Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Getting "Requested Resource in Use" error when trying to run M


  • This topic is locked This topic is locked

#1
shoie

shoie

    New Member

  • Member
  • Pip
  • 5 posts

Hello -

 

For a few weeks, I've been getting the Requested Resource is in use error when trying to run Malwarebytes.  Tonight I did a search on-line an see that this is a trojan.  I've tried a few tutorials to try and remove it without success.  I've tried running malwarebytes anti-rootkit beta and rkill tool but all of them continue to give me this message.  Below are the results of running frst.  This is on my son's computer and he plays a lot of games so I assume this is how he got the trojan.

 

Thanks for your help,

Steffanie

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 14-05-2017
Ran by Michael (administrator) on DESKTOP-T3IMUHD (16-05-2017 20:56:26)
Running from C:\Users\steff\Desktop
Loaded Profiles: Michael (Available Profiles: Michael)
Platform: Windows 10 Home Version 1703 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.22\AsSysCtrlService.exe
() C:\Program Files (x86)\ASUS\AXSP\1.02.00\atkexComSvc.exe
() C:\Users\steff\AppData\Local\ntuserlitelist\dataup\dataup.exe
(Electronic Arts) C:\Program Files (x86)\Origin\OriginWebHelperService.exe
() C:\Windows\System32\tprdpw32.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.15.597.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
() C:\Users\steff\AppData\Local\GameJoltClient\GameJoltClient.exe
() C:\Users\steff\AppData\Local\GameJoltClient\GameJoltClient.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Users\steff\AppData\Local\GameJoltClient\GameJoltClient.exe
() C:\Users\steff\AppData\Local\GameJoltClient\GameJoltClient.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Program Files\ATI Technologies\ATI.ACE\a4\AdaptiveSleepService.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
==================== Registry (Whitelisted) ====================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [629152 2017-03-18] (Microsoft Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176952 2016-06-01] (Apple Inc.)
HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [629152 2017-03-18] (Microsoft Corporation)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2780112 2017-01-20] (Malwarebytes)
HKLM\...\Run: [StartCN] => C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe [8027016 2016-11-21] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596504 2016-04-01] (Oracle Corporation)
HKU\S-1-5-21-2892662990-3918576701-1327745688-1002\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3019552 2017-04-25] (Valve Corporation)
HKU\S-1-5-21-2892662990-3918576701-1327745688-1002\...\Run: [WinResSync] => C:\WINDOWS\system32\regsvr32.exe /s "C:\Users\steff\AppData\Roaming\Microsoft\Protect\76e354-23e355-0dc12100-1d7df1-bfa0.rs" <===== ATTENTION
HKU\S-1-5-21-2892662990-3918576701-1327745688-1002\...\Run: [GameJoltClient] => C:\Users\steff\AppData\Local\GameJoltClient\GameJoltClient.exe [46705152 2016-08-25] ()
HKU\S-1-5-21-2892662990-3918576701-1327745688-1002\...\RunOnce: [WinResSync] => C:\WINDOWS\system32\regsvr32.exe /s "C:\Users\steff\AppData\Roaming\Microsoft\Protect\76e354-23e355-0dc12100-1d7df1-bfa0.rs" <===== ATTENTION
ShellIconOverlayIdentifiers: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\steff\AppData\Local\MEGAsync\ShellExtX64.dll -> No File
ShellIconOverlayIdentifiers: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\steff\AppData\Local\MEGAsync\ShellExtX64.dll -> No File
ShellIconOverlayIdentifiers: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\steff\AppData\Local\MEGAsync\ShellExtX64.dll -> No File
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\steff\AppData\Local\MEGAsync\ShellExtX32.dll -> No File
ShellIconOverlayIdentifiers-x32: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\steff\AppData\Local\MEGAsync\ShellExtX32.dll -> No File
ShellIconOverlayIdentifiers-x32: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\steff\AppData\Local\MEGAsync\ShellExtX32.dll -> No File
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 68.105.28.11 68.105.29.11 68.105.28.12
Tcpip\..\Interfaces\{26b11a49-585f-4b43-a90c-9af3c3d7b25b}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{4e696daa-75db-11e6-b9ee-806e6f6e6963}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{60e1210b-6c25-493d-9c17-7a1a61a75456}: [DhcpNameServer] 68.105.28.11 68.105.29.11 68.105.28.12
 
Internet Explorer:
==================
HKU\S-1-5-21-2892662990-3918576701-1327745688-1002\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bing.com/search?FORM=INCOH1&PC=IC05&PTAG=ICO-ef6df6ab
HKU\S-1-5-21-2892662990-3918576701-1327745688-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617912&ResetID=131390148903511237&GUID=5B7A2A23-00D8-4381-B348-1E4A35EC4929
SearchScopes: HKU\S-1-5-21-2892662990-3918576701-1327745688-1002 -> {1711FC25-F05A-40CE-B859-A0C1CF01FD18} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-ef6df6ab&q={searchTerms}
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\ssv.dll [2016-05-25] (Oracle Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\jp2ssv.dll [2016-05-25] (Oracle Corporation)
 
FireFox:
========
FF DefaultProfile: 21z70x7d.default
FF ProfilePath: C:\Users\steff\AppData\Roaming\Mozilla\Firefox\Profiles\21z70x7d.default [2017-01-20]
FF NewTab: Mozilla\Firefox\Profiles\21z70x7d.default -> 
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\21z70x7d.default -> Bing®
FF SearchEngineOrder.1: Mozilla\Firefox\Profiles\21z70x7d.default -> Yahoo powered search
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\21z70x7d.default -> 
FF Homepage: Mozilla\Firefox\Profiles\21z70x7d.default -> 
FF Extension: (No Name) - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi [not found]
FF SearchPlugin: C:\Users\steff\AppData\Roaming\Mozilla\Firefox\Profiles\21z70x7d.default\searchplugins\bing-lavasoft.xml [2017-01-20]
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-12-18] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\dtplugin\npDeployJava1.dll [2016-05-25] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\plugin2\npjp2.dll [2016-05-25] (Oracle Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.3\npGoogleUpdate3.dll [No File]
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.3\npGoogleUpdate3.dll [No File]
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin HKU\S-1-5-21-2892662990-3918576701-1327745688-1002: @nsroblox.roblox.com/launcher -> C:\Users\steff\AppData\Local\Roblox\Versions\version-398bf2b17c844b38\\NPRobloxProxy.dll [2013-01-01] ( ROBLOX Corporation)
FF Plugin HKU\S-1-5-21-2892662990-3918576701-1327745688-1002: @nsroblox.roblox.com/launcher64 -> C:\Users\steff\AppData\Local\Roblox\Versions\version-398bf2b17c844b38\\NPRobloxProxy64.dll [2013-01-01] ( ROBLOX Corporation)
StartMenuInternet: FIREFOX.EXE - firefox.exe
 
Chrome: 
=======
CHR StartupUrls: Default -> "chrome://newtab/"
CHR NewTab: Default ->  Active:"chrome-extension://lhboicfekepdfnkmebhpijmabmnenmoh/index.html", Active:"chrome-extension://nljldecpbfgbiaejapakffolddomlooi/stubby.html"
CHR DefaultSearchURL: Default -> hxxp://search.fulltabsearch.com/?src=FullTab_ds&q={searchTerms}
CHR DefaultSearchKeyword: Default -> keyword.FullTab
CHR Profile: C:\Users\steff\AppData\Local\Google\Chrome\User Data\Default [2017-05-16]
CHR Extension: (Google Slides) - C:\Users\steff\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-03-22]
CHR Extension: (Google Docs) - C:\Users\steff\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-03-22]
CHR Extension: (Google Drive) - C:\Users\steff\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-03-22]
CHR Extension: (YouTube) - C:\Users\steff\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-03-22]
CHR Extension: (Google Sheets) - C:\Users\steff\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-03-22]
CHR Extension: (Google Docs Offline) - C:\Users\steff\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-03-22]
CHR Extension: (Default) - C:\Users\steff\AppData\Local\Google\Chrome\User Data\Default\Extensions\iofaonnlciaohckdbpjeicblfalnjhak [2017-04-15]
CHR Extension: (FullTab) - C:\Users\steff\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhboicfekepdfnkmebhpijmabmnenmoh [2017-04-15]
CHR Extension: (RadioRage) - C:\Users\steff\AppData\Local\Google\Chrome\User Data\Default\Extensions\nljldecpbfgbiaejapakffolddomlooi [2017-04-15]
CHR Extension: (Chrome Web Store Payments) - C:\Users\steff\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-22]
CHR Extension: (Gmail) - C:\Users\steff\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-03-22]
CHR Extension: (Chrome Media Router) - C:\Users\steff\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-03-22]
 
==================== Services (Whitelisted) ====================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 AdaptiveSleepService; C:\Program Files\ATI Technologies\ATI.ACE\A4\AdaptiveSleepService.exe [155016 2016-11-21] ()
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-03-02] (Apple Inc.)
R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.02.00\atkexComSvc.exe [936728 2014-07-22] ()
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.22\AsSysCtrlService.exe [1360016 2014-07-22] () [File not signed]
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [1447944 2016-12-16] ()
R2 Dataup; C:\Users\steff\AppData\Local\ntuserlitelist\dataup\dataup.exe [77824 2017-01-05] () [File not signed] <==== ATTENTION
S3 EasyAntiCheat; C:\WINDOWS\SysWOW64\EasyAntiCheat.exe [245544 2016-06-24] (EasyAntiCheat Ltd)
S2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4355024 2017-01-20] (Malwarebytes)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2147216 2017-04-10] (Electronic Arts)
R2 Origin Web Helper Service; C:\Program Files (x86)\Origin\OriginWebHelperService.exe [3116440 2017-04-10] (Electronic Arts)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [342264 2017-03-18] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [102816 2017-03-18] (Microsoft Corporation)
 
===================== Drivers (Whitelisted) ======================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
S0 amdkmafd; C:\WINDOWS\System32\drivers\amdkmafd.sys [40720 2015-07-28] (Advanced Micro Devices, Inc.)
R3 amdkmdag; C:\WINDOWS\System32\DriverStore\FileRepository\c0309377.inf_amd64_7ab08912e1e1da0a\atikmdag.sys [26568848 2017-01-25] (Advanced Micro Devices, Inc.)
R3 amdkmdap; C:\WINDOWS\System32\DriverStore\FileRepository\c0309377.inf_amd64_7ab08912e1e1da0a\atikmpag.sys [536600 2017-01-25] (Advanced Micro Devices, Inc.)
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2014-07-22] ()
R3 AtiHDAudioService; C:\WINDOWS\system32\drivers\AtihdWT6.sys [110104 2016-09-28] (Advanced Micro Devices)
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.)
R0 drmkpro64; C:\WINDOWS\System32\drivers\ndistpr64.sys [78112 2013-09-28] () [File not signed] <==== ATTENTION
S3 MBAMProtection; C:\WINDOWS\system32\drivers\mbam.sys [43968 2017-03-25] (Malwarebytes)
S3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [251832 2017-04-23] (Malwarebytes)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [604160 2017-03-18] (Realtek                                            )
S3 SDFRd; C:\WINDOWS\System32\drivers\SDFRd.sys [31128 2017-03-18] ()
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [165504 2016-09-05] (Samsung Electronics Co., Ltd.)
S3 SWDUMon; C:\WINDOWS\system32\DRIVERS\SWDUMon.sys [13920 2017-01-20] ()
R1 VBoxUSBMon; C:\WINDOWS\system32\DRIVERS\VBoxUSBMon.sys [127432 2015-09-15] (BigNox Corporation)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44632 2017-03-18] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [294816 2017-03-18] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [121248 2017-03-18] (Microsoft Corporation)
S1 XQHDrv; C:\WINDOWS\system32\DRIVERS\XQHDrv.sys [253384 2015-09-15] (BigNox Corporation)
S1 XQHDrv; C:\Windows\SysWOW64\DRIVERS\XQHDrv.sys [253384 2015-09-15] (BigNox Corporation)
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2017-05-16 20:56 - 2017-05-16 20:57 - 00016067 _____ C:\Users\steff\Desktop\FRST.txt
2017-05-16 20:53 - 2017-05-16 20:56 - 00000000 ____D C:\FRST
2017-05-16 20:51 - 2017-05-16 20:51 - 00000000 ____D C:\WINDOWS\pss
2017-05-16 20:43 - 2017-05-16 20:43 - 02429952 _____ (Farbar) C:\Users\steff\Desktop\FRST64.exe
2017-05-16 20:33 - 2017-05-16 20:33 - 00000000 ____D C:\Users\steff\Downloads\mbar-1.09.3.1001 (1)
2017-05-16 20:26 - 2017-05-16 20:50 - 00000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job
2017-05-16 20:16 - 2017-05-16 20:16 - 00613140 _____ C:\WINDOWS\Minidump\051617-30328-01.dmp
2017-05-16 20:08 - 2017-05-16 20:08 - 00639876 _____ C:\WINDOWS\Minidump\051617-27515-01.dmp
2017-05-16 19:41 - 2017-05-16 19:41 - 00659148 _____ C:\WINDOWS\Minidump\051617-33250-01.dmp
2017-05-16 19:28 - 2017-05-16 19:28 - 00000000 ____D C:\Users\steff\AppData\Local\DBG
2017-05-16 19:14 - 2017-05-16 19:14 - 00663428 _____ C:\WINDOWS\Minidump\051617-24671-01.dmp
2017-05-16 19:01 - 2017-05-16 19:01 - 00627012 _____ C:\WINDOWS\Minidump\051617-27046-01.dmp
2017-05-16 18:06 - 2017-05-16 18:06 - 01040768 _____ C:\WINDOWS\SysWOW64\atiadlxy.dll
2017-05-16 18:06 - 2017-05-16 18:06 - 01040768 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\atiadlxx.dll
2017-05-16 18:06 - 2017-05-16 18:06 - 00924544 _____ (AMD) C:\WINDOWS\system32\coinst_17.10.dll
2017-05-16 18:06 - 2017-05-16 18:06 - 00546688 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\Rapidfire64.dll
2017-05-16 18:06 - 2017-05-16 18:06 - 00478080 _____ C:\WINDOWS\SysWOW64\Rapidfire.dll
2017-05-16 18:06 - 2017-05-16 18:06 - 00365440 _____ C:\WINDOWS\SysWOW64\SETB32A.tmp
2017-05-16 18:06 - 2017-05-16 18:06 - 00148440 _____ C:\WINDOWS\SysWOW64\aticfx32.dll
2017-05-16 18:06 - 2017-05-16 18:06 - 00133504 _____ C:\WINDOWS\SysWOW64\atisamu32.dll
2017-05-16 18:06 - 2017-05-16 18:06 - 00121208 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.dll
2017-05-16 18:06 - 2017-05-16 18:06 - 00112512 _____ C:\WINDOWS\system32\amdxc64.dll
2017-05-16 18:06 - 2017-05-16 18:06 - 00112000 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.dll
2017-05-16 18:06 - 2017-05-16 18:06 - 00101760 _____ C:\WINDOWS\SysWOW64\atidxx32.dll
2017-05-16 18:06 - 2017-05-16 18:06 - 00099192 _____ C:\WINDOWS\SysWOW64\amdxc32.dll
2017-05-16 18:06 - 2017-05-16 18:06 - 00075136 _____ C:\WINDOWS\SysWOW64\amdmcl32.dll
2017-05-16 18:06 - 2017-05-16 18:06 - 00044920 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\RapidFireServer64.dll
2017-05-16 18:06 - 2017-05-16 18:06 - 00042368 _____ C:\WINDOWS\SysWOW64\RapidFireServer.dll
2017-05-16 18:06 - 2017-05-16 18:06 - 00029056 _____ (Microsoft Corporation) C:\WINDOWS\system32\detoured.dll
2017-05-16 18:05 - 2017-05-16 18:05 - 00116072 _____ C:\WINDOWS\SysWOW64\amdave32.dll
2017-05-16 18:05 - 2017-05-16 18:05 - 00102520 _____ C:\WINDOWS\SysWOW64\amdpcom32.dll
2017-05-16 18:05 - 2017-05-16 18:05 - 00102512 _____ C:\WINDOWS\SysWOW64\atimpc32.dll
2017-05-16 15:55 - 2017-05-16 15:56 - 00669348 _____ C:\WINDOWS\Minidump\051617-30062-01.dmp
2017-05-16 15:43 - 2017-05-16 15:43 - 00645972 _____ C:\WINDOWS\Minidump\051617-23234-01.dmp
2017-05-16 15:41 - 2017-05-16 15:41 - 00000000 ____D C:\WINDOWS\LastGood
2017-05-16 15:36 - 2017-05-16 20:16 - 00000000 ____D C:\WINDOWS\Minidump
2017-05-16 15:36 - 2017-05-16 15:37 - 00669428 _____ C:\WINDOWS\Minidump\051617-24734-01.dmp
2017-05-16 15:35 - 2017-05-16 15:35 - 00000000 ____D C:\WINDOWS\LastGood.Tmp
2017-05-15 21:01 - 2017-05-15 21:01 - 00000000 ____D C:\Users\steff\AppData\Roaming\MK10
2017-05-15 20:17 - 2017-05-15 20:17 - 00000222 _____ C:\Users\steff\Desktop\Mortal Kombat X.url
2017-05-13 09:12 - 2017-05-13 09:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Radeon Settings
2017-05-13 09:11 - 2017-05-13 09:11 - 00000000 ____D C:\ProgramData\Microsoft OneDrive
2017-05-13 09:11 - 2017-05-13 09:11 - 00000000 ____D C:\Program Files\ATI Technologies
2017-05-13 09:08 - 2017-05-13 09:08 - 00000258 __RSH C:\Users\steff\ntuser.pol
2017-05-13 09:08 - 2017-05-13 09:08 - 00000020 ___SH C:\Users\steff\ntuser.ini
2017-05-12 23:39 - 2017-05-12 23:40 - 00000000 ____D C:\Windows.old
2017-05-12 23:39 - 2017-05-12 23:39 - 05225984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll
2017-05-12 23:39 - 2017-05-12 23:39 - 03667456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll
2017-05-12 23:39 - 2017-05-12 23:39 - 02859520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2017-05-12 23:39 - 2017-05-12 23:39 - 02298880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2017-05-12 23:39 - 2017-05-12 23:39 - 02158544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2017-05-12 23:39 - 2017-05-12 23:39 - 01626624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2017-05-12 23:39 - 2017-05-12 23:39 - 01518088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2017-05-12 23:39 - 2017-05-12 23:39 - 01506816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\quartz.dll
2017-05-12 23:39 - 2017-05-12 23:39 - 01302528 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVPXENC.dll
2017-05-12 23:39 - 2017-05-12 23:39 - 01291776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVPXENC.dll
2017-05-12 23:39 - 2017-05-12 23:39 - 01248768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AzureSettingSyncProvider.dll
2017-05-12 23:39 - 2017-05-12 23:39 - 01060352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsPrint.dll
2017-05-12 23:39 - 2017-05-12 23:39 - 01019904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aadtb.dll
2017-05-12 23:39 - 2017-05-12 23:39 - 00987648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wpnapps.dll
2017-05-12 23:39 - 2017-05-12 23:39 - 00909312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll
2017-05-12 23:39 - 2017-05-12 23:39 - 00840192 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll
2017-05-12 23:39 - 2017-05-12 23:39 - 00806400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StoreAgent.dll
2017-05-12 23:39 - 2017-05-12 23:39 - 00716440 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVideoDSP.dll
2017-05-12 23:39 - 2017-05-12 23:39 - 00636416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WpcWebFilter.dll
2017-05-12 23:39 - 2017-05-12 23:39 - 00559000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2017-05-12 23:39 - 2017-05-12 23:39 - 00476672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OneDriveSettingSyncProvider.dll
2017-05-12 23:39 - 2017-05-12 23:39 - 00429568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winspool.drv
2017-05-12 23:39 - 2017-05-12 23:39 - 00414208 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv.sys
2017-05-12 23:39 - 2017-05-12 23:39 - 00387928 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpps.dll
2017-05-12 23:39 - 2017-05-12 23:39 - 00367104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgentUserBroker.exe
2017-05-12 23:39 - 2017-05-12 23:39 - 00364032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll
2017-05-12 23:39 - 2017-05-12 23:39 - 00328704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe
2017-05-12 23:39 - 2017-05-12 23:39 - 00282112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VEEventDispatcher.dll
2017-05-12 23:39 - 2017-05-12 23:39 - 00252928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsDocumentTargetPrint.dll
2017-05-12 23:39 - 2017-05-12 23:39 - 00233472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WiFiDisplay.dll
2017-05-12 23:39 - 2017-05-12 23:39 - 00232448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudBackupSettings.dll
2017-05-12 23:39 - 2017-05-12 23:39 - 00175616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PackageStateRoaming.dll
2017-05-12 23:39 - 2017-05-12 23:39 - 00094720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataTimeUtil.dll
2017-05-12 23:39 - 2017-05-12 23:39 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmjpegdec.dll
2017-05-12 23:39 - 2017-05-12 23:39 - 00081408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmjpegdec.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 23681024 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 23677440 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 21353200 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 20505600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 20374424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 19335168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 12787200 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 11870208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 08320920 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2017-05-12 23:38 - 2017-05-12 23:38 - 08244736 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 07931392 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 07904784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 06759512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 06728192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 06292992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 05557760 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 05477088 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneCoreUAPCommonProxyStub.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 04848440 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2017-05-12 23:38 - 2017-05-12 23:38 - 04730368 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 04559360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 04469832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2017-05-12 23:38 - 2017-05-12 23:38 - 04446208 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 04396032 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 04175872 _____ (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 03672064 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2017-05-12 23:38 - 2017-05-12 23:38 - 03655680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 03307008 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 03116184 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 02969880 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreUIComponents.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 02957824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2017-05-12 23:38 - 2017-05-12 23:38 - 02800128 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 02765824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Shell.UnifiedTile.CuratedTileCollections.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 02651648 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 02635336 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 02499584 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.pcshell.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 02444192 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2017-05-12 23:38 - 2017-05-12 23:38 - 02443776 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 02435584 _____ (Microsoft Corporation) C:\WINDOWS\system32\ResetEngine.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 02399728 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 02330520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 02259760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreUIComponents.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 02085280 _____ (Microsoft Corporation) C:\WINDOWS\system32\UpdateAgent.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 02077184 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2017-05-12 23:38 - 2017-05-12 23:38 - 02056192 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2017-05-12 23:38 - 2017-05-12 23:38 - 02008576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2017-05-12 23:38 - 2017-05-12 23:38 - 01886208 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 01878016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AzureSettingSyncProvider.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 01852776 _____ (Microsoft Corporation) C:\WINDOWS\system32\crypt32.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 01839872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 01803264 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 01760264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 01657344 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsPrint.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 01628160 _____ (Microsoft Corporation) C:\WINDOWS\system32\comsvcs.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 01611776 _____ (Microsoft Corporation) C:\WINDOWS\system32\SpeechPal.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 01605632 _____ (Microsoft Corporation) C:\WINDOWS\system32\quartz.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 01604312 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 01600512 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbghelp.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 01583616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 01557288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\crypt32.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 01468416 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 01463296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 01433600 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettings.Handlers.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 01411128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 01356800 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 01325456 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 01320352 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpx.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 01295872 _____ (Microsoft Corporation) C:\WINDOWS\system32\dosvc.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 01293824 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadtb.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 01285120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbghelp.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 01269760 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 01260544 _____ (Microsoft Corporation) C:\WINDOWS\system32\GamePanel.exe
2017-05-12 23:38 - 2017-05-12 23:38 - 01257472 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpnapps.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 01242624 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedStartModel.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 01147296 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2017-05-12 23:38 - 2017-05-12 23:38 - 01103872 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 01087488 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 01085440 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 01075712 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 01054208 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 01051648 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 01027584 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 01024416 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2017-05-12 23:38 - 2017-05-12 23:38 - 00988168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00985600 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWorkspace.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00974848 _____ (Microsoft Corporation) C:\WINDOWS\system32\mmgaserver.exe
2017-05-12 23:38 - 2017-05-12 23:38 - 00970240 _____ (Microsoft Corporation) C:\WINDOWS\system32\autochk.exe
2017-05-12 23:38 - 2017-05-12 23:38 - 00925696 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebFilter.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00923040 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00891904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\autochk.exe
2017-05-12 23:38 - 2017-05-12 23:38 - 00872472 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipSVC.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00864256 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationController.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00805888 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieproxy.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00799232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00790528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00775824 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00751104 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00750560 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2017-05-12 23:38 - 2017-05-12 23:38 - 00750080 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorSvc.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00741784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Shell.Broker.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00731136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mmgaserver.exe
2017-05-12 23:38 - 2017-05-12 23:38 - 00722944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv2.sys
2017-05-12 23:38 - 2017-05-12 23:38 - 00712600 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2017-05-12 23:38 - 2017-05-12 23:38 - 00708712 _____ (Microsoft Corporation) C:\WINDOWS\system32\kernel32.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00707072 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2017-05-12 23:38 - 2017-05-12 23:38 - 00687104 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00681984 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00673280 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppBroker.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00673112 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppResolver.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00667040 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00663040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00651680 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2017-05-12 23:38 - 2017-05-12 23:38 - 00647168 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXService.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00646656 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockHostingFramework.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00626520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2017-05-12 23:38 - 2017-05-12 23:38 - 00624640 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00605936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00599576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kernel32.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00590848 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00585728 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneDriveSettingSyncProvider.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIRibbonRes.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIRibbonRes.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00583160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00545792 _____ (Microsoft Corporation) C:\WINDOWS\system32\winspool.drv
2017-05-12 23:38 - 2017-05-12 23:38 - 00543640 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe
2017-05-12 23:38 - 2017-05-12 23:38 - 00527360 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadcloudap.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00524800 _____ (Microsoft Corporation) C:\WINDOWS\system32\TileDataRepository.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00523296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppResolver.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00517632 _____ (Microsoft Corporation) C:\WINDOWS\system32\daxexec.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00510976 _____ (Microsoft Corporation) C:\WINDOWS\system32\TDLMigration.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00507392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00457728 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00450048 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcdedit.exe
2017-05-12 23:38 - 2017-05-12 23:38 - 00433664 _____ (Microsoft Corporation) C:\WINDOWS\system32\msIso.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00422400 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpAXHolder.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00416256 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgentUserBroker.exe
2017-05-12 23:38 - 2017-05-12 23:38 - 00409600 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00409504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2017-05-12 23:38 - 2017-05-12 23:38 - 00406528 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputSwitch.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00392704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PlayToManager.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00388000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS
2017-05-12 23:38 - 2017-05-12 23:38 - 00386560 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00382368 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00373760 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe
2017-05-12 23:38 - 2017-05-12 23:38 - 00362496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\daxexec.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00358400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieproxy.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00354360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcryptprimitives.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00354304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputSwitch.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00347136 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsDocumentTargetPrint.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00338432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00334336 _____ (Microsoft Corporation) C:\WINDOWS\system32\wc_storage.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00329728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00315392 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationObjFactory.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00314880 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsEnvironment.Desktop.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00311192 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00301056 _____ (Microsoft Corporation) C:\WINDOWS\system32\EnterpriseAppMgmtSvc.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00296448 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudBackupSettings.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00280064 _____ (Microsoft Corporation) C:\WINDOWS\system32\WiFiDisplay.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00274944 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00266240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00257024 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00251904 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Gaming.Preview.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00246272 _____ (Microsoft Corporation) C:\WINDOWS\system32\domgmt.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00232960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00232960 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00224256 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2017-05-12 23:38 - 2017-05-12 23:38 - 00218624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Streaming.ps.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.AppDefaults.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00207264 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00203776 _____ (Microsoft Corporation) C:\WINDOWS\system32\PackageStateRoaming.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00164864 _____ (Microsoft Corporation) C:\WINDOWS\system32\EnterpriseModernAppMgmtCSP.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00155136 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEStoreEventHandlers.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00142240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wcifs.sys
2017-05-12 23:38 - 2017-05-12 23:38 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00119296 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataTimeUtil.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00118784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netvsc.sys
2017-05-12 23:38 - 2017-05-12 23:38 - 00105456 _____ (Microsoft Corporation) C:\WINDOWS\system32\imagehlp.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00096256 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00095584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\imagehlp.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00089088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00087552 _____ (Microsoft Corporation) C:\WINDOWS\system32\asycfilt.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00084992 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00082944 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdc.ocx
2017-05-12 23:38 - 2017-05-12 23:38 - 00080384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00078848 _____ (Microsoft Corporation) C:\WINDOWS\system32\offreg.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00078336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\asycfilt.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00072192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdc.ocx
2017-05-12 23:38 - 2017-05-12 23:38 - 00064512 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsrv.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00057856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\offreg.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00056832 _____ (Microsoft Corporation) C:\WINDOWS\system32\cldapi.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00052736 _____ (Microsoft Corporation) C:\WINDOWS\system32\musdialoghandlers.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00050176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cldapi.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00050176 _____ (Microsoft Corporation) C:\WINDOWS\system32\catsrvps.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00047104 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00038912 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\BasicRender.sys
2017-05-12 23:38 - 2017-05-12 23:38 - 00032004 _____ C:\WINDOWS\system32\edgehtmlpluginpolicy.bin
2017-05-12 23:38 - 2017-05-12 23:38 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\system32\odbcconf.dll
2017-05-12 23:38 - 2017-05-12 23:38 - 00027040 _____ (Microsoft Corporation) C:\WINDOWS\system32\browser_broker.exe
2017-05-12 23:38 - 2017-05-12 23:38 - 00025088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\odbcconf.dll
2017-05-12 23:34 - 2017-05-12 23:34 - 00008192 _____ C:\WINDOWS\system32\config\userdiff
2017-05-12 23:34 - 2017-05-12 22:43 - 00000000 ____D C:\WINDOWS\ServiceProfiles
2017-05-12 23:33 - 2017-05-12 23:33 - 00000000 ____D C:\Program Files\Reference Assemblies
2017-05-12 23:33 - 2017-05-12 23:33 - 00000000 ____D C:\Program Files\MSBuild
2017-05-12 23:33 - 2017-05-12 23:33 - 00000000 ____D C:\Program Files (x86)\Reference Assemblies
2017-05-12 23:33 - 2017-05-12 23:33 - 00000000 ____D C:\Program Files (x86)\MSBuild
2017-05-12 23:32 - 2017-02-10 12:26 - 01166520 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationNative_v0300.dll
2017-05-12 23:32 - 2017-02-10 12:26 - 00124624 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2017-05-12 23:32 - 2017-02-10 12:26 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe
2017-05-12 23:32 - 2017-02-10 12:21 - 00778936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationNative_v0300.dll
2017-05-12 23:32 - 2017-02-10 12:21 - 00103120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2017-05-12 23:32 - 2017-02-10 12:21 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe
2017-05-12 23:08 - 2017-05-12 23:08 - 00000000 ____D C:\WINDOWS\system32\ÿÿo
2017-05-12 23:08 - 2017-05-12 23:08 - 00000000 ____D C:\WINDOWS\system32\6599124bf4a21821..bin
2017-05-12 23:08 - 2017-05-12 23:08 - 00000000 ____D C:\WINDOWS\system32\
2017-05-12 23:07 - 2017-05-12 23:07 - 00000000 _SHDL C:\Users\Default\My Documents
2017-05-12 23:04 - 2017-05-12 23:06 - 00007623 _____ C:\WINDOWS\diagwrn.xml
2017-05-12 23:04 - 2017-05-12 23:06 - 00007623 _____ C:\WINDOWS\diagerr.xml
2017-05-12 23:04 - 2017-05-12 23:04 - 00000000 ____D C:\ProgramData\USOShared
2017-05-12 23:00 - 2017-05-16 20:52 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-05-12 23:00 - 2017-05-16 14:38 - 00004168 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{DFA58333-E091-4C2D-B52F-3EFFD35E1F6E}
2017-05-12 23:00 - 2017-05-13 09:16 - 00003294 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task v2
2017-05-12 23:00 - 2017-05-12 23:00 - 00003344 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2017-05-12 23:00 - 2017-05-12 23:00 - 00003282 _____ C:\WINDOWS\System32\Tasks\{2CC1EE75-9B6A-59DE-40DD-5E1581EAAB6D}
2017-05-12 23:00 - 2017-05-12 23:00 - 00003120 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2017-05-12 23:00 - 2017-05-12 23:00 - 00000000 ____D C:\WINDOWS\System32\Tasks\Apple
2017-05-12 22:59 - 2017-05-16 20:30 - 01103130 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-05-12 22:52 - 2017-05-12 22:52 - 00001576 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2017-05-12 22:49 - 2017-05-12 22:52 - 00000000 ____D C:\WINDOWS\system32\config\bbimigrate
2017-05-12 22:46 - 2017-05-16 20:10 - 00000000 ____D C:\Users\steff
2017-05-12 22:46 - 2017-05-12 22:46 - 00000000 _SHDL C:\Users\steff\My Documents
2017-05-12 22:46 - 2017-05-12 22:46 - 00000000 _SHDL C:\Users\steff\Documents\My Videos
2017-05-12 22:46 - 2017-05-12 22:46 - 00000000 _SHDL C:\Users\steff\Documents\My Pictures
2017-05-12 22:46 - 2017-05-12 22:46 - 00000000 _SHDL C:\Users\steff\Documents\My Music
2017-05-12 22:46 - 2017-03-18 13:56 - 02233344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2017-05-12 22:45 - 2017-05-16 20:25 - 00065536 _____ C:\WINDOWS\system32\spu_storage.bin
2017-05-12 22:45 - 2017-05-15 21:01 - 00000000 ____D C:\ProgramData\Package Cache
2017-05-12 22:45 - 2017-05-12 22:45 - 00000000 ____D C:\Program Files (x86)\AMD
2017-05-12 22:44 - 2017-05-13 09:11 - 00000000 ____D C:\Program Files\AMD
2017-05-12 22:44 - 2017-05-12 22:44 - 00000000 ____D C:\Program Files\Common Files\ATI Technologies
2017-05-12 22:43 - 2017-05-16 15:37 - 00225384 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2017-05-12 22:43 - 2017-05-15 20:04 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2017-05-12 16:16 - 2017-05-13 09:08 - 00000000 ___DC C:\WINDOWS\Panther
2017-05-11 15:30 - 2017-05-11 15:30 - 00000000 ____D C:\Users\steff\AppData\Local\UNP
2017-05-11 15:18 - 2017-05-12 22:52 - 00000000 ____D C:\WINDOWS\system32\UNP
2017-05-11 15:18 - 2017-05-11 15:19 - 00000000 ____D C:\Program Files\UNP
2017-05-11 15:07 - 2017-03-03 23:26 - 00261632 _____ (Microsoft Corporation) C:\WINDOWS\system32\indexeddbserver.dll
2017-05-07 14:55 - 2017-05-07 14:55 - 04085127 _____ C:\Users\steff\Downloads\Hello Neighbor Alpha 4 Trainer v1.1.rar
2017-05-07 12:35 - 2017-05-07 12:36 - 16317046 _____ C:\Users\steff\Downloads\[1.7.10]FiveNightsAtFreddies 1.2.2Installer.jar
2017-05-07 08:03 - 2017-05-07 08:06 - 538620472 _____ C:\Users\steff\Downloads\[RePack] Full version Game - by FGrL [4,8 GB Compressed].zip
2017-05-06 18:22 - 2017-05-06 18:22 - 101447074 _____ C:\Users\steff\Downloads\New---Clash-Royale-Private-Server.apk
2017-05-06 14:01 - 2017-05-06 14:01 - 00000000 ____D C:\Users\steff\AppData\Local\RIPAciD
2017-05-06 13:58 - 2017-05-06 13:59 - 1038090240 _____ C:\Users\steff\Downloads\ARK.Survival.Evolved.v252.2.Inclu.ALL.DLC.part01.rar
2017-05-06 07:59 - 2017-05-06 07:59 - 266884985 _____ C:\Users\steff\Downloads\Hello.Neighbor.Alpha.4.part2.rar
2017-05-06 07:59 - 2017-05-06 07:59 - 266884985 _____ C:\Users\steff\Desktop\Hello.Neighbor.Alpha.4.part2.rar
2017-05-06 07:59 - 2017-05-04 17:53 - 00000000 ____D C:\Users\steff\Desktop\Hello.Neighbor.Alpha.4
2017-05-06 07:55 - 2017-05-06 07:55 - 1038090240 _____ C:\Users\steff\Downloads\Hello.Neighbor.Alpha.4.part1.rar
2017-05-06 07:55 - 2017-05-06 07:55 - 1038090240 _____ C:\Users\steff\Desktop\Hello.Neighbor.Alpha.4.part1.rar
2017-05-05 19:32 - 2017-05-07 09:28 - 00006610 _____ C:\WINDOWS\TEMPcoral.vbs
2017-04-25 00:51 - 2017-04-25 00:51 - 03471376 _____ C:\WINDOWS\SysWOW64\atiumdva.cap
2017-04-19 20:17 - 2017-04-19 20:17 - 00000000 ____D C:\Program Files (x86)\ntuserlitelist
2017-04-18 19:31 - 2017-04-18 19:31 - 00000000 ____D C:\Users\steff\AppData\Roaming\Axolot Games
2017-04-18 19:31 - 2017-04-18 19:31 - 00000000 ____D C:\Users\steff\AppData\Local\Axolot Games
2017-04-18 15:38 - 2017-04-18 15:38 - 00000222 _____ C:\Users\steff\Desktop\Scrap Mechanic.url
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2017-05-16 20:57 - 2017-04-15 18:54 - 00000000 ____D C:\Users\steff\AppData\Local\ntuserlitelist
2017-05-16 20:57 - 2016-09-18 09:57 - 00000000 ____D C:\Users\steff\AppData\Local\GameJoltClient
2017-05-16 20:53 - 2016-09-18 09:58 - 00000000 ____D C:\Users\steff\AppData\Local\game-jolt-client
2017-05-16 20:53 - 2016-06-19 20:46 - 00000000 ____D C:\Program Files (x86)\Steam
2017-05-16 20:51 - 2017-03-18 04:40 - 00524288 _____ C:\WINDOWS\system32\config\BBI
2017-05-16 20:45 - 2017-04-14 20:22 - 00000000 ____D C:\Program Files (x86)\Blizzard App
2017-05-16 20:16 - 2016-06-25 06:48 - 627327272 _____ C:\WINDOWS\MEMORY.DMP
2017-05-16 19:46 - 2017-03-18 14:03 - 00000000 ____D C:\WINDOWS\system32\NDF
2017-05-16 18:06 - 2017-01-25 02:29 - 10320248 _____ C:\WINDOWS\system32\amdvlk64.dll
2017-05-16 18:06 - 2017-01-25 02:29 - 08479104 _____ C:\WINDOWS\SysWOW64\amdvlk32.dll
2017-05-16 18:06 - 2017-01-25 02:29 - 02536320 _____ C:\WINDOWS\system32\amfrt64.dll
2017-05-16 18:06 - 2017-01-25 02:29 - 02198400 _____ C:\WINDOWS\SysWOW64\amfrt32.dll
2017-05-16 18:06 - 2017-01-25 02:29 - 01516416 _____ C:\WINDOWS\system32\atiadlxx.dll
2017-05-16 18:06 - 2017-01-25 02:29 - 01516416 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\SETE8A2.tmp
2017-05-16 18:06 - 2017-01-25 02:29 - 01516416 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\SETC763.tmp
2017-05-16 18:06 - 2017-01-25 02:29 - 01516416 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\SETACBB.tmp
2017-05-16 18:06 - 2017-01-25 02:29 - 00864120 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\amdlvr64.dll
2017-05-16 18:06 - 2017-01-25 02:29 - 00777088 _____ (AMD) C:\WINDOWS\system32\SETB92E.tmp
2017-05-16 18:06 - 2017-01-25 02:29 - 00777088 _____ (AMD) C:\WINDOWS\system32\SETA3C6.tmp
2017-05-16 18:06 - 2017-01-25 02:29 - 00777088 _____ (AMD) C:\WINDOWS\system32\SET8A9.tmp
2017-05-16 18:06 - 2017-01-25 02:29 - 00777088 _____ (AMD) C:\WINDOWS\system32\SET3E48.tmp
2017-05-16 18:06 - 2017-01-25 02:29 - 00777088 _____ (AMD) C:\WINDOWS\system32\SET3350.tmp
2017-05-16 18:06 - 2017-01-25 02:29 - 00777088 _____ (AMD) C:\WINDOWS\system32\SET1A8.tmp
2017-05-16 18:06 - 2017-01-25 02:29 - 00777088 _____ (AMD) C:\WINDOWS\system32\atieclxx.exe
2017-05-16 18:06 - 2017-01-25 02:29 - 00696192 _____ C:\WINDOWS\SysWOW64\amdlvr32.dll
2017-05-16 18:06 - 2017-01-25 02:29 - 00551808 _____ C:\WINDOWS\system32\dgtrayicon.exe
2017-05-16 18:06 - 2017-01-25 02:29 - 00551808 _____ (AMD) C:\WINDOWS\system32\SETF682.tmp
2017-05-16 18:06 - 2017-01-25 02:29 - 00551808 _____ (AMD) C:\WINDOWS\system32\SETD995.tmp
2017-05-16 18:06 - 2017-01-25 02:29 - 00551808 _____ (AMD) C:\WINDOWS\system32\SETB9AD.tmp
2017-05-16 18:06 - 2017-01-25 02:29 - 00551808 _____ (AMD) C:\WINDOWS\system32\SETA59D.tmp
2017-05-16 18:06 - 2017-01-25 02:29 - 00551808 _____ (AMD) C:\WINDOWS\system32\SET8F9.tmp
2017-05-16 18:06 - 2017-01-25 02:29 - 00551808 _____ (AMD) C:\WINDOWS\system32\SET3E98.tmp
2017-05-16 18:06 - 2017-01-25 02:29 - 00551808 _____ (AMD) C:\WINDOWS\system32\SET33DE.tmp
2017-05-16 18:06 - 2017-01-25 02:29 - 00551808 _____ (AMD) C:\WINDOWS\system32\SET2E2.tmp
2017-05-16 18:06 - 2017-01-25 02:29 - 00551808 _____ (AMD) C:\WINDOWS\system32\atiesrxx.exe
2017-05-16 18:06 - 2017-01-25 02:29 - 00531328 _____ C:\WINDOWS\system32\GameManager64.dll
2017-05-16 18:06 - 2017-01-25 02:29 - 00514424 _____ C:\WINDOWS\system32\amdgfxinfo64.dll
2017-05-16 18:06 - 2017-01-25 02:29 - 00483712 _____ C:\WINDOWS\system32\atieah64.exe
2017-05-16 18:06 - 2017-01-25 02:29 - 00467328 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atidemgy.dll
2017-05-16 18:06 - 2017-01-25 02:29 - 00411008 _____ C:\WINDOWS\system32\atiapfxx.exe
2017-05-16 18:06 - 2017-01-25 02:29 - 00365440 _____ C:\WINDOWS\SysWOW64\GameManager32.dll
2017-05-16 18:06 - 2017-01-25 02:29 - 00360312 _____ C:\WINDOWS\SysWOW64\amdgfxinfo32.dll
2017-05-16 18:06 - 2017-01-25 02:29 - 00334208 _____ C:\WINDOWS\SysWOW64\atieah32.exe
2017-05-16 18:06 - 2017-01-25 02:29 - 00278400 _____ C:\WINDOWS\system32\clinfo.exe
2017-05-16 18:06 - 2017-01-25 02:29 - 00276352 _____ C:\WINDOWS\system32\hsa-thunk64.dll
2017-05-16 18:06 - 2017-01-25 02:29 - 00245112 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atig6txx.dll
2017-05-16 18:06 - 2017-01-25 02:29 - 00242048 _____ C:\WINDOWS\SysWOW64\hsa-thunk.dll
2017-05-16 18:06 - 2017-01-25 02:29 - 00203648 _____ C:\WINDOWS\SysWOW64\atigktxx.dll
2017-05-16 18:06 - 2017-01-25 02:29 - 00191360 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\mantle64.dll
2017-05-16 18:06 - 2017-01-25 02:29 - 00169856 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\mantleaxl64.dll
2017-05-16 18:06 - 2017-01-25 02:29 - 00167808 _____ C:\WINDOWS\system32\atisamu64.dll
2017-05-16 18:06 - 2017-01-25 02:29 - 00156704 _____ C:\WINDOWS\system32\aticfx64.dll
2017-05-16 18:06 - 2017-01-25 02:29 - 00150912 _____ C:\WINDOWS\SysWOW64\mantle32.dll
2017-05-16 18:06 - 2017-01-25 02:29 - 00135040 _____ C:\WINDOWS\SysWOW64\mantleaxl32.dll
2017-05-16 18:06 - 2017-01-25 02:29 - 00122744 _____ C:\WINDOWS\system32\atimuixx.dll
2017-05-16 18:06 - 2017-01-25 02:29 - 00115072 _____ C:\WINDOWS\system32\atidxx64.dll
2017-05-16 18:06 - 2017-01-25 02:29 - 00091520 _____ C:\WINDOWS\system32\amdmcl64.dll
2017-05-16 18:06 - 2017-01-25 02:29 - 00068992 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\ati2erec.dll
2017-05-16 18:06 - 2017-01-25 02:29 - 00029048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\detoured.dll
2017-05-16 18:05 - 2017-01-25 02:28 - 00573800 _____ C:\WINDOWS\system32\amdmiracast.dll
2017-05-16 18:05 - 2017-01-25 02:28 - 00196176 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\amdhcp64.dll
2017-05-16 18:05 - 2017-01-25 02:28 - 00164400 _____ C:\WINDOWS\SysWOW64\amdhcp32.dll
2017-05-16 18:05 - 2017-01-25 02:28 - 00139080 _____ C:\WINDOWS\system32\amdave64.dll
2017-05-16 18:05 - 2017-01-25 02:28 - 00131280 _____ C:\WINDOWS\system32\atimpc64.dll
2017-05-16 18:05 - 2017-01-25 02:28 - 00131280 _____ C:\WINDOWS\system32\amdpcom64.dll
2017-05-16 15:38 - 2017-03-18 14:01 - 00000000 ____D C:\WINDOWS\INF
2017-05-16 15:37 - 2017-03-25 17:22 - 00000258 __RSH C:\ProgramData\ntuser.pol
2017-05-16 14:40 - 2017-03-18 14:03 - 00000000 ___HD C:\Program Files\WindowsApps
2017-05-16 14:40 - 2017-03-18 14:03 - 00000000 ____D C:\WINDOWS\AppReadiness
2017-05-16 14:38 - 2016-05-24 03:46 - 00000000 ____D C:\WINDOWS\system32\MRT
2017-05-15 20:17 - 2016-06-20 19:00 - 00000000 ____D C:\Users\steff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2017-05-15 20:04 - 2016-08-21 20:12 - 00000000 ____D C:\ProgramData\AMD
2017-05-14 14:55 - 2016-12-01 18:28 - 00001271 _____ C:\Users\steff\Desktop\nativelog.txt
2017-05-14 14:54 - 2016-05-25 21:20 - 00000000 ____D C:\Users\steff\AppData\Roaming\.minecraft
2017-05-14 14:42 - 2017-03-18 14:03 - 00000000 ____D C:\WINDOWS\appcompat
2017-05-13 14:50 - 2016-09-08 15:12 - 00000000 ____D C:\Users\steff\AppData\Local\ConnectedDevicesPlatform
2017-05-13 11:09 - 2017-03-18 13:51 - 00000000 ____D C:\WINDOWS\CbsTemp
2017-05-13 09:26 - 2016-05-23 22:21 - 00000000 ____D C:\Users\steff\AppData\Local\Packages
2017-05-13 09:16 - 2016-05-23 22:24 - 00002420 _____ C:\Users\steff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2017-05-13 09:16 - 2016-05-23 22:24 - 00000000 ___RD C:\Users\steff\OneDrive
2017-05-13 09:09 - 2017-03-18 14:03 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2017-05-13 09:09 - 2016-02-13 06:20 - 00000000 __RHD C:\Users\Public\AccountPictures
2017-05-12 23:42 - 2017-03-18 14:03 - 00028672 _____ C:\WINDOWS\system32\config\BCD-Template
2017-05-12 23:40 - 2017-03-18 14:06 - 00000000 ____D C:\WINDOWS\Setup
2017-05-12 23:39 - 2017-03-18 14:03 - 00000000 ___SD C:\WINDOWS\SysWOW64\F12
2017-05-12 23:39 - 2017-03-18 14:03 - 00000000 ___SD C:\WINDOWS\system32\F12
2017-05-12 23:39 - 2017-03-18 14:03 - 00000000 ____D C:\WINDOWS\SysWOW64\Dism
2017-05-12 23:39 - 2017-03-18 14:03 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2017-05-12 23:39 - 2017-03-18 14:03 - 00000000 ____D C:\WINDOWS\system32\appraiser
2017-05-12 23:39 - 2017-03-18 14:03 - 00000000 ____D C:\WINDOWS\ShellExperiences
2017-05-12 23:39 - 2017-03-18 14:03 - 00000000 ____D C:\WINDOWS\Provisioning
2017-05-12 23:39 - 2017-03-18 14:03 - 00000000 ____D C:\Program Files\Windows Photo Viewer
2017-05-12 23:39 - 2017-03-18 14:03 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2017-05-12 23:39 - 2017-03-18 04:40 - 00000000 ____D C:\WINDOWS\system32\Dism
2017-05-12 23:07 - 2017-03-18 14:03 - 00000000 ____D C:\WINDOWS\system32\WinBioDatabase
2017-05-12 23:06 - 2017-03-18 14:03 - 00000000 ____D C:\WINDOWS\rescache
2017-05-12 23:06 - 2017-03-18 14:03 - 00000000 ____D C:\WINDOWS\Registration
2017-05-12 23:04 - 2017-03-18 14:03 - 00000000 ____D C:\ProgramData\USOPrivate
2017-05-12 23:04 - 2017-03-18 14:03 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2017-05-12 23:04 - 2016-07-16 04:47 - 00000000 ____D C:\WINDOWS\system32\Tasks_Migrated
2017-05-12 23:01 - 2017-03-18 19:31 - 00000000 ____D C:\WINDOWS\HoloShell
2017-05-12 23:00 - 2016-05-30 04:05 - 00022840 _____ C:\WINDOWS\system32\emptyregdb.dat
2017-05-12 22:59 - 2017-03-18 14:03 - 00000000 __RHD C:\Users\Public\Libraries
2017-05-12 22:56 - 2016-10-21 15:36 - 00000000 ____D C:\Users\steff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FNaF 3 15 Years Later
2017-05-12 22:56 - 2016-09-24 11:48 - 00000000 ____D C:\Users\steff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Freddy Simulator 2
2017-05-12 22:56 - 2016-09-18 12:45 - 00000000 ____D C:\Users\steff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FNAF 4 sim fredbear
2017-05-12 22:56 - 2016-09-18 12:41 - 00000000 ____D C:\Users\steff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FNAF 4 sim NC
2017-05-12 22:56 - 2016-09-18 12:38 - 00000000 ____D C:\Users\steff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FNAF 4 sim NB
2017-05-12 22:56 - 2016-09-18 12:36 - 00000000 ____D C:\Users\steff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FNAF 4 sim NF
2017-05-12 22:56 - 2016-09-18 12:33 - 00000000 ____D C:\Users\steff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FNAF 4 sim Foxy
2017-05-12 22:52 - 2017-04-14 20:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Overwatch
2017-05-12 22:52 - 2017-04-14 20:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Blizzard App
2017-05-12 22:52 - 2017-03-26 17:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Plants vs Zombies GW2
2017-05-12 22:52 - 2017-03-26 17:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin
2017-05-12 22:52 - 2017-03-25 16:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-05-12 22:52 - 2017-01-16 13:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reflector 2
2017-05-12 22:52 - 2017-01-01 15:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERHOT [GOG.com]
2017-05-12 22:52 - 2016-12-15 17:13 - 00000000 ____D C:\Users\steff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2017-05-12 22:52 - 2016-12-15 17:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2017-05-12 22:52 - 2016-11-19 14:41 - 00000000 ____D C:\Users\steff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dazo
2017-05-12 22:52 - 2016-09-18 09:58 - 00000000 ____D C:\Users\steff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lucent Web Creative
2017-05-12 22:52 - 2016-09-11 11:53 - 00000000 ____D C:\Users\steff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Roblox
2017-05-12 22:52 - 2016-09-08 06:47 - 00000000 ____D C:\Users\steff\AppData\Roaming\Microsoft\Windows\Start Menu\Nox
2017-05-12 22:52 - 2016-09-07 15:53 - 00000000 ____D C:\Users\steff\AppData\Roaming\Microsoft\Windows\Start Menu\夜神模拟器
2017-05-12 22:52 - 2016-06-19 20:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2017-05-12 22:52 - 2016-06-04 09:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2017-05-12 22:52 - 2016-05-25 21:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2017-05-12 22:52 - 2016-05-25 21:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Minecraft
2017-05-12 22:50 - 2017-03-18 14:03 - 00000000 ____D C:\WINDOWS\SysWOW64\GroupPolicy
2017-05-12 22:50 - 2017-03-18 14:03 - 00000000 ____D C:\WINDOWS\system32\spool
2017-05-12 22:50 - 2017-03-18 14:03 - 00000000 ____D C:\WINDOWS\system32\oobe
2017-05-12 22:50 - 2016-10-30 11:04 - 00000000 ____D C:\WINDOWS\system32\ÿÿÿÿÿÿÿÿ8
2017-05-12 22:49 - 2017-03-29 17:52 - 00000000 ____D C:\WINDOWS\system32\460fad785549d11978cd05..bin
2017-05-12 22:49 - 2017-03-18 14:03 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2017-05-12 22:49 - 2017-03-18 14:03 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2017-05-12 22:49 - 2017-01-09 21:02 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bandicam
2017-05-12 22:49 - 2015-07-10 04:04 - 00000000 ___HD C:\WINDOWS\system32\GroupPolicy
2017-05-12 22:45 - 2017-03-18 04:40 - 00000000 ____D C:\WINDOWS\system32\Sysprep
2017-05-12 22:45 - 2016-08-12 10:24 - 00000000 ____D C:\AMD
2017-05-12 22:12 - 2017-03-18 20:20 - 00000000 ___HD C:\$WINDOWS.~BT
2017-05-11 15:21 - 2017-03-25 18:56 - 00001298 _____ C:\Users\steff\Desktop\Google Chrome.lnk
2017-05-11 15:19 - 2016-05-24 03:46 - 156335152 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2017-05-07 13:36 - 2017-03-25 20:08 - 00001249 _____ C:\WINDOWS\SysWOW64\nativelog.txt
2017-05-07 09:13 - 2017-03-26 17:14 - 00000000 ____D C:\ProgramData\Origin
2017-05-07 07:39 - 2017-03-26 17:16 - 00000000 ____D C:\Users\steff\AppData\Roaming\Origin
2017-05-06 18:28 - 2016-09-07 15:52 - 00000000 ____D C:\Users\steff\AppData\Local\Nox
2017-05-06 18:27 - 2016-09-07 16:02 - 00000000 ____D C:\Users\steff\.android
2017-05-06 18:26 - 2016-09-07 15:53 - 00000000 ____D C:\Users\steff\vmlogs
2017-05-06 18:26 - 2016-09-07 15:53 - 00000000 ____D C:\Users\steff\.BigNox
2017-05-06 12:50 - 2016-10-16 15:22 - 00000000 ____D C:\Users\steff\AppData\Local\UnrealEngine
2017-05-05 18:05 - 2017-04-14 20:22 - 00000000 ____D C:\Users\steff\AppData\Local\Battle.net
2017-05-05 17:43 - 2016-05-25 21:20 - 00000000 ____D C:\Program Files (x86)\Minecraft
2017-04-29 17:10 - 2017-04-14 20:40 - 00000000 ____D C:\Program Files (x86)\Overwatch
2017-04-28 18:05 - 2017-03-18 14:06 - 00835576 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2017-04-28 18:05 - 2017-03-18 14:06 - 00177656 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2017-04-25 16:36 - 2017-03-22 15:47 - 00000000 ____D C:\Users\steff\AppData\Local\ElevatedDiagnostics
2017-04-25 01:06 - 2016-11-21 17:55 - 00795616 _____ C:\WINDOWS\SysWOW64\atiapfxx.blb
2017-04-25 01:06 - 2016-11-21 17:55 - 00795616 _____ C:\WINDOWS\system32\atiapfxx.blb
2017-04-25 00:56 - 2016-11-21 17:50 - 03437632 _____ C:\WINDOWS\system32\atiumd6a.cap
2017-04-23 17:16 - 2017-03-26 17:15 - 00000000 ____D C:\Program Files (x86)\Origin
2017-04-23 15:47 - 2017-03-25 16:35 - 00251832 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2017-04-17 10:00 - 2017-04-15 18:55 - 00000000 ____D C:\Users\steff\AppData\Local\llssoft
2017-04-16 07:52 - 2016-09-16 04:55 - 00000000 ____D C:\Users\steff\Desktop\Ravenfield
 
==================== Files in the root of some directories =======
 
2017-01-20 18:24 - 2017-01-20 18:24 - 0140288 _____ () C:\Users\steff\AppData\Roaming\Installer.dat
2017-01-20 18:25 - 2017-01-20 18:26 - 0018432 _____ () C:\Users\steff\AppData\Roaming\Main.dat
2016-05-27 22:05 - 2017-01-03 17:01 - 0000236 _____ () C:\Users\steff\AppData\Roaming\WB.CFG
2016-09-08 07:48 - 2016-09-08 07:48 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
 
==================== Bamital & volsnap ======================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
 
LastRegBack: 2017-05-12 22:43
 
==================== End of FRST.txt ============================
 
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 14-05-2017
Ran by Michael (16-05-2017 20:58:06)
Running from C:\Users\steff\Desktop
Windows 10 Home Version 1703 (X64) (2017-05-13 06:08:06)
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-2892662990-3918576701-1327745688-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-2892662990-3918576701-1327745688-503 - Limited - Disabled)
Guest (S-1-5-21-2892662990-3918576701-1327745688-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2892662990-3918576701-1327745688-1004 - Limited - Enabled)
Michael (S-1-5-21-2892662990-3918576701-1327745688-1002 - Administrator - Enabled) => C:\Users\steff
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
µTorrent (HKU\S-1-5-21-2892662990-3918576701-1327745688-1002\...\uTorrent) (Version: 3.4.9.42973 - BitTorrent Inc.)
Amazing Frog? (HKLM\...\Steam App 332570) (Version:  - Fayju)
AMD Install Manager (HKLM\...\AMD Catalyst Install Manager) (Version: 5.00 - Advanced Micro Devices, Inc.)
AMD Radeon Settings (HKLM\...\WUCCCApp) (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.)
Apple Application Support (32-bit) (HKLM-x32\...\{26356515-5821-40FA-9C3D-9785052A1062}) (Version: 4.3.1 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{C2651553-6CA3-4822-B2E6-BC4ACA6E0EA2}) (Version: 4.3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{2E4AF2A6-50EA-4260-9BA4-5E582D11879A}) (Version: 9.3.0.15 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)
Bandicam (HKLM-x32\...\Bandicam) (Version: 3.3.0.1175 - Bandisoft.com)
Bandisoft MPEG-1 Decoder (HKLM-x32\...\BandiMPEG1) (Version:  - Bandisoft.com)
Blizzard App (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
CASE: Animatronics (HKLM\...\Steam App 489360) (Version:  - Last Level)
Catalyst Control Center Next Localization BR (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization BR (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization BR (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHS (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHS (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHS (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHT (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHT (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHT (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CS (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CS (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CS (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DA (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DA (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DA (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DE (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DE (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DE (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization EL (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization EL (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization EL (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization ES (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization ES (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization ES (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FI (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FI (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FI (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FR (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FR (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FR (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization HU (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization HU (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization HU (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization IT (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization IT (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization IT (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization JA (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization JA (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization JA (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization KO (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization KO (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization KO (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NL (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NL (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NL (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NO (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NO (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NO (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization PL (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization PL (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization PL (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization RU (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization RU (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization RU (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization SV (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization SV (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization SV (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TH (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TH (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TH (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TR (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TR (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TR (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Dota 2 (HKLM\...\Steam App 570) (Version:  - Valve)
Feed and Grow: Fish (HKLM\...\Steam App 429050) (Version:  - Old B1ood)
Five Nights at Freddy's (HKLM\...\Steam App 319510) (Version:  - Scott Cawthon)
Five Nights at Freddy's 2 (HKLM\...\Steam App 332800) (Version:  - Scott Cawthon)
Five Nights at Freddy's 3 (HKLM\...\Steam App 354140) (Version:  - Scott Cawthon)
Five Nights at Freddy's 4 (HKLM\...\Steam App 388090) (Version:  - Scott Cawthon)
Five Nights at Freddy's: Sister Location (HKLM\...\Steam App 506610) (Version:  - Scott Cawthon)
FNaF 3 15 Years Later (HKU\S-1-5-21-2892662990-3918576701-1327745688-1002\...\FNaF 3 15 Years Later) (Version:  - )
FNAF 4 sim Foxy (HKU\S-1-5-21-2892662990-3918576701-1327745688-1002\...\FNAF 4 sim Foxy) (Version:  - )
FNAF 4 sim fredbear (HKU\S-1-5-21-2892662990-3918576701-1327745688-1002\...\FNAF 4 sim fredbear) (Version:  - )
FNAF 4 sim NB (HKU\S-1-5-21-2892662990-3918576701-1327745688-1002\...\FNAF 4 sim NB) (Version:  - )
FNAF 4 sim NC (HKU\S-1-5-21-2892662990-3918576701-1327745688-1002\...\FNAF 4 sim NC) (Version:  - )
FNAF 4 sim NF (HKU\S-1-5-21-2892662990-3918576701-1327745688-1002\...\FNAF 4 sim NF) (Version:  - )
Freddy Simulator 2 (HKU\S-1-5-21-2892662990-3918576701-1327745688-1002\...\Freddy Simulator 2) (Version:  - )
Game Jolt Client version 0.8.2 (HKU\S-1-5-21-2892662990-3918576701-1327745688-1002\...\game-jolt-client_is1) (Version: 0.8.2 - Lucen Web Creative, LLC)
Garry's Mod (HKLM\...\Steam App 4000) (Version:  - Facepunch Studios)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 57.0.2987.133 - Google Inc.)
Google Update Helper (x32 Version: 1.3.33.3 - Google Inc.) Hidden
Itibiti RTC (x32 Version: 0.0.1 - Itibiti Inc) Hidden <==== ATTENTION
iTunes (HKLM\...\{9F4BF859-C3A4-4AB6-BDD1-9C5D58188598}) (Version: 12.4.1.6 - Apple Inc.)
Java 8 Update 91 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218091F0}) (Version: 8.0.910.14 - Oracle Corporation)
Marvel Heroes 2016 (HKLM\...\Steam App 226320) (Version:  - Gazillion Entertainment)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4693.1005 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-2892662990-3918576701-1327745688-1002\...\OneDriveSetup.exe) (Version: 17.3.6816.0313 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 (HKLM-x32\...\{d992c12e-cab2-426f-bde3-fb8c53950b0d}) (Version: 14.0.24215.1 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
Minecraft (HKLM-x32\...\{1C16BCA3-EBC1-49F6-8623-8FBFB9CCC872}) (Version: 1.0.3.0 - Mojang)
Mortal Kombat X (HKLM\...\Steam App 307780) (Version:  - NetherRealm Studios)
Mr.President! (HKLM\...\Steam App 507010) (Version:  - Game Developer X)
Nox APP Player (HKLM-x32\...\Nox) (Version: 3.7.1.0 - Duodian Technology Co. Ltd.)
NVIDIA PhysX (HKLM-x32\...\{80407BA7-7763-4395-AB98-5233F1B34E65}) (Version: 9.13.1220 - NVIDIA Corporation)
Origin (HKLM-x32\...\Origin) (Version: 10.4.9.38188 - Electronic Arts, Inc.)
Overwatch (HKLM-x32\...\Overwatch) (Version:  - Blizzard Entertainment)
Paint the Town Red (HKLM\...\Steam App 337320) (Version:  - South East Games)
paint.net (HKLM\...\{A1D05314-DC32-4668-A97E-51060EC8BCCE}) (Version: 4.0.12 - dotPDN LLC)
PaintTool SAI Ver.1 (HKLM-x32\...\PaintToolSAI) (Version:  - )
Plants vs Zombies GW2 (HKLM-x32\...\{C4F00C98-13B4-4313-8152-50EE0B04ABE2}) (Version: 1.0.7.0 - Electronic Arts)
Plants vs. Zombies: Game of the Year (HKLM\...\Steam App 3590) (Version:  - PopCap Games, Inc.)
Please, Don’t Touch Anything (HKLM\...\Steam App 354240) (Version:  - Four Quarters)
Primal Carnage (HKLM\...\Steam App 215470) (Version:  - Lukewarm Media)
Reflector 2 (HKLM\...\{B78C26E0-35DE-4A78-8F96-8A71EDA23ED7}) (Version: 2.6.1.0 - Squirrels)
ROBLOX Player for Michael (HKU\S-1-5-21-2892662990-3918576701-1327745688-1002\...\{373B1718-8CC5-4567-8EE2-9033AD08A680}) (Version:  - ROBLOX Corporation)
Robocraft (HKLM\...\Steam App 301520) (Version:  - Freejam)
Rome: Total War (HKLM\...\Steam App 4760) (Version:  - The Creative Assembly)
Scrap Mechanic (HKLM\...\Steam App 387990) (Version:  - Axolot Games)
Scribblenauts Unlimited (HKLM\...\Steam App 218680) (Version:  - 5th Cell Media)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Stranded Deep (HKLM\...\Steam App 313120) (Version:  - Beam Team Games)
SUPERHOT (HKLM-x32\...\1456141688_is1) (Version: 2.0.0.4 - GOG.com)
Surgeon Simulator (HKLM\...\Steam App 233720) (Version:  - Bossa Studios)
Tasty Blue (HKLM\...\Steam App 345200) (Version:  - Dingo Games)
Team Fortress 2 (HKLM\...\Steam App 440) (Version:  - Valve)
Totally Accurate Battle Simulator version 0.3.6 (HKLM-x32\...\{8670953D-FB1B-4365-B71A-A9560F37E1ED}_is1) (Version: 0.3.6 - Landfall)
Trove (HKLM\...\Steam App 304050) (Version:  - Trion Worlds)
TroveTools .NET (HKU\S-1-5-21-2892662990-3918576701-1327745688-1002\...\0ad522f4516a2a4e) (Version: 1.2.0.4 - Dazo)
Unturned (HKLM\...\Steam App 304930) (Version:  - Smartly Dressed Games)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.4 - VideoLAN)
Windows 10 Update and Privacy Settings (HKLM\...\{293F2009-0145-450B-B4AA-063D43FB368C}) (Version: 1.0.13.0 - Microsoft Corporation)
Windows Driver Package - BigNox Corporation (VBoxUSB) USB  (09/16/2015 4.3.12) (HKLM\...\76B144D15273552931249392EDB13C0BBD52C84E) (Version: 09/16/2015 4.3.12 - BigNox Corporation)
Windows Driver Package - BigNox Corporation VBoxUSBMon System  (09/16/2015 4.3.12) (HKLM\...\39F54A37125643D2E1E90FA7D81F36ACC9441510) (Version: 09/16/2015 4.3.12 - BigNox Corporation)
Windows Driver Package - BigNox Corporation XQHDrv System  (09/16/2015 4.3.12) (HKLM\...\0147813640F7AF69F569581EE672B6BE1E71798E) (Version: 09/16/2015 4.3.12 - BigNox Corporation)
WinRAR 5.40 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH)
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
CustomCLSID: HKU\S-1-5-21-2892662990-3918576701-1327745688-1002_Classes\CLSID\{DEE03C2B-0C0C-41A9-9877-FD4B4D7B6EA3}\InprocServer32 -> C:\Users\steff\AppData\Local\Roblox\Versions\version-398bf2b17c844b38\RobloxProxy64.dll (ROBLOX Corporation)
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {0790FEF7-8B50-403D-B258-9C4D940A46A5} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_ERROR_HB => C:\Windows\System32\MRT.exe [2017-05-11] (Microsoft Corporation)
Task: {906DAB9C-EC7E-40FA-BD52-7D10CA804CF3} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 
Task: {B8F2D538-7EB3-4CFC-920D-033FB83B0AA0} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 
Task: {E13704D0-6911-4878-912D-938BCF4B630A} - System32\Tasks\{2CC1EE75-9B6A-59DE-40DD-5E1581EAAB6D} => C:\ProgramData\{9C149D8B-2BBF-2A20-592B-A64A5E6428D7}\239FBED4-9434-097F-C4C3-80E98A2D7BFC.exe  <==== ATTENTION
Task: {EAA83325-1D19-46A1-BB2D-866CF9655686} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
 
==================== Shortcuts =============================
 
(The entries could be listed to be restored or removed.)
 
==================== Loaded Modules (Whitelisted) ==============
 
2016-04-22 01:07 - 2016-04-22 01:07 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2016-04-22 01:07 - 2016-04-22 01:07 - 01337144 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2016-03-19 04:30 - 2014-07-22 18:59 - 01360016 _____ () C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.22\AsSysCtrlService.exe
2016-03-19 04:30 - 2014-07-22 18:59 - 00936728 _____ () C:\Program Files (x86)\ASUS\AXSP\1.02.00\atkexComSvc.exe
2017-01-05 17:36 - 2017-01-05 17:36 - 00077824 _____ () C:\Users\steff\AppData\Local\ntuserlitelist\dataup\dataup.exe
2017-03-29 19:04 - 2017-03-29 19:04 - 00833024 ____N () C:\windows\system32\tprdpw32.exe
2017-03-18 13:58 - 2017-03-18 13:58 - 00138000 _____ () C:\WINDOWS\SYSTEM32\inputhost.dll
2017-03-18 13:59 - 2017-03-18 19:31 - 01731072 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-05-08 20:03 - 2017-05-08 20:03 - 00074752 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.15.597.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2017-05-08 20:03 - 2017-05-08 20:03 - 00201728 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.15.597.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2017-05-08 20:03 - 2017-05-08 20:03 - 43195904 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.15.597.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2017-05-08 20:03 - 2017-05-08 20:03 - 02457088 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.15.597.0_x64__kzf8qxf38zg5c\skypert.dll
2016-09-18 09:57 - 2016-08-25 10:58 - 46705152 _____ () C:\Users\steff\AppData\Local\GameJoltClient\GameJoltClient.exe
2017-04-04 15:12 - 2017-03-29 01:47 - 02885464 _____ () C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\libglesv2.dll
2017-04-04 15:12 - 2017-03-29 01:47 - 00099672 _____ () C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\libegl.dll
2017-05-11 14:52 - 2017-05-01 12:59 - 31118328 _____ () C:\Users\steff\AppData\Local\Google\Chrome\User Data\PepperFlash\25.0.0.171\pepflashplayer.dll
2016-11-21 17:19 - 2016-11-21 17:19 - 00155016 _____ () C:\Program Files\ATI Technologies\ATI.ACE\A4\AdaptiveSleepService.exe
2016-03-19 04:30 - 2014-07-22 18:59 - 00104448 _____ () C:\Program Files (x86)\ASUS\AXSP\1.02.00\ATKEX.dll
2016-09-21 23:32 - 2016-09-21 23:32 - 00224768 _____ () C:\Users\steff\AppData\Local\ntuserlitelist\dataup\help_dll.dll
2017-03-26 17:16 - 2017-04-17 14:25 - 02493440 _____ () C:\Program Files (x86)\Origin\libGLESv2.dll
2016-06-19 20:46 - 2017-03-09 17:13 - 00674592 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2016-06-19 20:46 - 2017-04-25 16:55 - 02465056 _____ () C:\Program Files (x86)\Steam\video.dll
2016-06-19 20:46 - 2016-08-31 18:02 - 04969248 _____ () C:\Program Files (x86)\Steam\v8.dll
2016-06-19 20:46 - 2016-01-27 00:49 - 00491008 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll
2016-06-19 20:46 - 2016-01-27 00:49 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll
2016-06-19 20:46 - 2016-01-27 00:49 - 02549760 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll
2016-06-19 20:46 - 2016-01-27 00:49 - 00442880 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll
2016-06-19 20:46 - 2016-01-27 00:49 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll
2016-06-19 20:46 - 2016-08-31 18:02 - 01195296 _____ () C:\Program Files (x86)\Steam\icuuc.dll
2016-06-19 20:46 - 2016-08-31 18:02 - 01563936 _____ () C:\Program Files (x86)\Steam\icui18n.dll
2016-06-19 20:46 - 2017-04-25 16:55 - 00848672 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2016-06-19 20:46 - 2016-07-04 15:17 - 00266560 _____ () C:\Program Files (x86)\Steam\openvr_api.dll
2016-09-18 09:58 - 2016-08-25 10:58 - 01481728 _____ () C:\Users\steff\AppData\Local\GameJoltClient\libglesv2.dll
2016-09-18 09:58 - 2016-08-25 10:58 - 00073728 _____ () C:\Users\steff\AppData\Local\GameJoltClient\libegl.dll
2017-04-14 19:43 - 2017-04-14 19:43 - 00062976 _____ () C:\Users\steff\AppData\Local\GameJoltClient\node_modules\windows-mutex\build\Release\CreateMutex.node
2016-12-12 21:44 - 2017-01-30 14:41 - 68875552 _____ () C:\Program Files (x86)\Steam\bin\cef\cef.win7\libcef.dll
2016-06-19 20:46 - 2017-04-25 16:55 - 00383776 _____ () C:\Program Files (x86)\Steam\steam.dll
2017-01-13 20:09 - 2017-01-13 20:09 - 00896512 _____ () C:\Users\steff\AppData\Local\ntuserlitelist\svcvmx\svcvmx.exe
2017-01-20 20:18 - 2017-01-20 20:18 - 01087488 _____ () C:\Users\steff\AppData\Local\ntuserlitelist\svcvmx\vmxclient.exe
2017-01-14 19:40 - 2017-01-14 19:40 - 53460992 _____ () C:\Users\steff\AppData\Local\ntuserlitelist\svcvmx\libcef.dll
2016-05-31 11:43 - 2016-05-31 11:43 - 01976832 _____ () C:\Users\steff\AppData\Local\ntuserlitelist\svcvmx\libglesv2.dll
2016-05-31 11:44 - 2016-05-31 11:44 - 00075264 _____ () C:\Users\steff\AppData\Local\ntuserlitelist\svcvmx\libEGL.dll
2016-06-15 17:15 - 2016-06-15 17:15 - 17599640 _____ () C:\Users\steff\AppData\Local\ntuserlitelist\svcvmx\pepflashplayer.dll
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 
==================== Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
IE trusted site: HKU\S-1-5-21-2892662990-3918576701-1327745688-1002\...\localhost -> localhost
IE trusted site: HKU\S-1-5-21-2892662990-3918576701-1327745688-1002\...\webcompanion.com -> hxxp://webcompanion.com
 
==================== Hosts content: ==========================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2015-07-10 04:04 - 2017-03-25 17:02 - 00001484 _____ C:\WINDOWS\system32\Drivers\etc\hosts
 
127.0.0.1       down.baidu2016.com
127.0.0.1       123.sogou.com
127.0.0.1       www.czzsyzgm.com
127.0.0.1       www.czzsyzxl.com
127.0.0.1       union.baidu2019.com
127.0.0.1       down.baidu2016.com
127.0.0.1       123.sogou.com
127.0.0.1       www.czzsyzgm.com
127.0.0.1       www.czzsyzxl.com
127.0.0.1       union.baidu2019.com
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-2892662990-3918576701-1327745688-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\steff\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\nightmare_jumpscare_by_crazyrave198-d939qnt.png
DNS Servers: 68.105.28.11 - 68.105.29.11
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [{E7F71E9F-0CA9-42BC-A073-0B6420638D2D}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{5042A57E-4A48-4716-9674-571CD5EE10E0}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{DCE9AC99-D01F-4B70-807B-176074F4936C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{2696B331-34BC-475D-8E6B-92891D86E579}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{619A2191-22FF-4E6B-843D-ADC90F87B28A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{8871C39C-ED1C-4F8F-B4B3-C04BD2ACFEBC}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{AA68D4EA-16E0-4733-A270-1852A32F851E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{9046DD82-9F97-4BD1-ACF3-9C5A3881A220}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{B781BF3C-BFC5-4C1F-905E-C876045D8C29}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{AFB221F6-F383-429A-AEC3-F0198D74D153}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{BDB9AEBF-48A7-444C-A262-B31CDD412F86}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{49B154B5-9856-4DED-9FAA-EEA844D62264}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{F92C1A4D-EC95-4D53-AB9C-46CE0B836568}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{0FE9769E-4E5A-467C-B325-6D3D9DFBE41A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{4043DAE5-AC17-4C59-B095-C39D5678712A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{EFE7B013-5B99-490F-8A04-88252931F1DA}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{0ED34EEE-2F74-4B11-BE1B-D8E2BF51E70F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{33DAD85F-899C-4304-84F3-F6C9C1CA73D1}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{89D48F82-2A07-4E63-AB19-170B4E9CB102}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{29E7B827-1056-4763-9B88-0E5A03E8C2E5}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{C2AB3FF1-BECC-4A93-AAF5-9B58D8DABD00}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{0E736466-8254-43EC-8644-52525E22FA2E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{DEA35C20-71A6-4C0A-A6F0-F139DCE0C8F9}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{A51F09E4-36B9-479B-9D5F-826C3E1477E0}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{EAC0908E-2B34-4197-A961-E1DA5AF17593}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{6E500BCB-AB5A-4309-850D-99D4C5A9F008}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{97921878-923E-45C3-A53E-39ABB39053F4}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Scrap Mechanic\Release\ScrapMechanic.exe
FirewallRules: [{0B1DD15D-60B3-4257-BB7D-78C223BBBAB5}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Scrap Mechanic\Release\ScrapMechanic.exe
FirewallRules: [UDP Query User{2D3329A2-C97A-4815-B645-6D55F595329C}C:\program files (x86)\overwatch\overwatch.exe] => (Block) C:\program files (x86)\overwatch\overwatch.exe
FirewallRules: [TCP Query User{68A9B5F7-2606-417E-972C-71583CBF8BF3}C:\program files (x86)\overwatch\overwatch.exe] => (Block) C:\program files (x86)\overwatch\overwatch.exe
FirewallRules: [{CF581659-2367-4E05-A433-F0566B13426F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{7EEB8F62-9578-4DDD-B485-3A1516EB8AF3}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{E62159D8-E2E0-4811-BDE9-FBA5E9C323E5}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{B9720EAC-2A1B-4C71-A290-5EF7E71F08AE}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [UDP Query User{B3F20FA0-92E4-44C1-B043-C6D4EE1057C5}C:\users\steff\desktop\astroneer.v0.2.10131.0\astro\binaries\win64\astro-win64-shipping.exe] => (Allow) C:\users\steff\desktop\astroneer.v0.2.10131.0\astro\binaries\win64\astro-win64-shipping.exe
FirewallRules: [TCP Query User{169FA5A4-A794-4972-9C4A-71B241B2A912}C:\users\steff\desktop\astroneer.v0.2.10131.0\astro\binaries\win64\astro-win64-shipping.exe] => (Allow) C:\users\steff\desktop\astroneer.v0.2.10131.0\astro\binaries\win64\astro-win64-shipping.exe
FirewallRules: [{F72FA785-ACD5-4D7A-A15C-3D8DA3EE5DA0}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{35C97F16-5FE4-4CE2-9247-80B42228D3E4}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [UDP Query User{357D00E8-3D6F-4644-9013-CA625BD38D8B}C:\users\steff\desktop\sword.with.sauce.alpha.v1.4.0\swordwithsauce1_4\binaries\win64\swordwithsauce1_4-win64-shipping.exe] => (Block) C:\users\steff\desktop\sword.with.sauce.alpha.v1.4.0\swordwithsauce1_4\binaries\win64\swordwithsauce1_4-win64-shipping.exe
FirewallRules: [TCP Query User{5B618CF6-3D18-4F59-9901-14CE67CBFBA9}C:\users\steff\desktop\sword.with.sauce.alpha.v1.4.0\swordwithsauce1_4\binaries\win64\swordwithsauce1_4-win64-shipping.exe] => (Block) C:\users\steff\desktop\sword.with.sauce.alpha.v1.4.0\swordwithsauce1_4\binaries\win64\swordwithsauce1_4-win64-shipping.exe
FirewallRules: [{C5D9DFEC-EE9E-4EFC-8639-AB1EA210AE34}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{E97FCA1E-22D5-42B9-B1EF-515AFEF9E275}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{CDD4A39D-4177-43E4-9253-9EE084236D5A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2cfg.exe
FirewallRules: [{4716DE90-8ADB-4190-B245-6B60B7C0595E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2cfg.exe
FirewallRules: [{90883E47-C6BC-449E-87B3-3797A5BCA5DE}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{9157D884-8091-4A68-98A8-8BCAD0063B63}] => (Allow) C:\Program Files (x86)\Origin Games\Plants vs Zombies Garden Warfare 2\GW2.Trial_Win64_Retail.exe
FirewallRules: [{6D7A1A35-2284-4EF9-8CC6-CE75563BE592}] => (Allow) C:\Program Files (x86)\Origin Games\Plants vs Zombies Garden Warfare 2\GW2.Trial_Win64_Retail.exe
FirewallRules: [{033E63D3-BCAB-47EE-9E46-627A436DBE2A}] => (Allow) C:\Program Files (x86)\Origin Games\Plants vs Zombies Garden Warfare 2\GW2.Main_Win64_Retail.exe
FirewallRules: [{D06D4491-6BB0-4B68-9067-69E17FBB956B}] => (Allow) C:\Program Files (x86)\Origin Games\Plants vs Zombies Garden Warfare 2\GW2.Main_Win64_Retail.exe
FirewallRules: [{45FF8717-87CD-4E11-9623-35EE98D7B790}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Scribblenauts\Scribble.exe
FirewallRules: [{D92C82D0-00E8-4155-86CA-16202C7EA6F6}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Scribblenauts\Scribble.exe
FirewallRules: [{7263EAF5-C804-40EB-8574-FFF9003CC304}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Plants Vs Zombies\PlantsVsZombies.exe
FirewallRules: [{7EE7191F-0E38-47F9-843D-8930F22C11D9}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Plants Vs Zombies\PlantsVsZombies.exe
FirewallRules: [{806B206E-AD97-4722-8F13-269FBD89370D}] => (Allow) C:\Program Files (x86)\Interviewing\laotians.exe
FirewallRules: [{070AD5E3-81DC-4AE2-A4E3-ADB75615EAC1}] => (Allow) C:\Program Files (x86)\Aegis\laotians.exe
FirewallRules: [{9D6A9008-6192-4A0B-9346-7FD586DA08C9}] => (Allow) C:\WINDOWS\system32\rundll32.exe
FirewallRules: [{EADB24FD-E789-4338-B4CA-0218CF13C63B}] => (Allow) C:\Program Files\Reflector 2\Reflector2.exe
FirewallRules: [UDP Query User{2636B0AD-4285-4097-A36E-243B7CB13645}C:\users\steff\desktop\the aftermath.exe] => (Allow) C:\users\steff\desktop\the aftermath.exe
FirewallRules: [TCP Query User{431E5032-2472-4A0A-9749-13FA5B7EAABD}C:\users\steff\desktop\the aftermath.exe] => (Allow) C:\users\steff\desktop\the aftermath.exe
FirewallRules: [{16BF744A-8750-4554-80E5-3B79D1C04AEC}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Rome Total War Gold\RomeTW-BI.exe
FirewallRules: [{265AE06E-CA75-43A6-A14E-652918CB077E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Rome Total War Gold\RomeTW-BI.exe
FirewallRules: [{E7ED5284-BF13-4ECF-A4D0-F2BAB23F1743}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Rome Total War Gold\RomeTW.exe
FirewallRules: [{E534237C-9ACF-43A8-A0F1-95004F7291B1}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Rome Total War Gold\RomeTW.exe
FirewallRules: [{66F9A14D-1451-40FE-B7A5-7A2F9C21AF35}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Stranded Deep\Stranded_Deep_x64.exe
FirewallRules: [{83E3A389-3241-4A1F-BD28-DE98E42C93D6}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Stranded Deep\Stranded_Deep_x64.exe
FirewallRules: [UDP Query User{2EFBFC59-86C6-4DC4-B3A8-B1D157F46DAD}C:\users\steff\desktop\hello.neighbor.alpha.2\helloneighborreborn\binaries\win64\helloneighborreborn.exe] => (Allow) C:\users\steff\desktop\hello.neighbor.alpha.2\helloneighborreborn\binaries\win64\helloneighborreborn.exe
FirewallRules: [TCP Query User{21FBA324-EB3B-40FA-981E-38EE955BBCF4}C:\users\steff\desktop\hello.neighbor.alpha.2\helloneighborreborn\binaries\win64\helloneighborreborn.exe] => (Allow) C:\users\steff\desktop\hello.neighbor.alpha.2\helloneighborreborn\binaries\win64\helloneighborreborn.exe
FirewallRules: [{2306B175-FE15-4389-967F-98E3F41ED143}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Unturned\Unturned.exe
FirewallRules: [{292B9A98-E755-4F83-95DF-69CEFFB027E9}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Unturned\Unturned.exe
FirewallRules: [{6E1BDD6F-D4CC-461D-8F8E-EC519D98AB4B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Unturned\Unturned_BE.exe
FirewallRules: [{816293A7-4110-41C1-833A-CC7633851CEB}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Unturned\Unturned_BE.exe
FirewallRules: [{76EA0E39-8ECD-41B4-8468-2657BD450D4D}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{ABB44AD4-83FF-4148-A3EA-6FF686CEA9D3}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{E1D4E955-C58B-416E-93E1-4E724C3ABFF2}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Please, Don’t Touch Anything\DontTouchAnything.exe
FirewallRules: [{4FCA1A44-52CE-435B-B4C0-E9CE3D89D8D4}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Please, Don’t Touch Anything\DontTouchAnything.exe
FirewallRules: [UDP Query User{924E9EF9-0338-47F5-AB84-6B95CD0BCF57}C:\users\steff\downloads\helloneighbor_pre_alpha_-_play_at_your_own_risk\helloneighbor\helloneighbour\binaries\win64\helloneighbour-win64-shipping.exe] => (Allow) C:\users\steff\downloads\helloneighbor_pre_alpha_-_play_at_your_own_risk\helloneighbor\helloneighbour\binaries\win64\helloneighbour-win64-shipping.exe
FirewallRules: [TCP Query User{6FBAD1A9-7D3A-4693-8853-8DCE7B911601}C:\users\steff\downloads\helloneighbor_pre_alpha_-_play_at_your_own_risk\helloneighbor\helloneighbour\binaries\win64\helloneighbour-win64-shipping.exe] => (Allow) C:\users\steff\downloads\helloneighbor_pre_alpha_-_play_at_your_own_risk\helloneighbor\helloneighbour\binaries\win64\helloneighbour-win64-shipping.exe
FirewallRules: [{D4144AD4-13BB-446D-B42C-2C443D32A1E7}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Tasty Blue\tastyblue.exe
FirewallRules: [{D95C008A-241A-4145-BE63-AA90C4FCA34A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Tasty Blue\tastyblue.exe
FirewallRules: [{4E6AF700-8E44-4C03-9A7C-E97998647B2E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Mr.President!\Mr.Prez.exe
FirewallRules: [{5989DC92-7813-430F-A6D0-86CFF7DE9A37}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Mr.President!\Mr.Prez.exe
FirewallRules: [{8778008F-61CD-47F4-AA50-F0522DA80B45}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\primal_carnage\Binaries\Win32\PrimalCarnageGame.exe
FirewallRules: [{DD72B165-D1E5-4FE4-B7A4-FF352C4BB587}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\primal_carnage\Binaries\Win32\PrimalCarnageGame.exe
FirewallRules: [{3E742FCC-6B6C-47CD-B339-4B7B2417EA10}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\CASE Animatronics\case.exe
FirewallRules: [{6B38A9DF-9A63-4569-96E4-CC39F897E94F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\CASE Animatronics\case.exe
FirewallRules: [{689A139E-0FFB-4093-80D0-ED58E4D11177}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Surgeon Simulator 2013\ss2013.exe
FirewallRules: [{A0DF0B3F-8B0B-4039-807F-3F225985B76B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Surgeon Simulator 2013\ss2013.exe
FirewallRules: [UDP Query User{BBA6700C-4CEB-4BD2-9B48-34EA171A19D2}C:\users\steff\appdata\local\game-jolt-client\games\those-nights-at-rachel-s-114026\default-193365\those nights at rachel's\windowsnoeditor\engine\binaries\win64\ue4game-win64-shipping.exe] => (Allow) C:\users\steff\appdata\local\game-jolt-client\games\those-nights-at-rachel-s-114026\default-193365\those nights at rachel's\windowsnoeditor\engine\binaries\win64\ue4game-win64-shipping.exe
FirewallRules: [TCP Query User{60F82C2F-CBC4-4049-AC8A-071C116EC7AF}C:\users\steff\appdata\local\game-jolt-client\games\those-nights-at-rachel-s-114026\default-193365\those nights at rachel's\windowsnoeditor\engine\binaries\win64\ue4game-win64-shipping.exe] => (Allow) C:\users\steff\appdata\local\game-jolt-client\games\those-nights-at-rachel-s-114026\default-193365\those nights at rachel's\windowsnoeditor\engine\binaries\win64\ue4game-win64-shipping.exe
FirewallRules: [UDP Query User{EEEDD44C-20F5-4B0B-9CE3-AB190BC3ED97}C:\users\steff\appdata\local\game-jolt-client\games\five-3d-nights-at-freddys-4-144401\default-225319\game (64 bit)\windowsnoeditor\engine\binaries\win64\ue4game.exe] => (Block) C:\users\steff\appdata\local\game-jolt-client\games\five-3d-nights-at-freddys-4-144401\default-225319\game (64 bit)\windowsnoeditor\engine\binaries\win64\ue4game.exe
FirewallRules: [TCP Query User{C8CDCC6F-06D8-43C2-9FF2-836143797B99}C:\users\steff\appdata\local\game-jolt-client\games\five-3d-nights-at-freddys-4-144401\default-225319\game (64 bit)\windowsnoeditor\engine\binaries\win64\ue4game.exe] => (Block) C:\users\steff\appdata\local\game-jolt-client\games\five-3d-nights-at-freddys-4-144401\default-225319\game (64 bit)\windowsnoeditor\engine\binaries\win64\ue4game.exe
FirewallRules: [UDP Query User{62C77F75-E9C7-4A68-987C-343B5DD1E7B1}C:\users\steff\appdata\local\game-jolt-client\games\five-3d-nights-at-freddys-4-144401\default-225292\game\windowsnoeditor\engine\binaries\win32\ue4game.exe] => (Block) C:\users\steff\appdata\local\game-jolt-client\games\five-3d-nights-at-freddys-4-144401\default-225292\game\windowsnoeditor\engine\binaries\win32\ue4game.exe
FirewallRules: [TCP Query User{71769CF3-17EB-48DA-8B91-1F226605C402}C:\users\steff\appdata\local\game-jolt-client\games\five-3d-nights-at-freddys-4-144401\default-225292\game\windowsnoeditor\engine\binaries\win32\ue4game.exe] => (Block) C:\users\steff\appdata\local\game-jolt-client\games\five-3d-nights-at-freddys-4-144401\default-225292\game\windowsnoeditor\engine\binaries\win32\ue4game.exe
FirewallRules: [UDP Query User{E462F8D5-6796-4F70-945C-D20EC3FA4F70}C:\users\steff\appdata\local\game-jolt-client\games\the-joy-of-creation-reborn-139218\default-241394\tjoc-r story mode\windowsnoeditor\engine\binaries\win32\ue4game-win32-shipping.exe] => (Block) C:\users\steff\appdata\local\game-jolt-client\games\the-joy-of-creation-reborn-139218\default-241394\tjoc-r story mode\windowsnoeditor\engine\binaries\win32\ue4game-win32-shipping.exe
FirewallRules: [TCP Query User{27FB00C1-3B7B-4D12-BFCA-9A33D92AEE84}C:\users\steff\appdata\local\game-jolt-client\games\the-joy-of-creation-reborn-139218\default-241394\tjoc-r story mode\windowsnoeditor\engine\binaries\win32\ue4game-win32-shipping.exe] => (Block) C:\users\steff\appdata\local\game-jolt-client\games\the-joy-of-creation-reborn-139218\default-241394\tjoc-r story mode\windowsnoeditor\engine\binaries\win32\ue4game-win32-shipping.exe
FirewallRules: [UDP Query User{833F1067-64C8-49B8-B36F-719C6261B0A9}C:\users\steff\appdata\local\game-jolt-client\games\the-joy-of-creation-reborn-139218\default-215556\tjoc-r beta 0.1.1\windowsnoeditor\engine\binaries\win64\ue4game-win64-shipping.exe] => (Allow) C:\users\steff\appdata\local\game-jolt-client\games\the-joy-of-creation-reborn-139218\default-215556\tjoc-r beta 0.1.1\windowsnoeditor\engine\binaries\win64\ue4game-win64-shipping.exe
FirewallRules: [TCP Query User{7E8A2ECF-ADB8-4637-BC96-E90F61E47FCF}C:\users\steff\appdata\local\game-jolt-client\games\the-joy-of-creation-reborn-139218\default-215556\tjoc-r beta 0.1.1\windowsnoeditor\engine\binaries\win64\ue4game-win64-shipping.exe] => (Allow) C:\users\steff\appdata\local\game-jolt-client\games\the-joy-of-creation-reborn-139218\default-215556\tjoc-r beta 0.1.1\windowsnoeditor\engine\binaries\win64\ue4game-win64-shipping.exe
FirewallRules: [UDP Query User{180069E2-7B6D-440B-9C63-46DA29EB7FF7}C:\users\steff\appdata\local\game-jolt-client\games\final-nights-2-sins-of-the-father-134778\default-208014\windowsnoeditor\finalnights2\binaries\win64\finalnights2.exe] => (Block) C:\users\steff\appdata\local\game-jolt-client\games\final-nights-2-sins-of-the-father-134778\default-208014\windowsnoeditor\finalnights2\binaries\win64\finalnights2.exe
FirewallRules: [TCP Query User{BF4166CF-F845-4555-A7AC-DE1CD86C356C}C:\users\steff\appdata\local\game-jolt-client\games\final-nights-2-sins-of-the-father-134778\default-208014\windowsnoeditor\finalnights2\binaries\win64\finalnights2.exe] => (Block) C:\users\steff\appdata\local\game-jolt-client\games\final-nights-2-sins-of-the-father-134778\default-208014\windowsnoeditor\finalnights2\binaries\win64\finalnights2.exe
FirewallRules: [{0F4D0004-13DA-47D3-9ABD-417B6F490ABC}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Five Nights at Freddy's Sister Location\SisterLocation.exe
FirewallRules: [{5858BB3D-5692-4B2D-B294-66CE1C1FFE11}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Five Nights at Freddy's Sister Location\SisterLocation.exe
FirewallRules: [UDP Query User{DC9C2F35-8709-45F1-8D49-F21996338686}C:\users\steff\appdata\local\gamejoltclient\gamejoltclient.exe] => (Allow) C:\users\steff\appdata\local\gamejoltclient\gamejoltclient.exe
FirewallRules: [TCP Query User{AB62B01D-D294-40C5-9682-5929B99F3E53}C:\users\steff\appdata\local\gamejoltclient\gamejoltclient.exe] => (Allow) C:\users\steff\appdata\local\gamejoltclient\gamejoltclient.exe
FirewallRules: [{6D638E8B-D74B-49CF-B7F1-0FB155702FDB}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Five Nights at Freddy's 3\FiveNightsatFreddys3.exe
FirewallRules: [{6838472B-6E1E-4A27-879B-4A06A6361F45}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Five Nights at Freddy's 3\FiveNightsatFreddys3.exe
FirewallRules: [{090E11F6-FB1E-412E-A16D-2644038D8535}] => (Allow) C:\Program Files\Bignox\BigNoxVM\RTNoxVMHandle.exe
FirewallRules: [{C5FB0442-7691-4605-8223-08F1D6D76859}] => (Allow) C:\Users\steff\AppData\Roaming\Nox\bin\Nox.exe
FirewallRules: [UDP Query User{B98AD598-1F36-4F36-8F8B-AC37F1A80B2A}C:\program files (x86)\java\jre1.8.0_91\bin\java.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_91\bin\java.exe
FirewallRules: [TCP Query User{9FA2305D-ABCB-4E12-93F0-0C19708DCBFA}C:\program files (x86)\java\jre1.8.0_91\bin\java.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_91\bin\java.exe
FirewallRules: [UDP Query User{74DA368E-CBC7-461C-B1A8-8BC8A108D744}C:\program files (x86)\java\jre1.8.0_91\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_91\bin\javaw.exe
FirewallRules: [TCP Query User{171B366F-1040-40F8-963D-93AE1736163B}C:\program files (x86)\java\jre1.8.0_91\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_91\bin\javaw.exe
FirewallRules: [{183DDB4A-849A-43B8-AF1F-0E40B25225D0}] => (Allow) C:\Users\steff\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{EFB93C24-2C07-435F-8F1A-3589D80CBE1A}] => (Allow) C:\Users\steff\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{BDDD9F84-FAE6-4D60-B226-0239A2A28913}] => (Allow) C:\Users\steff\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{7F9C8B11-3464-4A2B-82B7-3500CCE65E28}] => (Allow) C:\Users\steff\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{4ECE08F4-ADCB-4AF8-A70E-1D0C419FE578}] => (Allow) C:\Users\steff\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{BDC7103E-D65D-4237-9EF0-82AD44A62D32}] => (Allow) C:\Users\steff\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [UDP Query User{9C3E18CF-417B-477E-A596-4802DCBCA6CD}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Block) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [TCP Query User{7302D9E7-8C30-4699-9878-14C55505B42B}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Block) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [{E0F07F0D-6296-4934-B995-803C20E6999A}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{962C403D-FFBA-4C01-BE9E-AC9C0C43A393}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{6A6B76AA-BF09-4F65-BBCF-C56359A8E9CA}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{740DC054-1013-4CCA-B94F-4779D0B86B1A}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{BA791ACD-16AC-4CB0-9FF5-417AE1A7C172}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{34C0C50E-1F0B-4C17-A0DA-25A6058F68AA}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{39BD2DA2-FA05-41BE-9B6C-E6FC7236D2EE}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{E9B461EB-B9D6-4A18-B5FD-29CBE7D56B49}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{A72D7A02-2CC4-4252-A8C9-313EB57BCBDA}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{1EC998D1-0B6A-4803-BA14-E3C711CD1EC0}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Team Fortress 2\hl2.exe
FirewallRules: [{288E1390-3599-4500-8983-5C462F552849}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Team Fortress 2\hl2.exe
FirewallRules: [{A6B7C3EA-F8CE-4C4C-9DAD-8DB2D29D08BE}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Marvel Heroes\UnrealEngine3\Binaries\Win64\MarvelHeroes2016.exe
FirewallRules: [{84CFC4B3-23CC-4D2A-8F3F-1CE35EAF7786}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Marvel Heroes\UnrealEngine3\Binaries\Win64\MarvelHeroes2016.exe
FirewallRules: [{BC467AAA-FBEE-4172-8930-280197EC0783}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Trove\GlyphClient.exe
FirewallRules: [{C65AFCE5-8B6E-4B8E-9EAB-D1A1F4E0EDAE}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Trove\GlyphClient.exe
FirewallRules: [{905EAEBD-F33F-42D2-BCFD-A825C0937762}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Robocraft\Robocraft.exe
FirewallRules: [{EE9F7174-7530-4EAE-B396-E5AED4B82D82}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Robocraft\Robocraft.exe
FirewallRules: [{E58F1D84-CD95-4A85-BEC4-78C315AB0D15}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Paint the Town Red\PaintTheTownRed.exe
FirewallRules: [{10489F2C-C723-4D33-B125-E20D95403ED1}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Paint the Town Red\PaintTheTownRed.exe
FirewallRules: [{9AD21AFE-51CA-493D-A5FF-C5378D8FCB9A}] => (Allow) C:\Users\steff\AppData\Local\Chromium\Application\chrome.exe
FirewallRules: [{AC90FF90-123E-474D-A065-31D806E699DB}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\GarrysMod\hl2.exe
FirewallRules: [{5011870E-B1A8-4FDB-B5CA-1B173235C786}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\GarrysMod\hl2.exe
FirewallRules: [{D50BD7AE-D830-47A8-96C1-523918005DBA}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{54A91F34-4796-4983-8FDB-5F3B373EB4AF}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{41A7353B-F385-47EF-B775-E87F0141C401}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Feed and Grow Fish\Feed and Grow.exe
FirewallRules: [{7C724331-6ACE-491E-B2A7-A8A8D07973BE}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Feed and Grow Fish\Feed and Grow.exe
FirewallRules: [{8E303B21-45CA-4A18-896B-3B00C0AB7CDD}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\FiveNightsatFreddys4\FiveNightsatFreddys4.exe
FirewallRules: [{17DBFD71-EE61-470D-A70F-A85465E3CC72}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\FiveNightsatFreddys4\FiveNightsatFreddys4.exe
FirewallRules: [{3F094FF7-81D8-4229-8D7C-6CBC7C096B5D}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\FiveNightsatFreddys4\HalloweenEdition.exe
FirewallRules: [{7AEFCF79-DBC2-42DD-ADF0-8C5FB76D676F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\FiveNightsatFreddys4\HalloweenEdition.exe
FirewallRules: [{55A9E1BE-6209-4168-B63A-F85F382C8E53}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Five Nights at Freddy's\FiveNightsatFreddys.exe
FirewallRules: [{021A19C4-A4B9-4F86-83B7-6C4DE388B202}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Five Nights at Freddy's\FiveNightsatFreddys.exe
FirewallRules: [{F7AB1109-F934-4758-A8D4-C9B1820E3AA0}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Five Nights at Freddy's 2\FiveNightsatFreddys2.exe
FirewallRules: [{8903E594-0560-4F10-83DF-BEBEF6E0359D}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Five Nights at Freddy's 2\FiveNightsatFreddys2.exe
FirewallRules: [{7BD80C6A-83CF-4467-ADFA-F62D43EBBAE8}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{991BC127-B2B4-4528-B5BF-ADCCD38D8189}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{04954843-DC33-4150-B0C4-68AF86A37E59}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{151E57FC-9D37-4A93-B4F4-E5CEF4C36474}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{DF6603D2-D184-46F2-B26A-4935A773B430}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\MK10\Binaries\Retail\MK10.exe
FirewallRules: [{90D023D4-36B6-41D8-9238-BFA92C4375C1}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\MK10\Binaries\Retail\MK10.exe
FirewallRules: [{8E976AB1-564E-43DA-9837-2E033D2A79BC}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\MK10\Binaries\Retail\MKXLauncher.exe
FirewallRules: [{4B223C09-5EC1-4A44-86BE-F5C29FCB4880}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\MK10\Binaries\Retail\MKXLauncher.exe
FirewallRules: [{02D02B91-9B08-427C-9B8A-83C3E998B42E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{CD5156C3-8E0E-4777-B5F3-64FC607A2FFD}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
 
==================== Restore Points =========================
 
13-05-2017 09:09:59 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501
15-05-2017 21:00:31 Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (05/16/2017 08:58:03 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: RadeonSettings.exe, version: 10.1.1.1648, time stamp: 0x58336d3a
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x0000000000000000
Faulting process id: 0x1c34
Faulting application start time: 0x01d2cec1122b1459
Faulting application path: C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe
Faulting module path: unknown
Report Id: f6a28d17-1633-422f-8e0b-df058dbd58eb
Faulting package full name: 
Faulting package-relative application ID:
 
Error: (05/16/2017 08:22:46 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: RadeonSettings.exe, version: 10.1.1.1648, time stamp: 0x58336d3a
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x0000000000000000
Faulting process id: 0x19cc
Faulting application start time: 0x01d2cebc225d8e2c
Faulting application path: C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe
Faulting module path: unknown
Report Id: 60b0a0ff-4ba7-41a6-96e9-ac4d155176f2
Faulting package full name: 
Faulting package-relative application ID:
 
Error: (05/16/2017 07:59:28 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: RadeonSettings.exe, version: 10.1.1.1648, time stamp: 0x58336d3a
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x0000000000000000
Faulting process id: 0x1ea4
Faulting application start time: 0x01d2ceb8df49a29e
Faulting application path: C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe
Faulting module path: unknown
Report Id: 96850fd5-7468-44e2-9d21-d98d07f55148
Faulting package full name: 
Faulting package-relative application ID:
 
Error: (05/16/2017 07:52:33 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: RadeonSettings.exe, version: 10.1.1.1648, time stamp: 0x58336d3a
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x0000000000000000
Faulting process id: 0x1a28
Faulting application start time: 0x01d2ceb7cded3c31
Faulting application path: C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe
Faulting module path: unknown
Report Id: bc4af943-15bb-4384-b14d-f24d85f9ebcd
Faulting package full name: 
Faulting package-relative application ID:
 
Error: (05/16/2017 07:51:14 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3001) (User: NT AUTHORITY)
Description: The performance counter name string value in the registry is not formatted correctly. The malformed string is 9760. The first DWORD in the Data section contains the index value to the malformed string while the second and third DWORDs in the Data section contain the last valid index values.
 
Error: (05/16/2017 07:43:26 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-T3IMUHD)
Description: Activation of app Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo failed with error: -2144927142 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (05/16/2017 07:38:18 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: RadeonSettings.exe, version: 10.1.1.1648, time stamp: 0x58336d3a
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x0000000000000000
Faulting process id: 0x1c78
Faulting application start time: 0x01d2ceb5ea958ac0
Faulting application path: C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe
Faulting module path: unknown
Report Id: 5513f858-dfdb-46e6-a24c-85f420ec35ef
Faulting package full name: 
Faulting package-relative application ID:
 
Error: (05/16/2017 07:28:48 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: RadeonSettings.exe, version: 10.1.1.1648, time stamp: 0x58336d3a
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x0000000000000000
Faulting process id: 0x22a0
Faulting application start time: 0x01d2ceb49afe3d8b
Faulting application path: C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe
Faulting module path: unknown
Report Id: 1817663c-db95-4834-b5cd-cfb7dd3c6969
Faulting package full name: 
Faulting package-relative application ID:
 
Error: (05/16/2017 03:40:52 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-T3IMUHD)
Description: Activation of app Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo failed with error: -2144927142 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (05/16/2017 02:40:14 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: The Open Procedure for service "BITS" in DLL "C:\Windows\System32\bitsperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.
 
 
System errors:
=============
Error: (05/16/2017 08:52:36 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The MBAMService service failed to start due to the following error: 
The requested resource is in use.
 
Error: (05/16/2017 08:52:34 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The CldFlt service failed to start due to the following error: 
The request is not supported.
 
Error: (05/16/2017 08:52:15 PM) (Source: Application Popup) (EventID: 875) (User: )
Description: XQHDrv.sys
 
Error: (05/16/2017 08:51:35 PM) (Source: DCOM) (EventID: 10005) (User: DESKTOP-T3IMUHD)
Description: DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "Unavailable" in order to run the server:
{DD522ACC-F821-461A-A407-50B198B896DC}
 
Error: (05/16/2017 08:51:17 PM) (Source: DCOM) (EventID: 10005) (User: DESKTOP-T3IMUHD)
Description: DCOM got error "1084" attempting to start the service WSearch with arguments "Unavailable" in order to run the server:
{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
 
Error: (05/16/2017 08:51:17 PM) (Source: DCOM) (EventID: 10005) (User: DESKTOP-T3IMUHD)
Description: DCOM got error "1084" attempting to start the service WSearch with arguments "Unavailable" in order to run the server:
{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
 
Error: (05/16/2017 08:51:16 PM) (Source: DCOM) (EventID: 10005) (User: DESKTOP-T3IMUHD)
Description: DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "Unavailable" in order to run the server:
{DD522ACC-F821-461A-A407-50B198B896DC}
 
Error: (05/16/2017 08:51:15 PM) (Source: DCOM) (EventID: 10005) (User: DESKTOP-T3IMUHD)
Description: DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.TokenBrokerInternal
 
Error: (05/16/2017 08:51:11 PM) (Source: DCOM) (EventID: 10005) (User: DESKTOP-T3IMUHD)
Description: DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "Unavailable" in order to run the server:
{DD522ACC-F821-461A-A407-50B198B896DC}
 
Error: (05/16/2017 08:51:08 PM) (Source: DCOM) (EventID: 10005) (User: DESKTOP-T3IMUHD)
Description: DCOM got error "1084" attempting to start the service WSearch with arguments "Unavailable" in order to run the server:
{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
 
 
CodeIntegrity:
===================================
  Date: 2017-05-16 19:41:51.963
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\dllhost.exe) attempted to load \Device\HarddiskVolume2\Users\steff\AppData\Roaming\Microsoft\Protect\76e354-23e355-0dc12100-1d7df1-bfa0.rs that did not meet the Microsoft signing level requirements.
 
  Date: 2017-05-16 19:41:51.134
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\dllhost.exe) attempted to load \Device\HarddiskVolume2\Users\steff\AppData\Roaming\Microsoft\Protect\76e354-23e355-0dc12100-1d7df1-bfa0.rs that did not meet the Microsoft signing level requirements.
 
  Date: 2017-05-16 19:41:50.598
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\dllhost.exe) attempted to load \Device\HarddiskVolume2\Users\steff\AppData\Roaming\Microsoft\Protect\76e354-23e355-0dc12100-1d7df1-bfa0.rs that did not meet the Microsoft signing level requirements.
 
 
==================== Memory info =========================== 
 
Processor: AMD FX™-6300 Six-Core Processor 
Percentage of memory in use: 38%
Total physical RAM: 8190.17 MB
Available physical RAM: 5012.55 MB
Total Virtual: 10110.17 MB
Available Virtual: 6332.2 MB
 
==================== Drives ================================
 
Drive c: (Windows) (Fixed) (Total:930.73 GB) (Free:560.29 GB) NTFS
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: DD0E7A7A)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=930.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=450 MB) - (Type=27)
 
==================== End of Addition.txt ============================

 


  • 0

Advertisements


#2
zep516

zep516

    Trusted Helper

  • Malware Removal
  • 7,698 posts
Hi! My name is zep516 and Welcome to Geekstogo!
I'll do the best I can to resolve your computer issue
Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, don't continue Stop and ask! Never be afraid to ask questions! :)

Try following these instructions for Malwarebytes, please let Malwarebytes run un-interrupted. It may look like it freezes just leave it. It could take an hour or more.
Please don't click on the window while cleanup is running. This may delay it even more.
  • Please download Malwarebytes Anti-Rootkit and save the file to your Desktop.
  • Right-Click MBAR.exe and select AVOiBNU.jpgRun as administrator to run the installer.
  • Select your Desktop as the location to extract the contents and click OK. The programme should open upon completion.
  • Click Next, followed by Update. Upon update completion, click Next.
  • Ensure Drivers, Sectors & System are checked and click Scan.
  • Note: Do not use your computer during the scan.
  • Upon completion:
    • If no infection is found, close the MBAR window.
    • If an infection is found, ensure Create Restore Point is checked and click Cleanup. Reboot when prompted.
  • Two logs (mbar-log.txt and system-log.txt) will be created. Copy the contents of both logs and paste in your next reply. Both logs can be found in the MBAR folder.

  • 0

#3
shoie

shoie

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts

Thanks for your help.  Attached is the error I get when trying to run it as Administrator.

Attached Thumbnails

  • Error.PNG

Edited by shoie, 16 May 2017 - 11:05 PM.

  • 0

#4
zep516

zep516

    Trusted Helper

  • Malware Removal
  • 7,698 posts
Hello,

Please make sure malwarebytes up dated although yours appears to be.

Also
Malwarebytes created a folder on your desktop.

Open the folder and rename mbar.exe to test.exe. try running it again.
  • 0

#5
shoie

shoie

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts

Changed it with same results.


  • 0

#6
zep516

zep516

    Trusted Helper

  • Malware Removal
  • 7,698 posts
Hello,

find the mbar.cmd file in the MBAR folder and run it.
  • 0

#7
shoie

shoie

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts

Ok - doing that I am able to get it to run and it finds 10 malware but then I get the blue screen of death.  Not sure how to get it to complete.


  • 0

#8
zep516

zep516

    Trusted Helper

  • Malware Removal
  • 7,698 posts
Hello,

It might run in the safemode

http://www.digitalci...mode-windows-10

Also

Go in these two folders, and delete everything you can.
C:\Users\steff\AppData\Local\ntuserlitelist\
C:\Users\steff\AppData\Local\llssoft
  • 0

#9
shoie

shoie

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts

Finally success - over 2000 malware.  I've attached the logs since they are so big.

Attached Files


Edited by shoie, 18 May 2017 - 09:16 PM.

  • 0

#10
zep516

zep516

    Trusted Helper

  • Malware Removal
  • 7,698 posts
Hello,

How did you get it to run? So I can use the information for future reference.

Due to the nature of this malware we are going to run several more scans to clean up even more possible malware. One of the scans will be Malwarebytes this is not the malwarebytes anti rootkit version that you have already but, malwarebytes anti malware...

Next
Download AdwCleaner from here. Save the file to the desktop.
NOTE: If you are using IE 8 or above you may get a warning that stops the program from downloading. Just click on the warning and allow the download to complete.
Close all open windows and browsers.
  • XP users: Double click the AdwCleaner icon to start the program.
  • Vista/7/8 users: Right click the AdwCleaner icon on the desktop, click Run as administrator and accept the UAC prompt to run AdwCleaner.
    You will see the following console:
iO5EZayK.png
  • Click the Scan button and wait for the scan to finish.
  • After the Scan has finished the window may or may not show what it found and above, in the progress bar, you will see: Pending. Please uncheck elements you don't want to remove.
  • Click the Clean button.
  • Everything checked will be moved to Quarantine.
  • When the program has finished cleaning a report appears.Once done it will ask to reboot, allow this
adwcleaner_delete_restart.jpg
  • On reboot a log will be produced please copy / paste that in your next reply. This report is also saved to C:\AdwCleaner\AdwCleaner[C0].txt
Next
  • Please download Junkware Removal Tool to your Desktop.
  • Please close your security software to avoid potential conflicts. See Here how to disable you security protection (Anti Virus)
  • Run the tool by double-clicking it. If you are using Windows Vista or 7, right-mouse click it and select Run as administrator.
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete, depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your Desktop and will automatically open.
  • Please post the contents of JRT.txt into your reply.
    Next
    • Please download Malwarebytes Anti-Malware to your desktop.
    • Double-click mbam-setup-version.exe and follow the prompts to install the program.
    • Launch Malwarebytes Anti-Malware
    • Then click Finish.
    • If an update is found, you will be prompted to download and install the latest version.
    • Once the program has loaded, select Scan now. Or select the Threat Scan from the Scan menu.
    • When the scan is complete , make sure that that all Threats are selected, and click Remove Selected.
    • Reboot your computer if prompted.
    Posting the Malwarebytes log.
    • After the restart once you are back at your desktop, open MBAM once more.
    • Click on the History tab > Application Logs.
    • Double click on the Scan Log which shows the Date and time of the scan just performed.
    • Click 'Export'.
    • Click 'Text file (*.txt)'
    • In the Save File dialog box which appears, click on Desktop.
    • In the File name: box type a name for your scan log.
    • A message box named 'File Saved' should appear stating "Your file has been successfully exported".
    • Click Ok
    • post that saved log to your next reply.
    In your next reply post;
  • The AdwCleaner [C1].txt Log
  • The JRT.txt Log
  • Malwarebytes log



  • 0

#11
zep516

zep516

    Trusted Helper

  • Malware Removal
  • 7,698 posts
Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP