B122118AB}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe

FirewallRules: [{0CAE9F5F-481F-4AB6-BD29-B26780178D2B}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe

FirewallRules: [{D4957CD0-8D70-46CE-B393-3731B5F88E73}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe

FirewallRules: [{01313BE6-25B0-4663-A2C9-106CB08069BB}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

FirewallRules: [{04591195-6F56-4242-98B6-E62B69732F72}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe

FirewallRules: [{565DBDBA-97A1-4889-96F1-8FB6B6DC8EEA}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe

FirewallRules: [{75351BB4-B052-4BDF-9291-C29B4519BC50}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

FirewallRules: [{510360FF-CAEF-432A-8481-E90AA338A25D}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

FirewallRules: [{8CF9B0CD-4C61-4C72-9281-E1487FBDEE3B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Assassin's Creed IV Black Flag\AC4BFSP.exe

FirewallRules: [{3D70B7CD-E352-4AE0-8A2F-0DD657757C63}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Assassin's Creed IV Black Flag\AC4BFSP.exe

FirewallRules: [{A7E21DAD-CD27-4504-B96E-108810533BD8}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Game of Thrones\Binaries\Win32\ShippingPC-AGOTGame.exe

FirewallRules: [{DB4EA62F-7C4A-4033-99EC-FE9F5114271B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Game of Thrones\Binaries\Win32\ShippingPC-AGOTGame.exe

FirewallRules: [{21AF6423-DA38-406B-A279-34A3D6C32A3D}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Metal Gear Solid Ground Zeroes\MgsGroundZeroes.exe

FirewallRules: [{D343044C-7D4A-43A5-A562-2AD6E062F643}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Metal Gear Solid Ground Zeroes\MgsGroundZeroes.exe

FirewallRules: [{D75A6A9C-2306-44D4-9D91-74E350F525B9}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Two Worlds II\TwoWorlds2.exe

FirewallRules: [{B08123F4-3B1D-49AD-8AFA-8DB86C8F96E5}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Two Worlds II\TwoWorlds2.exe

FirewallRules: [{9F8778C7-F077-4691-AF46-B1FBD3223452}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Two Worlds II\TwoWorlds2_DX10.exe

FirewallRules: [{3610E05C-5ED6-4E26-B2A3-1CEEDD234349}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Two Worlds II\TwoWorlds2_DX10.exe

FirewallRules: [{2B197FA2-29A3-4BBB-9DD6-7B241CEA48F9}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Witcher 3\bin\x64\witcher3.exe

FirewallRules: [{46D94CB5-A327-4714-9F06-A37554696CFA}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Witcher 3\bin\x64\witcher3.exe

FirewallRules: [{F75AA6C6-A776-46BA-8BCE-6C85265EB4EB}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\FSX\fsx.exe

FirewallRules: [{198FCF1C-6036-4786-B71B-A45238328433}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\FSX\fsx.exe

FirewallRules: [TCP Query User{1079F915-6936-4203-98A8-7197B237A01F}C:\program files (x86)\konami\pro evolution soccer 2013\pes2013.exe] => (Allow) C:\program files (x86)\konami\pro evolution soccer 2013\pes2013.exe

FirewallRules: [UDP Query User{A7704081-E5E4-4FDA-AF28-AD3CC81FFFB9}C:\program files (x86)\konami\pro evolution soccer 2013\pes2013.exe] => (Allow) C:\program files (x86)\konami\pro evolution soccer 2013\pes2013.exe

==================== Faulty Device Manager Devices =============

Name: PCI Simple Communications Controller

Description: PCI Simple Communications Controller

Class Guid:

Manufacturer:

Service:

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

==================== Event log errors: =========================

Application errors:

==================

Error: (06/18/2015 11:32:06 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: Solitaire.exe, version: 1.0.0.0, time stamp: 0x54d8b5a6

Faulting module name: Windows.UI.Xaml.dll, version: 6.3.9600.16384, time stamp: 0x5215860f

Exception code: 0xc000027b

Fault offset: 0x00804fec

Faulting process id: 0xf78

Faulting application start time: 0xSolitaire.exe0

Faulting application path: Solitaire.exe1

Faulting module path: Solitaire.exe2

Report Id: Solitaire.exe3

Faulting package full name: Solitaire.exe4

Faulting package-relative application ID: Solitaire.exe5

Error: (06/18/2015 08:07:40 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

Details:

AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

System Error:

Access is denied.

Error: (06/18/2015 01:56:33 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: pes2013.exe, version: 1.3.0.0, time stamp: 0x50b536fe

Faulting module name: ntdll.dll, version: 6.3.9600.16384, time stamp: 0x52159015

Exception code: 0xc0000005

Fault offset: 0x0003e182

Faulting process id: 0x127c

Faulting application start time: 0xpes2013.exe0

Faulting application path: pes2013.exe1

Faulting module path: pes2013.exe2

Report Id: pes2013.exe3

Faulting package full name: pes2013.exe4

Faulting package-relative application ID: pes2013.exe5

Error: (06/17/2015 05:55:05 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: The program Para Jogar CLIQUE AQUI.exe version 1.0.0.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control

panel.

Process ID: ea4

Start Time: 01d0a93fdac80876

Termination Time: 0

Application Path: C:\Program Files (x86)\KONAMI\Pro Evolution Soccer 2013\Para Jogar CLIQUE AQUI.exe

Report Id: 1ff00efe-1533-11e5-825a-74d435e68c45

Faulting package full name:

Faulting package-relative application ID:

Error: (06/17/2015 05:54:13 PM) (Source: Application Hang) (EventID: 1002) (User: )

panel.

Process ID: 18fc

Start Time: 01d0a93fba01330a

Termination Time: 0

Application Path: C:\Program Files (x86)\KONAMI\Pro Evolution Soccer 2013\Para Jogar CLIQUE AQUI.exe

Report Id: 00c0138e-1533-11e5-825a-74d435e68c45

Faulting package full name:

Faulting package-relative application ID:

Error: (06/17/2015 05:50:00 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

Details:

AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

System Error:

Access is denied.

Error: (06/17/2015 05:49:57 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

Details:

AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

System Error:

Access is denied.

Error: (06/17/2015 05:43:58 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

Details:

AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

System Error:

Access is denied.

Error: (06/17/2015 09:43:39 AM) (Source: Application Hang) (EventID: 1002) (User: )

Description: The program Minesweeper.exe version 1.0.0.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 1160

Start Time: 01d0a8fb32868f29

Termination Time: 4294967295

Application Path: C:\Program Files\WindowsApps\Microsoft.MicrosoftMinesweeper_2.4.1408.2503_x86__8wekyb3d8bbwe\Minesweeper.exe

Report Id: 79dca64e-14ee-11e5-825a-74d435e68c45

Faulting package full name: Microsoft.MicrosoftMinesweeper_2.4.1408.2503_x86__8wekyb3d8bbwe

Faulting package-relative application ID: App

Error: (06/17/2015 09:43:39 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: DALLEGRAVE-PC)

Description: App Microsoft.MicrosoftMinesweeper_2.4.1408.2503_x86__8wekyb3d8bbwe+App did not launch within its allotted time.

System errors:

=============

Error: (06/19/2015 00:51:05 AM) (Source: DCOM) (EventID: 10010) (User: DALLEGRAVE-PC)

Description: {03E64E17-B220-4052-9B9B-155F9CB8E016}

Error: (06/19/2015 00:51:05 AM) (Source: DCOM) (EventID: 10010) (User: DALLEGRAVE-PC)

Description: {03E64E17-B220-4052-9B9B-155F9CB8E016}

Error: (06/19/2015 00:51:04 AM) (Source: DCOM) (EventID: 10010) (User: DALLEGRAVE-PC)

Description: {03E64E17-B220-4052-9B9B-155F9CB8E016}

Error: (06/19/2015 00:51:04 AM) (Source: DCOM) (EventID: 10010) (User: DALLEGRAVE-PC)

Description: {03E64E17-B220-4052-9B9B-155F9CB8E016}

Error: (06/19/2015 00:51:03 AM) (Source: DCOM) (EventID: 10010) (User: DALLEGRAVE-PC)

Description: {03E64E17-B220-4052-9B9B-155F9CB8E016}

Error: (06/18/2015 11:46:00 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The Windows Presentation Foundation Font Cache 3.0.0.0 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.

Error: (06/18/2015 11:46:00 AM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The NVIDIA Streamer Service service terminated unexpectedly. It has done this 1 time(s).

Error: (06/18/2015 11:46:00 AM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The NVIDIA Network Service service terminated unexpectedly. It has done this 1 time(s).

Error: (06/18/2015 11:46:00 AM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The NVIDIA GeForce Experience Service service terminated unexpectedly. It has done this 1 time(s).

Error: (06/18/2015 11:46:00 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.

Microsoft Office:

=========================

Error: (06/18/2015 11:32:06 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Solitaire.exe1.0.0.054d8b5a6Windows.UI.Xaml.dll6.3.9600.163845215860fc000027b00804fecf7801d0aa37daf88dd3C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_2.6.1502.901_x86__8wekyb3d8bbwe\Solitaire.exeC:

\Windows\System32\Windows.UI.Xaml.dll5ff5ca37-162b-11e5-825d-74d435e68c45Microsoft.MicrosoftSolitaireCollection_2.6.1502.901_x86__8wekyb3d8bbweApp

Error: (06/18/2015 08:07:40 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description:

Details:

AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

System Error:

Access is denied.

Error: (06/18/2015 01:56:33 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: pes2013.exe1.3.0.050b536fentdll.dll6.3.9600.1638452159015c00000050003e182127c01d0a97682608bfdC:\Program Files (x86)\KONAMI\Pro Evolution Soccer 2013\pes2013.exeC:\WINDOWS\SYSTEM32\ntdll.dll63891d3d-1576-11e5-825a-

74d435e68c45

Error: (06/17/2015 05:55:05 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: Para Jogar CLIQUE AQUI.exe1.0.0.0ea401d0a93fdac808760C:\Program Files (x86)\KONAMI\Pro Evolution Soccer 2013\Para Jogar CLIQUE AQUI.exe1ff00efe-1533-11e5-825a-74d435e68c45

Error: (06/17/2015 05:54:13 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: Para Jogar CLIQUE AQUI.exe1.0.0.018fc01d0a93fba01330a0C:\Program Files (x86)\KONAMI\Pro Evolution Soccer 2013\Para Jogar CLIQUE AQUI.exe00c0138e-1533-11e5-825a-74d435e68c45

Error: (06/17/2015 05:50:00 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description:

Details:

AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

System Error:

Access is denied.

Error: (06/17/2015 05:49:57 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description:

Details:

AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

System Error:

Access is denied.

Error: (06/17/2015 05:43:58 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description:

Details:

AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

System Error:

Access is denied.

Error: (06/17/2015 09:43:39 AM) (Source: Application Hang) (EventID: 1002) (User: )

Description: Minesweeper.exe1.0.0.0116001d0a8fb32868f294294967295C:\Program Files\WindowsApps\Microsoft.MicrosoftMinesweeper_2.4.1408.2503_x86__8wekyb3d8bbwe\Minesweeper.exe79dca64e-14ee-11e5-825a-

74d435e68c45Microsoft.MicrosoftMinesweeper_2.4.1408.2503_x86__8wekyb3d8bbweApp

Error: (06/17/2015 09:43:39 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: DALLEGRAVE-PC)

Description: Microsoft.MicrosoftMinesweeper_2.4.1408.2503_x86__8wekyb3d8bbwe+App

==================== Memory info ===========================

Processor: Intel® Core™ i7-4790K CPU @ 4.00GHz

Percentage of memory in use: 31%

Total physical RAM: 8076.95 MB

Available physical RAM: 5521.42 MB

Total Pagefile: 9356.95 MB

Available Pagefile: 6750.08 MB

Total Virtual: 131072 MB

Available Virtual: 131071.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:223.48 GB) (Free:56.94 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

Drive d: () (Fixed) (Total:931.51 GB) (Free:744.59 GB) NTFS

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 223.6 GB) (Disk ID: 7CCB641F)

Partition 1: (Active) - (Size=223.5 GB) - (Type=07 NTFS)

========================================================

Disk: 1 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 1C31C86A)

Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

==================== End of log ============================

#19
Biscuithd

Posted 22 June 2015 - 08:22 AM

Trusted Helper

Malware Removal
2,573 posts

Let's see if this helps.

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint:
EmptyTemp:
SearchScopes: HKU\S-1-5-21-3400116732-2033998285-2783747925-1001 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = http://www.google.co...q={searchTerms}

CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-06-12]

CHR Extension: (Google Wallet) - C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-06-12]

CHR Extension: (Gmail) - C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-06-12]

2015-06-12 09:33 - 2015-06-12 09:33 - 00000118 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat

2015-06-12 00:58 - 2015-06-12 00:58 - 00000401 _____ C:\WINDOWS\system32\{F33C3B9B-72AF-418A-B3FD-560646F7CDA2}.bat

Save this as fixlist.txt, in the same location as FRST.exe

Run FRST and press Fix
On completion a log will be generated please post that

#20
adriandallegrave

Posted 22 June 2015 - 08:58 AM

Member

Topic Starter
Member
29 posts

It ran succesfully. The malware stays though.

Fix result of Farbar Recovery Scan Tool (x64) Version:13-06-2015

Ran by Adrian at 2015-06-22 11:52:41 Run:1

Running from C:\Users\Adrian\Desktop\frst

Loaded Profiles: Adrian (Available Profiles: Adrian)

Boot Mode: Normal

==============================================

fixlist content:

*****************

CreateRestorePoint:

EmptyTemp:

SearchScopes: HKU\S-1-5-21-3400116732-2033998285-2783747925-1001 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = http://www.google.co...q={searchTerms}

CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-06-12]

CHR Extension: (Google Wallet) - C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-06-12]

CHR Extension: (Gmail) - C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-06-12]

2015-06-12 09:33 - 2015-06-12 09:33 - 00000118 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat

2015-06-12 00:58 - 2015-06-12 00:58 - 00000401 _____ C:\WINDOWS\system32\{F33C3B9B-72AF-418A-B3FD-560646F7CDA2}.bat

*****************

Restore point was successfully created.

"HKU\S-1-5-21-3400116732-2033998285-2783747925-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66}" => key removed successfully

HKCR\CLSID\{012E1000-F331-11DB-8314-0800200C9A66} => key not found.

C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg => moved successfully.

C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda => moved successfully.

C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia => moved successfully.

C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat => moved successfully.

C:\WINDOWS\system32\{F33C3B9B-72AF-418A-B3FD-560646F7CDA2}.bat => moved successfully.

EmptyTemp: => 858.2 MB temporary data Removed.

The system needed a reboot..

==== End of Fixlog 11:52:49 ====

#21
adriandallegrave

Posted 24 June 2015 - 02:40 PM

Member

Topic Starter
Member
29 posts

Do you have any new suggestions?

#22
Biscuithd

Posted 25 June 2015 - 06:58 AM

Trusted Helper

Malware Removal
2,573 posts

Very sorry that I missed your reply. I will dig in again.

#23
Biscuithd

Posted 25 June 2015 - 07:26 AM

Trusted Helper

Malware Removal
2,573 posts

The FreeLotto that you show hasn't been around in that form for a while. Let's see if we can remove it all at once.

Download ADWCleaner by Xplode to your desktop.

Close all programs and right-click on the icon - select Run as Administrator.
You will be presented with the console like the one below:
Click on Scan and follow the prompts.
Let it run unhindered.
When done, click on the Clean button, and follow the prompts.
Allow the system to reboot.

After that, you will then be presented with the report. Copy & Paste this report on your next reply.

The report will be saved in the C:\AdwCleaner folder, as AdwCleaner[S0].txt.

You can download Malwarebytes Anti-Malware Free from the below link, then double click on it to install this program. Even if you have a copy, download a new one.
MALWAREBYTES ANTI-MALWARE DOWNLOAD LINK (This link will open a download page in a new window from where you can download Malwarebytes Anti-Malware Free)
When the installation begins, keep following the prompts in order to continue with the setup process.
On the Scanner tab,select Perform quick scan and then click on the Scan button to start scanning your computer.
Malwarebytes’ Anti-Malware will now start scanning your computer for freelotto.com malicious files as shown below.
When the Malwarebytes scan will be completed,click on Show Result.
You will now be presented with a screen showing you the malware infections that Malwarebytes’ Anti-Malware has detected.Please note that the infections found may be different than what is shown in the image.Make sure that everything is Checked (ticked) and click on the Remove Selected button.

#24
adriandallegrave

Posted 25 June 2015 - 03:11 PM

Member

Topic Starter
Member
29 posts

The malware is not actually related to freelotto.com nor oursurfing.com. It makes the browser open a new tab every time I click anywhere on the page for the first time and it's always a different website. freelotto.com was just an example. Besides that it brings ads on any internte page I visit and they are always from different things. I ran ADWCleaner a few posts back but did it again as you told me too anyway and it found 2 search engines on chrome. MalwareBytes found OpenCandy and I removed it again. The malware stays even after cleaning those search engines. Here are the logs.

# AdwCleaner v4.207 - Logfile created 25/06/2015 at 17:45:30

# Updated 21/06/2015 by Xplode

# Database : 2015-06-23.1 [Server]

# Operating system : Windows 8.1 Pro (x64)

# Username : Adrian - DALLEGRAVE-PC

# Running from : C:\Users\Adrian\Downloads\AdwCleaner.exe

# Option : Cleaning

***** [ Services ] *****

***** [ Files / Folders ] *****

***** [ Scheduled tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.16384

-\\ Google Chrome v43.0.2357.130

[C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}

[C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}

*************************

AdwCleaner[R0].txt - [721 bytes] - [18/06/2015 11:44:28]

AdwCleaner[R1].txt - [1085 bytes] - [25/06/2015 17:44:34]

AdwCleaner[S0].txt - [1015 bytes] - [25/06/2015 17:45:30]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1074 bytes] ##########

#25
adriandallegrave

Posted 25 June 2015 - 03:12 PM

Member

Topic Starter
Member
29 posts

I forgot to put Malwarebytes log. Here it goes.

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 25/06/2015

Scan Time: 17:47:27

Logfile: mb.txt

Administrator: Yes

Version: 2.01.6.1022

Malware Database: v2015.03.09.05

Rootkit Database: v2015.02.25.01

License: Trial

Malware Protection: Enabled

Malicious Website Protection: Enabled

Self-protection: Disabled

OS: Windows 8.1

CPU: x64

File System: NTFS

User: Adrian

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 337962

Time Elapsed: 2 min, 47 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 0

(No malicious items detected)

Registry Values: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Folders: 0

(No malicious items detected)

Files: 2

PUP.Optional.OpenCandy, C:\Users\Adrian\AppData\Local\Temp\HYDE7D0.tmp.1435264785\HTA\install.1435264785.zip, Quarantined, [0574a79c6b1f47efac7d27e144c230d0],

PUP.Optional.OpenCandy, C:\Users\Adrian\AppData\Local\Temp\HYDE7D0.tmp.1435264785\HTA\3rdparty\OCSetupHlp.dll, Quarantined, [6613ae95791186b0082112f61bebee12],

Physical Sectors: 0

(No malicious items detected)

(end)

#26
adriandallegrave

Posted 25 June 2015 - 03:14 PM

Member

Topic Starter
Member
29 posts

I also deleted those two files Malwarebytes found.

#27
Biscuithd

Posted 01 July 2015 - 07:33 AM

Trusted Helper

Malware Removal
2,573 posts

Very sorry that I left you hanging! I've been in hospital for a bit. I'm on the mend now and assume you still need help.

If so, please run FRST and post a fresh log and lets see where we are.

#28
adriandallegrave

Posted 01 July 2015 - 11:29 AM

Member

Topic Starter
Member
29 posts

Thanks for coming back. I hope you're feeling better.

I installed many Windows updates. Here goes the logs:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:28-06-2015 01

Ran by Adrian (administrator) on DALLEGRAVE-PC on 01-07-2015 14:24:23

Running from C:\Users\Adrian\Desktop\frst

Loaded Profiles: Adrian (Available Profiles: Adrian)

Platform: Windows 8.1 Pro (X64) OS Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Intel Corporation) C:\Windows\System32\igfxEM.exe

(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe