hi, i am new in this forum but i saw that you resolved many times this problem.
I used the scan tool in FRST64.exe and attached are the FRST.txt and Addition.txt files.
Thanks in advance
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 05-02-2017
Ran by andre (administrator) on GAMING-PC (09-02-2017 19:53:47)
Running from C:\Users\andre\Downloads
Loaded Profiles: andre (Available Profiles: andre)
Platform: Windows 10 Pro Version 1607 (X64) Language: Italiano (Italia)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Windows\SysWOW64\ASGT.exe
(Foolish IT LLC) C:\Program Files (x86)\Foolish IT\CryptoPrevent\CryptoPreventMonSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Security Assist\isaHelperService.exe
() C:\Users\andre\AppData\Local\Kingosoft\Kingo Root\update_27205\bin\KingoSoftService.exe
(UASSOFT.COM) C:\Program Files (x86)\5-button mouse\KMWDSrv.exe
(IObit) C:\Program Files (x86)\IObit\IObit Uninstaller\IUService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
(Plex, Inc.) C:\Program Files (x86)\Plex\Plex Media Server\Plex Update Service.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(CyberGhost S.R.L) C:\Program Files\CyberGhost 5\Service.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
() C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_x64.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.105.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Microsoft Corporation) C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Logitech Inc.) C:\Program Files\Logitech\Gaming Software\LWEMon.exe
(Spotify Ltd) C:\Users\andre\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Disc Soft Ltd) C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe
(Microsoft Corporation) C:\Windows\System32\regsvr32.exe
(Microsoft Corporation) C:\Windows\SysWOW64\regsvr32.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Franz) C:\Users\andre\AppData\Local\Franz\app-4.0.4\Franz.exe
(Franz) C:\Users\andre\AppData\Local\Franz\app-4.0.4\Franz.exe
(Franz) C:\Users\andre\AppData\Local\Franz\app-4.0.4\Franz.exe
(Franz) C:\Users\andre\AppData\Local\Franz\app-4.0.4\Franz.exe
(Franz) C:\Users\andre\AppData\Local\Franz\app-4.0.4\Franz.exe
(Franz) C:\Users\andre\AppData\Local\Franz\app-4.0.4\Franz.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Plex, Inc.) C:\Program Files (x86)\Plex\Plex Media Server\Plex Media Server.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(UASSOFT.COM) C:\Program Files (x86)\5-button mouse\StartAutorun.exe
(UASSOFT.COM) C:\Program Files (x86)\5-button mouse\KMCONFIG.exe
(UASSOFT.COM) C:\Program Files (x86)\5-button mouse\KMProcess.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(CHENGDU Yiwo Tech Development Co., Ltd.) C:\Program Files (x86)\EaseUS\EaseUS Partition Master 11.0\bin\CleanUpUI.exe
(Python Software Foundation) C:\Program Files (x86)\Plex\Plex Media Server\PlexScriptHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Plex, Inc.) C:\Program Files (x86)\Plex\Plex Media Server\Plex DLNA Server.exe
(Python Software Foundation) C:\Program Files (x86)\Plex\Plex Media Server\PlexScriptHost.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office15\MSOSYNC.EXE
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
==================== Registry (Whitelisted) ====================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13885696 2015-06-24] (Realtek Semiconductor)
HKLM\...\Run: [Fences] => C:\Program Files (x86)\Stardock\Fences\Fences.exe [4031152 2013-11-26] (Stardock Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2397120 2016-06-14] (NVIDIA Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500936 2015-04-28] (Adobe Systems Incorporated)
HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [631808 2016-09-07] (Microsoft Corporation)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM\...\Run: [Start WingMan Profiler] => C:\Program Files\Logitech\Gaming Software\LWEMon.exe [190536 2010-06-14] (Logitech Inc.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [KMCONFIG] => "C:\Program Files (x86)\5-button mouse\StartAutorun.exe" KMConfig.exe
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-08-06] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [595504 2016-01-29] (Oracle Corporation)
HKLM-x32\...\Run: [EaseUS EPM tray] => C:\Program Files (x86)\EaseUS\EaseUS Partition Master 11.0\bin\EpmNews.exe
HKLM-x32\...\Run: [EaseUS Cleanup] => C:\Program Files (x86)\EaseUS\EaseUS Partition Master 11.0\bin\CleanUpUI.exe [1227456 2016-04-26] (CHENGDU Yiwo Tech Development Co., Ltd.)
HKLM-x32\...\Run: [EaseUS EPM Tray Agent] => C:\Program Files (x86)\EaseUS\EaseUS Partition Master 11.0\bin\TrayPopupE\TrayTipAgentE.exe [255072 2014-11-18] ()
HKLM Group Policy restriction on software: %userprofile%\AppData\*.paf <====== ATTENTION
HKU\S-1-5-21-145242487-1084527268-1276034731-1001\...\Run: [Spotify Web Helper] => C:\Users\andre\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1444976 2016-12-28] (Spotify Ltd)
HKU\S-1-5-21-145242487-1084527268-1276034731-1001\...\Run: [DAEMON Tools Lite Automount] => C:\Program Files\DAEMON Tools Lite\DTAgent.exe [4468056 2015-06-18] (Disc Soft Ltd)
HKU\S-1-5-21-145242487-1084527268-1276034731-1001\...\Run: [Uqcrmedia] => regsvr32.exe C:\Users\andre\AppData\Local\Uqcrmedia\MSMDll.dll <===== ATTENTION
HKU\S-1-5-21-145242487-1084527268-1276034731-1001\...\Run: [Enzftion] => C:\Windows\SysWOW64\regsvr32.exe C:\Users\andre\AppData\Local\Ivdpsoft\MSMDll.dll
HKU\S-1-5-21-145242487-1084527268-1276034731-1001\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [23818360 2016-11-30] (Google)
HKU\S-1-5-21-145242487-1084527268-1276034731-1001\...\Run: [Franz] => C:\Users\andre\AppData\Local\Franz\app-4.0.4\Franz.exe [86039832 2016-09-06] (Franz)
HKU\S-1-5-21-145242487-1084527268-1276034731-1001\...\Run: [Plex Media Server] => C:\Program Files (x86)\Plex\Plex Media Server\Plex Media Server.exe [13082608 2016-12-15] (Plex, Inc.)
HKU\S-1-5-21-145242487-1084527268-1276034731-1001\...\MountPoints2: {fba3afbe-8ae8-11e5-8790-8cdcd4202568} - "G:\O16Setup.EXE"
ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-11-30] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-11-30] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-11-30] (Google)
Startup: C:\Users\andre\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Fences.lnk [2016-02-05]
ShortcutTarget: Fences.lnk -> C:\Program Files (x86)\Stardock\Fences\Fences.exe (Stardock Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{2bc6c0a7-560f-448f-9c91-fa1eeeb87b3a}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{8ccbc468-4962-4271-af6b-16a83e99f592}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{99d3c195-cb38-4c48-b570-baf96f7c799e}: [NameServer] 138.201.86.45,8.8.8.8
ManualProxies:
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131176271532003900&GUID=1DEEE4D6-7A6F-4278-BF87-7F5F81A6E388
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\S-1-5-21-145242487-1084527268-1276034731-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/it-it/?ocid=iehp
SearchScopes: HKU\S-1-5-21-145242487-1084527268-1276034731-1001 -> {6F7E0B5D-E3D8-48B5-9965-4991D0CBE0BA} URL = hxxps://it.search.yahoo.com/search?p={searchTerms}&fr=yset_ie_syc_oracle&type=orcl_default
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer.dll [2016-05-23] (IObit)
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2012-10-01] (Microsoft Corporation)
BHO: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_73\bin\ssv.dll [2016-02-13] (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2012-10-01] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2012-10-01] (Microsoft Corporation)
BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_73\bin\jp2ssv.dll [2016-02-13] (Oracle Corporation)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2012-10-01] (Microsoft Corporation)
BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\ssv.dll [2015-11-27] (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2012-10-01] (Microsoft Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office16\GROOVEEX.DLL [2015-07-31] (Microsoft Corporation)
BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\jp2ssv.dll [2015-11-27] (Oracle Corporation)
Handler: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files\Microsoft Office\Office16\MSOSB.DLL [2015-07-31] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2015-07-31] (Microsoft Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2012-10-01] (Microsoft Corporation)
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\Office16\MSOSB.DLL [2015-07-31] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2015-07-31] (Microsoft Corporation)
Edge:
======
Edge HomeButtonPage: HKU\S-1-5-21-145242487-1084527268-1276034731-1001 -> hxxp://www.google.com
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll [2015-11-21] ()
FF Plugin: @java.com/DTPlugin,version=11.73.2 -> C:\Program Files\Java\jre1.8.0_73\bin\dtplugin\npDeployJava1.dll [2016-02-13] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.73.2 -> C:\Program Files\Java\jre1.8.0_73\bin\plugin2\npjp2.dll [2016-02-13] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2015-03-09] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll [2015-11-21] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.68 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2015-08-24] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2015-08-24] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\dtplugin\npDeployJava1.dll [2015-11-27] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\plugin2\npjp2.dll [2015-11-27] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2016-12-29] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2016-12-29] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-18] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-18] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-12-23] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2015-03-09] (Adobe Systems)
FF Plugin HKU\S-1-5-21-145242487-1084527268-1276034731-1001: SkypePlugin -> C:\Users\andre\AppData\Local\SkypePlugin\7.29.0.73\npGatewayNpapi.dll [2016-12-08] (Skype Technologies S.A.)
FF Plugin HKU\S-1-5-21-145242487-1084527268-1276034731-1001: SkypePlugin64 -> C:\Users\andre\AppData\Local\SkypePlugin\7.29.0.73\npGatewayNpapi-x64.dll [2016-12-08] (Skype Technologies S.A.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2012-10-01] (Microsoft Corporation)
Chrome:
=======
CHR DefaultProfile: perpckplewerpydolerck
CHR HomePage: perpckplewerpydolerck -> hxxp://%66%65%65%64.%73%6E%61%70%64%6F.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBUTxkij9_Bx1m16h7dcAwTiLfY1lmlart3J00IjvDqbPdRysFowqyNVU2hI0Fv2nZDkhKZgmwZ9jOPiUN7yqPgyxVzHFr5Y59fplSv26XMz5zRNKEufUspskZjYsILn4V6nOJ5JQVSW3wwWJB58Xv1iLxta55NC5Xv2xbK
CHR StartupUrls: perpckplewerpydolerck -> "hxxps://www.google.it/","hxxp://www.trotux.com/?z=210d660c49348d3a601c95cgaz2m4oaqcm6w7b1c5t&from=icb&uid=TS256GSSD370S_C219181460&type=hp"
CHR Profile: C:\Users\andre\AppData\Local\Google\Chrome\User Data\perpckplewerpydolerck [2017-02-09] <==== ATTENTION
CHR Extension: (Adblock Plus) - C:\Users\andre\AppData\Local\Google\Chrome\User Data\perpckplewerpydolerck\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-10-27]
CHR Extension: (Pushbullet) - C:\Users\andre\AppData\Local\Google\Chrome\User Data\perpckplewerpydolerck\Extensions\chlffgpmiacpedhhbkiomidkjlcfhogd [2016-10-28]
CHR Extension: (JP Performance - BMW M4 (unoffical)) - C:\Users\andre\AppData\Local\Google\Chrome\User Data\perpckplewerpydolerck\Extensions\denclkkkinblmabbbedcablldldmjlle [2017-01-05]
CHR Extension: (Inbox by Gmail) - C:\Users\andre\AppData\Local\Google\Chrome\User Data\perpckplewerpydolerck\Extensions\gkljgfmjocfalijkgoogmfffkhmkbgol [2016-10-13]
CHR Extension: (AllCast Receiver) - C:\Users\andre\AppData\Local\Google\Chrome\User Data\perpckplewerpydolerck\Extensions\hjbljnpdahefgnopeohlaeohgkiidnoe [2017-01-08]
CHR Extension: ((1) WhatsApp Web) - C:\Users\andre\AppData\Local\Google\Chrome\User Data\perpckplewerpydolerck\Extensions\hnpfjngllnobngcgfapefoaidbinmjnm [2016-09-01]
CHR Extension: (Coupons at Checkout) - C:\Users\andre\AppData\Local\Google\Chrome\User Data\perpckplewerpydolerck\Extensions\kegphgaihkjoophpabchkmpaknehfamb [2016-11-14]
CHR Extension: (Estensione Google Keep per Chrome) - C:\Users\andre\AppData\Local\Google\Chrome\User Data\perpckplewerpydolerck\Extensions\lpcaedmchfhocbbapmcbpinfpgnhiddi [2016-09-12]
CHR Extension: (Pagamenti Chrome Web Store) - C:\Users\andre\AppData\Local\Google\Chrome\User Data\perpckplewerpydolerck\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-01-19]
CHR Extension: (Mopify) - C:\Users\andre\AppData\Local\Google\Chrome\User Data\perpckplewerpydolerck\Extensions\opachcjmboaadmggggggeegnaajchbod [2016-12-01]
CHR Extension: (Gmail) - C:\Users\andre\AppData\Local\Google\Chrome\User Data\perpckplewerpydolerck\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-09-01]
CHR Extension: (Chrome Media Router) - C:\Users\andre\AppData\Local\Google\Chrome\User Data\perpckplewerpydolerck\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-02-08]
CHR HKU\S-1-5-21-145242487-1084527268-1276034731-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [bollcafdnolnlnooclcfehjgcbbpabao] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-145242487-1084527268-1276034731-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [gjndibjblceakamilagmcappediilefl] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 ASGT; C:\Windows\syswow64\ASGT.exe [55296 2012-01-16] () [File not signed]
R2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [65128 2016-01-11] (CyberGhost S.R.L)
R3 CryptoPreventEmail; C:\Program Files (x86)\Foolish IT\CryptoPrevent\CryptoPreventMonSvc.exe [615408 2017-02-09] (Foolish IT LLC)
R3 CryptoPreventFolderWatch; C:\Program Files (x86)\Foolish IT\CryptoPrevent\CryptoPreventMonSvc.exe [615408 2017-02-09] (Foolish IT LLC)
R2 CryptoPreventMonSvc; C:\Program Files (x86)\Foolish IT\CryptoPrevent\CryptoPreventMonSvc.exe [615408 2017-02-09] (Foolish IT LLC)
R3 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe [1268568 2015-06-18] (Disc Soft Ltd)
S2 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [107520 2016-10-17] (Freemake) [File not signed]
S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [976848 2016-01-14] (Intel® Corporation)
S3 Intel® Security Assist; C:\Program Files (x86)\Intel\Intel® Security Assist\isa.exe [335872 2016-02-05] (Intel Corporation) [File not signed]
R2 IObitUnSvr; C:\Program Files (x86)\IObit\IObit Uninstaller\IUService.exe [360736 2016-10-28] (IObit)
R2 isaHelperSvc; C:\Program Files (x86)\Intel\Intel® Security Assist\isaHelperService.exe [8704 2016-02-05] (Intel Corporation) [File not signed]
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [209184 2016-02-11] (Intel Corporation)
R2 KingoSoftService; C:\Users\andre\AppData\Local\Kingosoft\Kingo Root\update_27205\bin\checkupdate.exe [367584 2017-01-15] ()
R2 KMWDSERVICE; C:\Program Files (x86)\5-button mouse\KMWDSrv.exe [201216 2009-10-08] (UASSOFT.COM) [File not signed]
R2 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [458176 2016-12-29] (NVIDIA Corporation)
R3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [3632576 2016-06-14] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [2521024 2016-06-14] (NVIDIA Corporation)
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [166912 2013-10-17] () [File not signed]
R2 PlexUpdateService; C:\Program Files (x86)\Plex\Plex Media Server\Plex Update Service.exe [1919472 2016-12-15] (Plex, Inc.)
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [117264 2010-06-25] (CACE Technologies, Inc.)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [303360 2015-06-24] (Realtek Semiconductor)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2889896 2016-09-15] (Microsoft Corporation)
R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [754784 2016-01-08] (DEVGURU Co., LTD.)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5702416 2015-09-11] (TeamViewer GmbH)
S3 VSStandardCollectorService140; C:\Program Files (x86)\Microsoft Visual Studio 14.0\Team Tools\DiagnosticsHub\Collector\StandardCollector.Service.exe [52968 2015-07-07] (Microsoft Corporation)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.)
R3 dtlitescsibus; C:\WINDOWS\System32\drivers\dtlitescsibus.sys [30264 2015-07-09] (Disc Soft Ltd)
S3 epmntdrv; C:\WINDOWS\system32\epmntdrv.sys [18016 2016-01-20] ()
S3 epmntdrv; C:\WINDOWS\SysWOW64\epmntdrv.sys [15968 2016-01-20] ()
S3 EuGdiDrv; C:\WINDOWS\system32\EuGdiDrv.sys [10848 2016-01-20] ()
S3 EuGdiDrv; C:\WINDOWS\SysWOW64\EuGdiDrv.sys [10208 2016-01-20] ()
S3 HtcVCom32; C:\WINDOWS\system32\DRIVERS\HtcVComV64.sys [121800 2010-03-09] (QUALCOMM Incorporated)
S3 i8042HDR; C:\WINDOWS\system32\DRIVERS\i8042HDR.sys [15920 2009-08-14] (Windows ® Codename Longhorn DDK provider)
S3 iaStorB; C:\WINDOWS\System32\drivers\iaStorB.sys [582128 2014-06-13] (Intel Corporation)
R0 iaStorS; C:\WINDOWS\System32\drivers\iaStorS.sys [653296 2014-06-13] (Intel Corporation)
R2 IntelHaxm; C:\WINDOWS\system32\DRIVERS\IntelHaxm.sys [96776 2015-11-16] (Intel Corporation)
S3 LGJoyXlCore; C:\WINDOWS\system32\drivers\LGJoyXlCore.sys [85160 2016-04-19] (Logitech Inc.)
R2 memudrv; C:\Program Files\Microvirt\MEmuHyperv\MEmuDrv.sys [260328 2016-01-16] (Microvirt Corporation)
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
R3 netr28ux; C:\WINDOWS\System32\drivers\netr28ux.sys [2224128 2016-07-16] (MediaTek Inc.)
R2 NPF; C:\WINDOWS\System32\drivers\npf.sys [35344 2010-06-25] (CACE Technologies, Inc.)
R3 nvlddmkm; C:\WINDOWS\System32\DriverStore\FileRepository\nv_dispiwu.inf_amd64_b67dc924fff8de6d\nvlddmkm.sys [14199224 2017-01-04] (NVIDIA Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [26560 2016-06-14] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\WINDOWS\system32\drivers\nvvad64v.sys [56384 2016-04-14] (NVIDIA Corporation)
R3 RTCore64; C:\Program Files (x86)\MSI Afterburner\RTCore64.sys [13512 2016-05-30] ()
R3 SensorsSimulatorDriver; C:\WINDOWS\System32\drivers\WUDFRd.sys [216064 2016-07-16] (Microsoft Corporation)
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [165504 2016-09-05] (Samsung Electronics Co., Ltd.)
R3 tilfilter; C:\WINDOWS\System32\drivers\TIxHCIlfilter.sys [34424 2016-08-19] (Texas Instruments, Inc.)
R3 tiufilter; C:\WINDOWS\System32\drivers\TIxHCIufilter.sys [39032 2016-08-19] (Texas Instruments, Inc.)
S1 VBoxNetAdp; C:\WINDOWS\system32\DRIVERS\VBoxNetAdp6.sys [132120 2016-10-18] (Oracle Corporation)
S3 VBoxUSB; C:\WINDOWS\System32\Drivers\VBoxUSB.sys [125008 2015-07-09] (Oracle Corporation)
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
S3 wdm_usb; C:\WINDOWS\system32\DRIVERS\usb2ser.sys [159936 2016-08-16] (MBB)
R3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-02-09 19:53 - 2017-02-09 19:54 - 00336862 _____ C:\Users\andre\Downloads\FRST.txt
2017-02-09 19:53 - 2017-02-09 19:53 - 00000000 ____D C:\FRST
2017-02-09 19:50 - 2017-02-09 19:50 - 02421248 _____ (Farbar) C:\Users\andre\Downloads\FRST64.exe
2017-02-09 19:49 - 2017-02-09 19:49 - 04015056 _____ C:\Users\andre\Desktop\adwcleaner_6.043.exe
2017-02-09 19:43 - 2017-02-09 19:43 - 00003126 _____ C:\Users\andre\Downloads\fixlist.txt
2017-02-09 19:43 - 2017-02-09 19:43 - 00000000 ____D C:\CryptoPreventQuarantine
2017-02-09 19:42 - 2017-02-09 19:42 - 00053248 _____ C:\WINDOWS\SysWOW64\zlib.dll
2017-02-09 19:42 - 2017-02-09 19:42 - 00001285 _____ C:\Users\Public\Desktop\CryptoPrevent.lnk
2017-02-09 19:42 - 2017-02-09 19:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CryptoPrevent
2017-02-09 19:42 - 2017-02-09 19:42 - 00000000 ____D C:\ProgramData\Foolish IT
2017-02-09 19:42 - 2017-02-09 19:42 - 00000000 ____D C:\Program Files (x86)\Foolish IT
2017-02-09 19:40 - 2017-02-09 19:41 - 10611818 _____ C:\Users\andre\Downloads\CryptoPreventSetupV8.zip
2017-02-09 19:33 - 2017-02-09 19:33 - 00000000 ____D C:\WINDOWS\Panther
2017-02-09 17:10 - 2017-02-09 17:31 - 00000000 ____D C:\Users\andre\AppData\Roaming\npm-cache
2017-02-09 16:42 - 2017-02-09 18:52 - 00000000 ____D C:\Users\andre\Desktop\es
2017-02-09 16:29 - 2017-02-09 16:30 - 07837333 _____ C:\Users\andre\Downloads\GiraudoLoris-04.02.2017.rar
2017-02-08 17:40 - 2017-02-08 17:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2017-02-08 17:39 - 2017-02-08 17:40 - 00000000 ____D C:\WINDOWS\LastGood.Tmp
2017-02-08 17:39 - 2017-02-08 17:39 - 00000000 ____D C:\Program Files (x86)\VulkanRT
2017-02-08 17:39 - 2016-12-29 14:06 - 00001951 _____ C:\WINDOWS\NvContainerRecovery.bat
2017-02-08 17:39 - 2016-12-29 13:43 - 00133056 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvStreaming.exe
2017-02-08 17:39 - 2016-09-09 19:25 - 00269600 _____ C:\WINDOWS\SysWOW64\vulkan-1.dll
2017-02-08 17:39 - 2016-09-09 19:25 - 00261920 _____ C:\WINDOWS\system32\vulkan-1.dll
2017-02-08 17:39 - 2016-09-09 19:25 - 00110880 _____ C:\WINDOWS\SysWOW64\vulkaninfo.exe
2017-02-08 17:39 - 2016-09-09 19:24 - 00125216 _____ C:\WINDOWS\system32\vulkaninfo.exe
2017-01-26 18:56 - 2016-12-21 08:08 - 00142848 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2017-01-26 18:56 - 2016-12-21 05:44 - 00120320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2017-01-20 19:40 - 2017-01-20 19:40 - 00000016 _____ C:\Users\andre\.emulator_console_auth_token
2017-01-20 19:16 - 2017-01-20 19:16 - 03371578 _____ C:\Users\andre\Downloads\esVerifica.rar
2017-01-20 19:02 - 2017-01-20 19:02 - 00000000 ____D C:\Users\andre\.cordova
2017-01-20 19:02 - 2017-01-20 19:02 - 00000000 ____D C:\Users\andre\.config
2017-01-20 18:48 - 2017-01-20 19:02 - 00000000 ____D C:\Users\andre\Desktop\test
2017-01-20 18:47 - 2017-01-20 18:47 - 00000138 _____ C:\Users\andre\.bash_history
2017-01-20 18:39 - 2017-01-20 18:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Git
2017-01-20 18:39 - 2017-01-20 18:39 - 00000000 ____D C:\ProgramData\Git
2017-01-20 18:38 - 2017-01-20 18:39 - 00000000 ____D C:\Program Files\Git
2017-01-20 18:28 - 2017-01-20 18:30 - 34195664 _____ (The Git Development Community ) C:\Users\andre\Downloads\Git-2.11.0.3-64-bit.exe
2017-01-19 21:37 - 2017-01-19 21:37 - 00000000 ____D C:\Users\andre\AppData\Roaming\Shuame
2017-01-19 21:36 - 2017-01-19 21:37 - 07453104 _____ C:\Users\andre\Downloads\RootGenius_en_2.2.6.exe
2017-01-19 21:30 - 2017-01-19 21:30 - 04680936 _____ (北京奇虎科技有限公司) C:\Users\andre\Downloads\360RootSetup.exe
2017-01-17 16:40 - 2017-01-17 16:40 - 00000000 ___HD C:\$Windows.~WS
2017-01-17 16:40 - 2017-01-17 16:40 - 00000000 ____D C:\$WINDOWS.~BT
2017-01-17 16:39 - 2017-01-17 16:40 - 18309328 _____ (Microsoft Corporation) C:\Users\andre\Downloads\MediaCreationTool (2).exe
2017-01-17 16:38 - 2017-01-17 16:39 - 00000000 ____D C:\Users\andre\Desktop\office
2017-01-15 18:08 - 2017-01-15 18:08 - 00000000 ____D C:\Users\andre\Desktop\mi box root
2017-01-15 17:31 - 2017-01-15 17:31 - 01143831 _____ C:\Users\andre\Downloads\WiFi ADB - Debug Over Air_1.49_apk-dl.com.apk
2017-01-15 17:30 - 2017-01-15 17:30 - 03500155 _____ C:\Users\andre\Downloads\AndroidPC.es_MINIX_NEO_U1_root_v01_Daemonium.zip
2017-01-15 15:09 - 2017-01-15 15:09 - 00147290 _____ C:\Users\andre\Downloads\EsercizioNAT (1).pkt
2017-01-15 14:46 - 2017-01-15 14:46 - 00149484 _____ C:\Users\andre\Downloads\es_simile_ver_Nat.pkt
2017-01-15 14:46 - 2017-01-15 14:46 - 00148538 _____ C:\Users\andre\Downloads\preparazioneVerificaNat.pkt
2017-01-15 14:38 - 2017-01-15 15:09 - 00175898 _____ C:\Users\andre\Downloads\EsercizioNAT.pkt
2017-01-15 12:58 - 2017-01-15 13:08 - 389713940 _____ C:\Users\andre\Downloads\MiBOX3_jurassicpark_gitv_1.3.106.386.zip
2017-01-15 12:24 - 2017-01-15 17:49 - 00000163 _____ C:\Users\andre\AppData\Local\uts.ini
2017-01-15 12:24 - 2017-01-15 12:24 - 00000000 ____D C:\Users\andre\AppData\Roaming\Kingosoft
2017-01-15 12:24 - 2017-01-15 12:24 - 00000000 ____D C:\Users\andre\AppData\Local\uts
2017-01-15 12:21 - 2017-01-15 12:21 - 00000000 ____D C:\Users\andre\AppData\Roaming\KingRoot
2017-01-15 12:20 - 2017-01-15 12:33 - 00000000 ____D C:\Program Files (x86)\KingRoot
2017-01-15 12:20 - 2017-01-15 12:21 - 00000000 ____D C:\Users\andre\AppData\Roaming\Tencent
2017-01-15 12:20 - 2017-01-15 12:20 - 31021016 _____ (KingRoot ) C:\Users\andre\Downloads\KingRoot_pc.exe
2017-01-15 12:20 - 2017-01-15 12:20 - 00001076 _____ C:\Users\Public\Desktop\KingRoot.lnk
2017-01-15 12:20 - 2017-01-15 12:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KingRoot
2017-01-14 23:13 - 2017-01-14 23:13 - 24834917 _____ C:\Users\andre\Downloads\AppuntiStoria-20170114T221320Z.zip
2017-01-13 23:13 - 2017-01-13 23:14 - 12681147 _____ C:\Users\andre\Downloads\per cascio-20170113T221329Z.zip
2017-01-13 18:51 - 2017-01-13 18:52 - 08753213 _____ C:\Users\andre\Downloads\web.rar
2017-01-13 18:18 - 2017-01-13 18:18 - 24779689 _____ C:\Users\andre\Downloads\drive-download-20170113T171821Z.zip
2017-01-12 18:18 - 2017-01-12 18:18 - 02916700 _____ C:\Users\andre\Downloads\cetusplay-on-android-tvbox-2-0-1-en-apkplz.com.apk
2017-01-10 22:24 - 2016-12-21 09:08 - 00245600 _____ (Microsoft Corporation) C:\WINDOWS\system32\offlinesam.dll
2017-01-10 22:24 - 2016-12-21 09:08 - 00136032 _____ (Microsoft Corporation) C:\WINDOWS\system32\ImplatSetup.dll
2017-01-10 22:24 - 2016-12-21 09:04 - 07816032 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2017-01-10 22:24 - 2016-12-21 08:49 - 00328008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll
2017-01-10 22:24 - 2016-12-21 08:46 - 00624048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2017-01-10 22:24 - 2016-12-21 08:43 - 04130440 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2017-01-10 22:24 - 2016-12-21 08:43 - 01454504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetsrc.dll
2017-01-10 22:24 - 2016-12-21 08:43 - 01071736 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetcore.dll
2017-01-10 22:24 - 2016-12-21 08:43 - 00092512 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2017-01-10 22:24 - 2016-12-21 08:42 - 22224480 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2017-01-10 22:24 - 2016-12-21 08:42 - 01988560 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2017-01-10 22:24 - 2016-12-21 08:42 - 01702392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll
2017-01-10 22:24 - 2016-12-21 08:42 - 01300600 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll
2017-01-10 22:24 - 2016-12-21 08:41 - 01600632 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2017-01-10 22:24 - 2016-12-21 08:37 - 00455520 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe
2017-01-10 22:24 - 2016-12-21 08:15 - 22563840 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2017-01-10 22:24 - 2016-12-21 08:14 - 00043008 _____ (Microsoft Corporation) C:\WINDOWS\system32\LaunchWinApp.exe
2017-01-10 22:24 - 2016-12-21 08:09 - 00368640 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneBackupHandler.dll
2017-01-10 22:24 - 2016-12-21 08:09 - 00363520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BioFeedback.dll
2017-01-10 22:24 - 2016-12-21 08:08 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BlockedShutdown.dll
2017-01-10 22:24 - 2016-12-21 08:08 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpencom.dll
2017-01-10 22:24 - 2016-12-21 08:08 - 00289792 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeveloperOptionsSettingsHandlers.dll
2017-01-10 22:24 - 2016-12-21 08:08 - 00211968 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe
2017-01-10 22:24 - 2016-12-21 08:07 - 00748544 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll
2017-01-10 22:24 - 2016-12-21 08:06 - 06285312 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2017-01-10 22:24 - 2016-12-21 08:06 - 00310784 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncSettings.dll
2017-01-10 22:24 - 2016-12-21 08:06 - 00260608 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgentUserBroker.exe
2017-01-10 22:24 - 2016-12-21 08:06 - 00147456 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsrv.dll
2017-01-10 22:24 - 2016-12-21 08:05 - 00425984 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadcloudap.dll
2017-01-10 22:24 - 2016-12-21 08:05 - 00261632 _____ (Microsoft Corporation) C:\WINDOWS\system32\indexeddbserver.dll
2017-01-10 22:24 - 2016-12-21 08:05 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll
2017-01-10 22:24 - 2016-12-21 08:01 - 09131008 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2017-01-10 22:24 - 2016-12-21 08:00 - 00440320 _____ (Microsoft Corporation) C:\WINDOWS\system32\fhcfg.dll
2017-01-10 22:24 - 2016-12-21 07:59 - 01908224 _____ (Microsoft Corporation) C:\WINDOWS\system32\AzureSettingSyncProvider.dll
2017-01-10 22:24 - 2016-12-21 07:59 - 00883712 _____ (Microsoft Corporation) C:\WINDOWS\system32\samsrv.dll
2017-01-10 22:24 - 2016-12-21 07:58 - 23678464 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2017-01-10 22:24 - 2016-12-21 07:57 - 00462336 _____ (Microsoft Corporation) C:\WINDOWS\system32\fhsettingsprovider.dll
2017-01-10 22:24 - 2016-12-21 07:56 - 00947712 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVP9DEC.dll
2017-01-10 22:24 - 2016-12-21 07:56 - 00936960 _____ (Microsoft Corporation) C:\WINDOWS\system32\MCRecvSrc.dll
2017-01-10 22:24 - 2016-12-21 07:55 - 08129536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2017-01-10 22:24 - 2016-12-21 07:55 - 04749312 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2017-01-10 22:24 - 2016-12-21 07:54 - 05511680 _____ (Microsoft Corporation) C:\WINDOWS\system32\aclui.dll
2017-01-10 22:24 - 2016-12-21 07:53 - 06664192 _____ (Microsoft Corporation) C:\WINDOWS\system32\mspaint.exe
2017-01-10 22:24 - 2016-12-21 07:53 - 04474368 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll
2017-01-10 22:24 - 2016-12-21 07:51 - 08075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2017-01-10 22:24 - 2016-12-21 07:51 - 05611008 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1.dll
2017-01-10 22:24 - 2016-12-21 07:50 - 01490432 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2017-01-10 22:24 - 2016-12-21 07:49 - 04149248 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2017-01-10 22:24 - 2016-12-21 07:49 - 02691072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll
2017-01-10 22:24 - 2016-12-21 07:49 - 01062912 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
2017-01-10 22:24 - 2016-12-21 07:47 - 01121280 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadtb.dll
2017-01-10 22:24 - 2016-12-21 06:59 - 00218976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\offlinesam.dll
2017-01-10 22:24 - 2016-12-21 06:09 - 00263472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll
2017-01-10 22:24 - 2016-12-21 06:02 - 03892864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2017-01-10 22:24 - 2016-12-21 06:02 - 01852720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2017-01-10 22:24 - 2016-12-21 06:02 - 01360464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetsrc.dll
2017-01-10 22:24 - 2016-12-21 06:02 - 01277344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll
2017-01-10 22:24 - 2016-12-21 06:02 - 01201872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll
2017-01-10 22:24 - 2016-12-21 06:02 - 00980832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetcore.dll
2017-01-10 22:24 - 2016-12-21 06:01 - 20969928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2017-01-10 22:24 - 2016-12-21 05:46 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LaunchWinApp.exe
2017-01-10 22:24 - 2016-12-21 05:43 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BlockedShutdown.dll
2017-01-10 22:24 - 2016-12-21 05:41 - 00253952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BioFeedback.dll
2017-01-10 22:24 - 2016-12-21 05:41 - 00231936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll
2017-01-10 22:24 - 2016-12-21 05:40 - 00557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StoreAgent.dll
2017-01-10 22:24 - 2016-12-21 05:40 - 00318976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpencom.dll
2017-01-10 22:24 - 2016-12-21 05:40 - 00237056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SyncSettings.dll
2017-01-10 22:24 - 2016-12-21 05:40 - 00180224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe
2017-01-10 22:24 - 2016-12-21 05:39 - 01300480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVPXENC.dll
2017-01-10 22:24 - 2016-12-21 05:39 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgentUserBroker.exe
2017-01-10 22:24 - 2016-12-21 05:38 - 00866816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Cred.dll
2017-01-10 22:24 - 2016-12-21 05:35 - 04612608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2017-01-10 22:24 - 2016-12-21 05:35 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\indexeddbserver.dll
2017-01-10 22:24 - 2016-12-21 05:34 - 07626752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2017-01-10 22:24 - 2016-12-21 05:33 - 19413504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2017-01-10 22:24 - 2016-12-21 05:32 - 19417600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2017-01-10 22:24 - 2016-12-21 05:30 - 05398016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aclui.dll
2017-01-10 22:24 - 2016-12-21 05:30 - 01255936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AzureSettingSyncProvider.dll
2017-01-10 22:24 - 2016-12-21 05:27 - 00640000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MCRecvSrc.dll
2017-01-10 22:24 - 2016-12-21 05:26 - 01155072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVP9DEC.dll
2017-01-10 22:24 - 2016-12-21 05:25 - 07469056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2017-01-10 22:24 - 2016-12-21 05:25 - 06474752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mspaint.exe
2017-01-10 22:24 - 2016-12-21 05:24 - 06044160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2017-01-10 22:24 - 2016-12-21 05:22 - 01883648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll
2017-01-10 22:24 - 2016-12-14 06:41 - 01235296 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2017-01-10 22:24 - 2016-12-14 06:41 - 00590960 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2017-01-10 22:24 - 2016-12-14 06:34 - 02482280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll
2017-01-10 22:24 - 2016-12-14 06:33 - 02169184 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystems64.dll
2017-01-10 22:24 - 2016-12-14 06:33 - 01669984 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVIntegration.dll
2017-01-10 22:24 - 2016-12-14 06:33 - 01400160 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystemController.dll
2017-01-10 22:24 - 2016-12-14 06:33 - 01356864 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipUp.exe
2017-01-10 22:24 - 2016-12-14 06:33 - 01054048 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVPolicy.dll
2017-01-10 22:24 - 2016-12-14 06:33 - 00992096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVManifest.dll
2017-01-10 22:24 - 2016-12-14 06:33 - 00822624 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVClient.exe
2017-01-10 22:24 - 2016-12-14 06:33 - 00813408 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntStreamingManager.dll
2017-01-10 22:24 - 2016-12-14 06:33 - 00779616 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVReporting.dll
2017-01-10 22:24 - 2016-12-14 06:33 - 00752992 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVOrchestration.dll
2017-01-10 22:24 - 2016-12-14 06:33 - 00704352 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntVirtualization.dll
2017-01-10 22:24 - 2016-12-14 06:33 - 00696160 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVPublishing.dll
2017-01-10 22:24 - 2016-12-14 06:33 - 00571744 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVCatalog.dll
2017-01-10 22:24 - 2016-12-14 06:33 - 00513376 _____ (Microsoft Corporation) C:\WINDOWS\system32\TransportDSA.dll
2017-01-10 22:24 - 2016-12-14 06:33 - 00406368 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVScripting.dll
2017-01-10 22:24 - 2016-12-14 06:33 - 00241504 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVShNotify.exe
2017-01-10 22:24 - 2016-12-14 06:33 - 00190816 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVDllSurrogate.exe
2017-01-10 22:24 - 2016-12-14 06:23 - 00404832 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2017-01-10 22:24 - 2016-12-14 06:21 - 02206496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2vdec.dll
2017-01-10 22:24 - 2016-12-14 06:19 - 00584544 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2017-01-10 22:24 - 2016-12-14 06:18 - 00715104 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2017-01-10 22:24 - 2016-12-14 06:18 - 00335712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys
2017-01-10 22:24 - 2016-12-14 06:17 - 00319288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll
2017-01-10 22:24 - 2016-12-14 06:14 - 01694712 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmde.dll
2017-01-10 22:24 - 2016-12-14 06:14 - 00418952 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2017-01-10 22:24 - 2016-12-14 06:14 - 00089416 _____ (Microsoft Corporation) C:\WINDOWS\system32\remoteaudioendpoint.dll
2017-01-10 22:24 - 2016-12-14 06:01 - 01557808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll
2017-01-10 22:24 - 2016-12-14 06:01 - 00382784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2017-01-10 22:24 - 2016-12-14 06:01 - 00076984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\remoteaudioendpoint.dll
2017-01-10 22:24 - 2016-12-14 05:48 - 01631232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll
2017-01-10 22:24 - 2016-12-14 05:46 - 01631232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Resources.dll
2017-01-10 22:24 - 2016-12-14 05:46 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2017-01-10 22:24 - 2016-12-14 05:43 - 00201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\ScDeviceEnum.dll
2017-01-10 22:24 - 2016-12-14 05:42 - 00352768 _____ (Microsoft Corporation) C:\WINDOWS\system32\cloudAP.dll
2017-01-10 22:24 - 2016-12-14 05:42 - 00236544 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSCard.dll
2017-01-10 22:24 - 2016-12-14 05:42 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.UI.Logon.ProxyStub.dll
2017-01-10 22:24 - 2016-12-14 05:42 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinSCard.dll
2017-01-10 22:24 - 2016-12-14 05:41 - 00223744 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2017-01-10 22:24 - 2016-12-14 05:40 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\system32\domgmt.dll
2017-01-10 22:24 - 2016-12-14 05:40 - 00231424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudBackupSettings.dll
2017-01-10 22:24 - 2016-12-14 05:40 - 00193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\certprop.dll
2017-01-10 22:24 - 2016-12-14 05:39 - 00837632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wbiosrvc.dll
2017-01-10 22:24 - 2016-12-14 05:39 - 00290816 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll
2017-01-10 22:24 - 2016-12-14 05:39 - 00257024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.CredDialogController.dll
2017-01-10 22:24 - 2016-12-14 05:38 - 17188864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2017-01-10 22:24 - 2016-12-14 05:38 - 13869056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2017-01-10 22:24 - 2016-12-14 05:38 - 00295424 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudBackupSettings.dll
2017-01-10 22:24 - 2016-12-14 05:38 - 00213504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.CredDialogController.dll
2017-01-10 22:24 - 2016-12-14 05:37 - 00090112 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatepolicy.dll
2017-01-10 22:24 - 2016-12-14 05:36 - 01002496 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll
2017-01-10 22:24 - 2016-12-14 05:36 - 00539648 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll
2017-01-10 22:24 - 2016-12-14 05:36 - 00074752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\updatepolicy.dll
2017-01-10 22:24 - 2016-12-14 05:35 - 00755712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2017-01-10 22:24 - 2016-12-14 05:35 - 00712192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2017-01-10 22:24 - 2016-12-14 05:35 - 00600576 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptui.dll
2017-01-10 22:24 - 2016-12-14 05:35 - 00553984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptui.dll
2017-01-10 22:24 - 2016-12-14 05:32 - 00497152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LogonController.dll
2017-01-10 22:24 - 2016-12-14 05:26 - 00932864 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2017-01-10 22:24 - 2016-12-14 05:26 - 00869888 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2017-01-10 22:24 - 2016-12-14 05:25 - 02009600 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRHInproc.dll
2017-01-10 22:24 - 2016-12-14 05:24 - 01005568 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3D12.dll
2017-01-10 22:24 - 2016-12-14 05:24 - 00673792 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2017-01-10 22:24 - 2016-12-14 05:23 - 03134976 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll
2017-01-10 22:24 - 2016-12-14 05:23 - 01231872 _____ (Microsoft Corporation) C:\WINDOWS\system32\dosvc.dll
2017-01-10 22:24 - 2016-12-14 05:22 - 02748416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll
2017-01-10 22:24 - 2016-12-14 05:22 - 02317824 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2017-01-10 22:24 - 2016-12-14 05:22 - 01513472 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2017-01-10 22:24 - 2016-12-14 05:22 - 00391168 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll
2017-01-10 22:24 - 2016-12-14 05:21 - 03616768 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2017-01-10 22:24 - 2016-11-02 13:01 - 00484584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2017-01-10 22:24 - 2016-11-02 12:00 - 00534096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2017-01-10 22:24 - 2016-11-02 11:28 - 00324608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll
2017-01-10 22:24 - 2016-11-02 11:22 - 00337920 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2017-01-10 22:24 - 2016-11-02 11:21 - 00942080 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2017-01-10 22:24 - 2016-08-02 05:30 - 00822784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
2017-01-10 22:23 - 2016-12-21 08:42 - 00241504 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHost.dll
2017-01-10 22:23 - 2016-12-21 08:13 - 00119808 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCsp.dll
2017-01-10 22:23 - 2016-12-21 08:12 - 00083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProvPluginEng.dll
2017-01-10 22:23 - 2016-12-21 08:10 - 00234496 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCore.dll
2017-01-10 22:23 - 2016-12-21 08:08 - 01292288 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVPXENC.dll
2017-01-10 22:23 - 2016-12-21 08:08 - 00349184 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll
2017-01-10 22:23 - 2016-12-21 07:53 - 01692672 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2017-01-10 22:23 - 2016-12-21 07:51 - 02275840 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2017-01-10 22:23 - 2016-12-21 05:24 - 05061120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll
2017-01-10 22:23 - 2016-12-21 05:24 - 03733504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll
2017-01-10 22:23 - 2016-12-21 05:24 - 00886272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aadtb.dll
2017-01-10 22:23 - 2016-12-21 05:22 - 00860672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll
2017-01-10 22:23 - 2016-12-14 06:26 - 01469792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppVEntSubsystems32.dll
2017-01-10 22:23 - 2016-12-14 06:08 - 00341344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2017-01-10 22:23 - 2016-12-14 06:06 - 00509792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2017-01-10 22:23 - 2016-12-14 05:45 - 00147968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32k.sys
2017-01-10 22:23 - 2016-12-14 05:40 - 00266752 _____ (Microsoft Corporation) C:\WINDOWS\system32\ConsoleLogon.dll
2017-01-10 22:23 - 2016-12-14 05:40 - 00104448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.UI.Logon.ProxyStub.dll
2017-01-10 22:23 - 2016-12-14 05:32 - 00806400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3D12.dll
2017-01-10 22:23 - 2016-12-14 05:22 - 02998272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2017-01-10 22:23 - 2016-12-14 05:22 - 00707584 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll
2017-01-10 16:12 - 2017-01-10 22:52 - 00696320 _____ C:\Users\andre\Documents\Database1.accdb
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-02-09 19:51 - 2016-08-06 10:57 - 07945280 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-02-09 19:51 - 2016-07-16 23:35 - 03845182 _____ C:\WINDOWS\system32\perfh010.dat
2017-02-09 19:51 - 2016-07-16 23:35 - 01143046 _____ C:\WINDOWS\system32\perfc010.dat
2017-02-09 19:49 - 2016-09-01 09:12 - 00000000 ____D C:\AdwCleaner
2017-02-09 19:45 - 2016-12-05 21:37 - 00000000 ____D C:\Users\andre\AppData\Roaming\Franz
2017-02-09 19:45 - 2016-11-30 17:08 - 00000000 ___RD C:\Users\andre\Desktop\drive
2017-02-09 19:45 - 2016-08-06 11:09 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-02-09 19:45 - 2016-08-06 10:57 - 00000000 ____D C:\ProgramData\NVIDIA
2017-02-09 19:45 - 2016-02-13 19:11 - 00000093 _____ C:\HaxLogs.txt
2017-02-09 19:44 - 2016-07-16 07:04 - 02097152 _____ C:\WINDOWS\system32\config\BBI
2017-02-09 19:44 - 2016-01-10 19:48 - 00000412 __RSH C:\ProgramData\ntuser.pol
2017-02-09 19:33 - 2016-06-03 11:30 - 00000000 ____D C:\Program Files (x86)\MSI Afterburner
2017-02-09 19:29 - 2016-08-06 10:56 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2017-02-09 18:51 - 2015-10-31 14:35 - 00000000 ____D C:\Users\andre\AppData\Local\Spotify
2017-02-09 18:43 - 2016-08-06 11:09 - 00003130 _____ C:\WINDOWS\System32\Tasks\MSIAfterburner
2017-02-09 18:40 - 2016-08-26 13:59 - 00000000 ____D C:\Users\andre\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GoldMiner.io
2017-02-09 18:39 - 2016-08-26 19:10 - 00000000 ____D C:\Users\andre\AppData\Local\Ethash
2017-02-09 18:28 - 2016-08-30 15:48 - 00000000 ____D C:\Users\andre\AppData\Roaming\wargaming.net
2017-02-09 18:18 - 2015-10-31 14:34 - 00000000 ____D C:\Users\andre\AppData\Roaming\Spotify
2017-02-09 17:52 - 2016-08-06 11:09 - 00005324 _____ C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for GAMING-PC-andre Gaming-PC
2017-02-09 17:08 - 2016-11-10 16:47 - 00000000 ____D C:\Users\andre\AppData\Roaming\npm
2017-02-09 16:58 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\AppReadiness
2017-02-09 13:38 - 2016-07-16 12:47 - 00000000 ___HD C:\Program Files\WindowsApps
2017-02-09 02:00 - 2016-01-30 15:51 - 00000000 ____D C:\Users\andre\AppData\Local\Adobe
2017-02-08 17:49 - 2016-10-11 17:24 - 00000000 ____D C:\Users\andre\Desktop\Programma italiano e storia
2017-02-08 17:40 - 2016-08-06 10:56 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2017-02-08 17:40 - 2016-07-16 12:45 - 00000000 ____D C:\WINDOWS\INF
2017-02-08 17:39 - 2016-08-06 10:56 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2017-02-08 17:39 - 2016-08-06 10:56 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2017-02-07 15:27 - 2016-09-01 10:05 - 00000000 ____D C:\Users\andre\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Applicazioni Chrome
2017-02-07 15:26 - 2015-12-20 15:54 - 00000000 ____D C:\Users\andre\AppData\Local\CrashDumps
2017-02-06 23:11 - 2016-09-01 10:02 - 00002270 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-02-06 23:11 - 2016-09-01 10:02 - 00002258 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-02-06 18:08 - 2015-11-24 20:50 - 00000000 ____D C:\ProgramData\ProductData
2017-02-01 12:41 - 2016-08-06 10:57 - 00000000 ____D C:\Users\andre
2017-01-26 22:01 - 2016-07-16 12:36 - 00000000 ____D C:\WINDOWS\CbsTemp
2017-01-26 18:58 - 2015-11-05 16:21 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2017-01-26 18:56 - 2016-08-30 15:21 - 00001018 _____ C:\Users\andre\Desktop\PotPlayer 64 bit.lnk
2017-01-23 17:26 - 2015-10-30 22:53 - 00000000 ____D C:\Users\andre\AppData\Local\Packages
2017-01-20 19:40 - 2015-11-29 12:16 - 00000000 ____D C:\Users\andre\.android
2017-01-20 18:43 - 2016-11-10 16:48 - 00000000 _____ C:\Users\andre\.node_repl_history
2017-01-20 18:23 - 2015-11-24 21:31 - 00000000 ____D C:\Users\andre\Documents\Visual Studio 2015
2017-01-19 20:51 - 2016-02-05 15:57 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2017-01-17 17:05 - 2016-10-30 14:36 - 00000000 ____D C:\ESD
2017-01-15 17:49 - 2015-11-29 13:14 - 00000000 ____D C:\Program Files (x86)\Kingo ROOT
2017-01-15 16:51 - 2016-11-20 12:49 - 00000168 _____ C:\Users\andre\.packettracer
2017-01-14 18:48 - 2016-12-10 15:38 - 00000000 ____D C:\Users\andre\Desktop\clio
2017-01-14 17:50 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\rescache
2017-01-13 18:27 - 2016-11-09 16:25 - 00000000 ____D C:\Users\andre\Desktop\KMSAuto Lite Portable TEST5
2017-01-13 17:36 - 2016-08-06 11:09 - 00004562 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2017-01-13 17:24 - 2015-10-30 22:53 - 00000000 __RHD C:\Users\Public\AccountPictures
2017-01-12 20:15 - 2016-08-06 10:56 - 05019688 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2017-01-12 20:13 - 2016-08-06 11:52 - 00000000 ____D C:\Program Files\Hyper-V
2017-01-12 20:13 - 2016-07-16 12:47 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2017-01-12 20:13 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2017-01-12 20:13 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\oobe
2017-01-12 20:13 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\ShellExperiences
2017-01-12 20:13 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\Provisioning
2017-01-12 20:13 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\PolicyDefinitions
2017-01-11 16:22 - 2015-10-30 22:58 - 00000000 ____D C:\WINDOWS\system32\MRT
2017-01-11 16:20 - 2015-10-30 22:58 - 135657872 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
==================== Files in the root of some directories =======
2015-11-25 17:35 - 2015-12-05 19:57 - 0000624 _____ () C:\Users\andre\AppData\Roaming\All CPU MeterV3_Settings.ini
2015-11-23 20:02 - 2015-11-23 20:02 - 0000839 _____ () C:\Users\andre\AppData\Roaming\Drives Meter_Settings.ini
2015-11-23 20:01 - 2015-11-23 20:01 - 0000505 _____ () C:\Users\andre\AppData\Roaming\Drives Monitor_Settings.ini
2015-12-29 17:37 - 2015-12-29 17:37 - 0005120 _____ () C:\Users\andre\AppData\Roaming\GiftBag.db
1998-01-12 01:00 - 1998-01-12 01:00 - 0049931 _____ () C:\Users\andre\AppData\Roaming\Jaundice.N62
2015-11-23 20:05 - 2015-11-23 20:05 - 0000015 _____ () C:\Users\andre\AppData\Roaming\Network Meter_Usage.ini
1998-10-27 01:00 - 1998-10-27 01:00 - 0001693 _____ () C:\Users\andre\AppData\Roaming\Palaeoecology.W
2016-01-02 21:26 - 2016-03-22 16:08 - 0000132 _____ () C:\Users\andre\AppData\Roaming\Preferenze Adobe Formato PNG CS6
2015-11-23 20:06 - 2015-11-23 20:06 - 0002420 _____ () C:\Users\andre\AppData\Roaming\System Monitor II_CPU0_Settings.ini
2015-11-23 20:10 - 2015-11-23 20:10 - 0000121 _____ () C:\Users\andre\AppData\Roaming\System Monitor II_UptimeRecord.ini
2015-12-18 16:04 - 2015-12-18 16:04 - 0000040 _____ () C:\Users\andre\AppData\Roaming\TheHunterSettings_steam_live.cfg
2016-10-11 15:26 - 2016-12-28 12:24 - 0000600 _____ () C:\Users\andre\AppData\Local\PUTTY.RND
2016-04-01 20:22 - 2016-05-26 11:02 - 0007609 _____ () C:\Users\andre\AppData\Local\Resmon.ResmonCfg
2017-01-15 12:24 - 2017-01-15 17:49 - 0000163 _____ () C:\Users\andre\AppData\Local\uts.ini
2016-11-20 12:49 - 2016-11-20 12:50 - 0019456 _____ () C:\Users\andre\AppData\Local\WebpageIcons.db
2015-11-05 17:14 - 2015-11-05 17:14 - 0000057 _____ () C:\ProgramData\Ament.ini
Files to move or delete:
====================
C:\Users\andre\IP_Log_Data.js
Some files in TEMP:
====================
2017-01-08 17:20 - 2017-01-08 17:21 - 12630720 _____ (Ellora Assets Corporation ) C:\Users\andre\AppData\Local\Temp\FreemakeYouTubeToMP3BoomFull.exe
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2017-02-09 17:48
==================== End of FRST.txt ============================