Jwinebago382

Hello, my internet connection has been very slow, my disk usage is ramped up, and I noticed that Tamper Protection in Windows Security was turned off. There are also Windows Updates pending to download, but it also says the last time my system checked was when I was using my laptop in the morning. Anyways, please check out the attached logs, I have been here before and know you about FRST, here is the frst log and the addition log Addition.txt FRST.txt

Also, I had moved the potentially compromised files to an external hard drive when I had assumed it was safe. I zipped it beforehand, and I would like to walk through scanning that external device as well, just in case

Hi so I was sent potentially compromised files and I wanted to make sure it was safe. I read your reply a couple hours ago and belived it was safe, but then I received these logs from my malwarebytes trial warning of trojans from an outbound connection. Can you help me with this? Additionally, in my search bar there was a forums.malwarebyes.com, misspelled, and my malwarebytes program noted it was a case of fraud and I should avoid the site. I dont recall accidentally going to this site last night, but it may just be sitting in there from a mistake on my part while typing the website months ago, but id rather let you know than be sorry in the future outbound trojan.txt

heres the logs, thanks for your help Addition.txt AdwCleaner[S00].txt FRST.txt malwarebyteslog.txt

Got joe logs right here, didn't pick up the logs for Malwarebytes they were just taking too long. Addition.txt AdwCleaner[S5].txt FRST.txt

Got the FRST logs right here. Thank you for all your help! Addition.txt FRST.txt

edit: Tried to edit my original post from that built-in admin profile, which I used to post my logs in the first place, but for some reason my microsoft edge browser won't allow me to click 'reply,' won't let me edit this post, and won't let me log out of malwarebytes.com. I use a different browser called Opera in my user profile, which I've used to edit this post now. The microsoft edge browser in my user profile can download successfully however.

Here are the logs, and I have reset my browsers like you've asked. AdwCleaner[S4].txt JRT.txt Addition.txt FRST.txt

Okay so the browser cant seem to download but a 'partial download' file is left behind. Is this normal?

The disk check has completed, though a status 50 states my log couldnt transfer to eventvwr which is a shame. Didnt know if youd want to look at those. My built-in admin profile still cant download things like FRST, though my other admin and public profile can. So it hasnt changed, but the command prompt did state repairs to the system were completed.

https://www.google.com/amp/www.thewindowsclub.com/chkdsk-stuck-hangs-windows/amp Looks like the chkdsk wont complete, but would running the line of commands mentioned im this article help me? I really dont want to spend the money on a new drive, is this issue somethig i absolutely have to fix? Thank you for your help.

I left the chkdsk command prompt open all night, but it looks like it froze while scanning for bad user data files. It got stuck at 10000 out of 40000 and it has not moved for at least six hours. Any way around this?

The command prompt itself asks me to restart the machine in order to start chkdsk. Specifically it states that 'chkdsk cannot run because the volume is in use by another process. would you like to schedule this volume to be checked the next time the system restarts?' This question has appeared every time I have tried to use chkdsk in the command prompt. Does my issue make sense now? The fact that the command prompt states a restart will begin chkdsk, but upon startup the disk check never happens for me. Even in safe mode with command prompt, even from different admin accounts. And yes I checked with notepad and have confirmed my drive uses the c: as oppose to the d: or e:

I already tried using that, and when i restart it does say 'press any key within 8 seconds to abort disk check' but hardly 3 seconds pass before the normal sign in screen appears. So no the safe mode command prompt did not yield a different result unfortunately. And i am using a c: drive so that potential mistake is not the issue at hand.

Tried using a shut down after using the chkdsk command, and also tried using the command prompt in safe mode. Neither managed to start the chkdsk.

Hi, so whenever i try to start chkdsk, it asks me to restart the system, which i do. But the event viewer program never reports that the chkdsk actually happened, and i did this system restart following the chkdsk in command prompt with admin privileges from all three accounts. None have led to the creation of a chkdsk that i can check in event viewer.

Looks like creating a new admin account did the trick, it can download and it can edit the local account. It's just kind of sluggish.

Hi! So the log states there are no threats, but then why is my built-in admin account having issues? Why can't it download well-known tools from bleepingcomputer.com, and why did I have to download the mbar anti rootkit tool through my public account, gain permission to edit my admin account, then copy the mbar exe to my admin desktop? I tried to instead copy the mbar exe from the public account into my admin account through my admin account, but for some reason the permissions could never get accepted. I could never open my public account through my admin account, which is weird since the reverse, opening the admin account through my public account, was quicker and actually gained a result. Is this something I should worry about? Also, I did run the anti rootkit exe from my admin account, it just had to be placed on the admin desktop by use of the public account. The log says I'm clean, but what now? Thank you. mbar-log-2017-07-11 (21-44-12).txt system-log.txt

So I can't download FRST or any other programs from my admin account for some odd reason. I'm using the built-in admin account with a password. I will however download from my public account and then move the applications to my admin account when required to use them in the admin desktop. Here are those FRST logs by the way, which is lucky because I forgot to uninstall FRST from the last time I used it. I let FRST update by the way. Addition.txt FRST.txt

Hi Malwarebytes Forums, Looks like I found a file with Junkware Removal Tool called asr.dat which the removal program states it had deleted. Should I be concerned? Is there anyway I may be sure my system is clean? Let me know what logs I may provide, and how I may avoid these problems in the future. Thank you for your time.

I didn't perform any steps past the command prompt because I got the error for both system32 and sysWOW64 that 'error: unable to rebuild performance counter setting from system backup store, error code is 5.' My system is still really slow on startup, and sometimes before I get to the sign in page there's a light blue screen which feels disconcerting but hasn't proved problematic. EDIT: Also, and this is strange, right now I typed in 'google.com' to get some info on what an error code 5 is, but then it redirected to some shady website that I'd never seen before. Very strange since this was going towards a well known site like google. Also, a random site redirect like this hasnt happened since the initial attack. So maybe its not a virus that made the redirect, since ive been using this laptop almost everyday since without a random redirect like this. Also, windows and opera got updated a couple days after the attack, which worries me because maybe that could help hide the threat on the system? I wouldnt know. Thamk you for the assistance

Hi, TFC didn't ask me to restart my system, but it did clear out my temporary files. I do still get CPU usages at 50-85%, disk usage jumps to 80-99% every now and then. My computer doesn't seem messed up besides that, and its slow at startup but that improves. Also sometimes when I search something on google the google search page appears in a different style, I haven't noticed anything else to be changed though. I assume everything is fine but who knows for sure right?

Hi, So when I got this on 5/16/2017, I lost the opera(default internet browser) shortcut on my admin profile, which seemed weird at the time. I've been using the desktop since then because I haven't experienced any other issues. Today 5/25/2017 I received a notification from Windows Defender saying that there were 0 threats in my system, but one quarantined. So I clicked the notification which took me to the defender program where one file called SupportScam:JS/TechBrolo.AA was quarantined. I clicked more details for the file which presented a page that said the file status is "unknown." This seems very strange to me, since this could mean this file is still active though my windows defender said it was quarantined. Anyways Here is the stuff, also I haven't been able to get back to the quarantined file pen in windows defender. JRT ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Malwarebytes Version: 8.1.3 (04.10.2017) Operating System: Windows 10 Home x64 Ran by Neeko (Administrator) on Thu 05/25/2017 at 19:05:54.55 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ File System: 0 Registry: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on Thu 05/25/2017 at 19:08:01.93 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ adwcleaner # AdwCleaner v6.047 - Logfile created 25/05/2017 at 14:22:05 # Updated on 19/05/2017 by Malwarebytes # Database : 2017-05-19.1 [Local] # Operating System : Windows 10 Home (X64) # Username : Neeko - DESKTOP-M7IRLC6 # Running from : C:\Users\Neeko\Desktop\AdwCleaner.exe # Mode: Scan # Support : https://www.malwarebytes.com/support ***** [ Services ] ***** No malicious services found. ***** [ Folders ] ***** No malicious folders found. ***** [ Files ] ***** No malicious files found. ***** [ DLL ] ***** No malicious DLLs found. ***** [ WMI ] ***** No malicious keys found. ***** [ Shortcuts ] ***** No infected shortcut found. ***** [ Scheduled Tasks ] ***** No malicious task found. ***** [ Registry ] ***** No malicious registry entries found. ***** [ Web browsers ] ***** No malicious Firefox based browser items found. No malicious Chromium based browser items found. ************************* C:\AdwCleaner\AdwCleaner[S0].txt - [990 Bytes] - [25/05/2017 14:22:05] ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1062 Bytes] ########## FRST Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 24-05-2017 Ran by Neeko (administrator) on DESKTOP-M7IRLC6 (25-05-2017 18:38:02) Running from C:\Users\Neeko\Desktop Loaded Profiles: Neeko (Available Profiles: Neeko & Rick 0) Platform: Windows 10 Home Version 1703 (X64) Language: English (United States) Internet Explorer Version 11 (Default browser: Edge) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Intel Corporation) C:\Windows\System32\igfxCUIService.exe (HP) C:\Windows\System32\hpservice.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe (Intel Corporation) C:\Windows\System32\Intel\DPTF\esif_uf.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe (RaMMicHaeL) C:\Program Files (x86)\Unchecky\bin\unchecky_svc.exe (Synaptics Incorporated) C:\Windows\System32\valWBFPolicyService.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (MyCity) C:\Program Files (x86)\MCShield\MCShieldRTM.exe (Intel Corporation) C:\Windows\Temp\DPTF\esif_assist_64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (RaMMicHaeL) C:\Program Files (x86)\Unchecky\bin\unchecky_bg.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe ==================== Registry (Whitelisted) ==================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [629152 2017-03-18] (Microsoft Corporation) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8843520 2016-01-28] (Realtek Semiconductor) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [303928 2017-03-22] (Apple Inc.) HKU\S-1-5-21-166261395-844033189-1565394352-1001\...\Run: [MCShield Monitor] => C:\Program Files (x86)\MCShield\MCShieldRTM.exe [650816 2014-04-11] (MyCity) HKU\S-1-5-21-166261395-844033189-1565394352-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3019552 2017-04-25] (Valve Corporation) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 66.253.214.16 50.30.184.16 Tcpip\..\Interfaces\{4b71d5e5-183c-42bf-abcf-210136008644}: [DhcpNameServer] 66.253.214.16 50.30.184.16 Tcpip\..\Interfaces\{9a33da33-3bcb-4a80-b5e2-687e90d240a5}: [DhcpNameServer] 66.253.214.16 50.30.184.16 Internet Explorer: ================== FireFox: ======== FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll [2017-04-28] () ==================== Services (Whitelisted) ==================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2017-03-17] (Apple Inc.) R2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2286848 2015-10-01] (Broadcom Corporation.) R2 esifsvc; C:\Windows\system32\Intel\DPTF\esif_uf.exe [2219072 2016-10-25] (Intel Corporation) R2 hpsrv; C:\Windows\system32\Hpservice.exe [38728 2016-10-12] (HP) R2 igfxCUIService2.0.0.0; C:\Windows\system32\igfxCUIService.exe [373720 2017-01-13] (Intel Corporation) R2 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [458176 2017-03-29] (NVIDIA Corporation) R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [310016 2016-01-28] (Realtek Semiconductor) R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [269400 2016-10-05] (Synaptics Incorporated) R2 Unchecky; C:\Program Files (x86)\Unchecky\bin\unchecky_svc.exe [304408 2017-04-22] (RaMMicHaeL) R2 valWBFPolicyService; C:\Windows\system32\valWBFPolicyService.exe [100384 2016-03-09] (Synaptics Incorporated) R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [342264 2017-03-18] (Microsoft Corporation) R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [102816 2017-03-18] (Microsoft Corporation) ===================== Drivers (Whitelisted) ====================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R3 Accelerometer; C:\Windows\system32\DRIVERS\Accelerometer.sys [56128 2016-10-12] (HP) R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [177440 2016-01-27] (Broadcom Corporation.) R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [7585280 2017-03-18] (Broadcom Corporation) R3 dptf_acpi; C:\Windows\System32\drivers\dptf_acpi.sys [72592 2016-10-25] (Intel Corporation) R3 dptf_cpu; C:\Windows\System32\drivers\dptf_cpu.sys [67984 2016-10-25] (Intel Corporation) R3 esif_lf; C:\Windows\system32\DRIVERS\esif_lf.sys [355216 2016-10-25] (Intel Corporation) R0 hpdskflt; C:\Windows\System32\DRIVERS\hpdskflt.sys [42312 2016-10-12] (HP) R1 MpKsl8e27ddaf; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{2869278D-6DDC-4E76-A154-B737EC625829}\MpKsl8e27ddaf.sys [44928 2017-05-25] (Microsoft Corporation) R3 nvlddmkm; C:\Windows\System32\DriverStore\FileRepository\nvhm.inf_amd64_0460fff687def1f0\nvlddmkm.sys [14378544 2017-04-11] (NVIDIA Corporation) R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [604160 2017-03-18] (Realtek ) S3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [760968 2017-02-23] (Realsil Semiconductor Corporation) S3 SDFRd; C:\Windows\System32\drivers\SDFRd.sys [31128 2017-03-18] () S2 SecDrv; C:\Windows\SysWOW64\drivers\SECDRV.SYS [11973 2017-05-24] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [File not signed] R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [79960 2016-10-05] (Synaptics Incorporated) S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44632 2017-03-18] (Microsoft Corporation) R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [294816 2017-03-18] (Microsoft Corporation) R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [121248 2017-03-18] (Microsoft Corporation) R3 WirelessButtonDriver64; C:\Windows\system32\DRIVERS\WirelessButtonDriver64.sys [31656 2016-04-13] (HP) ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2017-05-25 18:38 - 2017-05-25 18:38 - 00007905 _____ C:\Users\Neeko\Desktop\FRST.txt 2017-05-25 14:37 - 2017-05-25 14:40 - 00000000 ____D C:\Windows\Microsoft Antimalware 2017-05-25 14:24 - 2017-05-25 14:24 - 00002775 _____ C:\Users\Public\Desktop\Sophos Virus Removal Tool.lnk 2017-05-25 14:24 - 2017-05-25 14:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sophos 2017-05-25 14:24 - 2017-05-25 14:24 - 00000000 ____D C:\Program Files (x86)\Sophos 2017-05-25 14:22 - 2017-05-25 14:22 - 00001141 _____ C:\Users\Neeko\Desktop\AdwCleaner[S0].txt 2017-05-25 14:20 - 2017-05-25 14:22 - 00000000 ____D C:\AdwCleaner 2017-05-25 14:20 - 2017-05-25 14:20 - 00000555 _____ C:\Users\Neeko\Desktop\JRT.txt 2017-05-25 14:10 - 2017-05-25 14:10 - 04110280 _____ C:\Users\Neeko\Desktop\AdwCleaner.exe 2017-05-25 14:03 - 2017-05-25 14:04 - 01663672 _____ (Malwarebytes) C:\Users\Neeko\Desktop\JRT.exe 2017-05-24 11:49 - 2017-05-24 11:49 - 00001675 _____ C:\Users\Neeko\Desktop\VTM Bloodlines Unofficial Patch.lnk 2017-05-24 02:32 - 2017-05-24 02:32 - 00000000 ____D C:\Users\Neeko\AppData\Local\DBG 2017-05-24 02:32 - 2017-05-24 02:32 - 00000000 ____D C:\Users\Neeko\AppData\Local\CrashDumps 2017-05-24 02:22 - 2017-05-24 02:24 - 00011973 _____ (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) C:\Windows\SysWOW64\Drivers\SECDRV.SYS 2017-05-24 02:08 - 2017-05-24 11:49 - 00001705 _____ C:\Users\Neeko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VTM Bloodlines Unofficial Patch.lnk 2017-05-24 01:48 - 2017-05-24 01:51 - 481960598 _____ (Werner Spahl ) C:\Users\Rick 0\Downloads\VTMBup97.exe 2017-05-23 15:03 - 2017-05-23 15:04 - 02983934 _____ C:\Users\Rick 0\Downloads\Leyda, Selection from Kino.pdf 2017-05-23 12:06 - 2017-05-23 12:06 - 55917364 _____ C:\Users\Rick 0\Downloads\Pastel - Closer.wav 2017-05-23 11:42 - 2017-05-23 11:45 - 00000000 ____D C:\Users\Rick 0\Documents\VirtualDJ 2017-05-23 11:42 - 2017-05-23 11:42 - 00001023 _____ C:\Users\Rick 0\Desktop\VirtualDJ 8.lnk 2017-05-23 11:42 - 2017-05-23 11:42 - 00000000 ____D C:\Users\Rick 0\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VirtualDJ 2017-05-23 11:42 - 2017-05-23 11:42 - 00000000 ____D C:\Program Files (x86)\VirtualDJ 2017-05-20 17:39 - 2017-05-20 17:39 - 00000214 _____ C:\Windows\Tasks\CreateExplorerShellUnelevatedTask.job 2017-05-19 19:17 - 2017-05-19 19:17 - 00000995 _____ C:\Users\Rick 0\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Saved Pictures.lnk 2017-05-16 16:01 - 2017-05-25 18:37 - 00000000 ____D C:\Users\Neeko\Desktop\FRST-OlderVersion 2017-05-16 11:30 - 2017-05-24 02:40 - 00000000 ____D C:\Users\Neeko\AppData\Local\Steam 2017-05-16 11:30 - 2017-05-16 11:30 - 00000000 ____D C:\Users\Neeko\AppData\Local\CEF 2017-05-15 16:57 - 2017-05-15 16:57 - 00634989 _____ C:\Users\Rick 0\Downloads\pathe and other film industry history the decline of euro film.pdf 2017-05-14 17:20 - 2017-05-14 17:20 - 03068415 _____ C:\Users\Rick 0\Downloads\Stam, The Structuring Absences of Silent Cinema.pdf 2017-05-14 17:20 - 2017-05-14 17:20 - 02090697 _____ C:\Users\Rick 0\Downloads\Stewart, We Were Never Immigrants.pdf 2017-05-14 17:18 - 2017-05-14 17:18 - 06436284 _____ C:\Users\Rick 0\Downloads\Abel French Film Industry.pdf 2017-05-14 17:18 - 2017-05-14 17:18 - 05206731 _____ C:\Users\Rick 0\Downloads\Abel, The French Rooster Rules the Roost.pdf 2017-05-14 17:04 - 2017-05-14 17:04 - 00593102 _____ C:\Users\Rick 0\Downloads\Film History I FSP 17.pdf 2017-05-14 17:03 - 2017-05-14 17:03 - 04341528 _____ C:\Users\Rick 0\Downloads\Pathé.pptx 2017-05-13 14:13 - 2017-05-13 14:13 - 00646089 _____ C:\Users\Rick 0\Downloads\Abelson_Night and Day.pdf 2017-05-11 20:31 - 2017-05-11 20:33 - 00000000 ____D C:\Users\Rick 0\Downloads\ps 205 2017-05-11 12:57 - 2017-05-23 14:41 - 00000000 ____D C:\Users\Rick 0\Downloads\film 381 2017-05-10 12:08 - 2017-05-15 18:07 - 00000000 ____D C:\Users\Rick 0\Documents\Sound recordings 2017-05-09 22:52 - 2017-04-27 18:38 - 01411128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32full.dll 2017-05-09 22:52 - 2017-04-27 18:12 - 01604312 _____ (Microsoft Corporation) C:\Windows\system32\gdi32full.dll 2017-05-09 22:52 - 2017-04-27 18:12 - 00543640 _____ (Microsoft Corporation) C:\Windows\system32\securekernel.exe 2017-05-09 22:52 - 2017-04-27 18:11 - 02158544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2017-05-09 22:52 - 2017-04-27 18:08 - 08320920 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2017-05-09 22:52 - 2017-04-27 18:07 - 06759512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Media.Protection.PlayReady.dll 2017-05-09 22:52 - 2017-04-27 18:03 - 00667040 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll 2017-05-09 22:52 - 2017-04-27 18:00 - 02444192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys 2017-05-09 22:52 - 2017-04-27 17:59 - 02635336 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2017-05-09 22:52 - 2017-04-27 17:59 - 00388000 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBXHCI.SYS 2017-05-09 22:52 - 2017-04-27 17:56 - 07904784 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.Protection.PlayReady.dll 2017-05-09 22:52 - 2017-04-27 17:52 - 02957824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32kfull.sys 2017-05-09 22:52 - 2017-04-27 17:51 - 20505600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\edgehtml.dll 2017-05-09 22:52 - 2017-04-27 17:46 - 19335168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2017-05-09 22:52 - 2017-04-27 17:46 - 00329728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webplatstorageserver.dll 2017-05-09 22:52 - 2017-04-27 17:44 - 00338432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2017-05-09 22:52 - 2017-04-27 17:44 - 00266240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2017-05-09 22:52 - 2017-04-27 17:42 - 00806400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\StoreAgent.dll 2017-05-09 22:52 - 2017-04-27 17:42 - 00663040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2017-05-09 22:52 - 2017-04-27 17:42 - 00636416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WpcWebFilter.dll 2017-05-09 22:52 - 2017-04-27 17:42 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InstallAgentUserBroker.exe 2017-05-09 22:52 - 2017-04-27 17:40 - 11870208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2017-05-09 22:52 - 2017-04-27 17:40 - 06292992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Chakra.dll 2017-05-09 22:52 - 2017-04-27 17:40 - 02008576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2017-05-09 22:52 - 2017-04-27 17:40 - 00328704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InstallAgent.exe 2017-05-09 22:52 - 2017-04-27 17:39 - 05225984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll 2017-05-09 22:52 - 2017-04-27 17:39 - 02859520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2017-05-09 22:52 - 2017-04-27 17:38 - 03667456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_47.dll 2017-05-09 22:52 - 2017-04-27 17:38 - 01019904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aadtb.dll 2017-05-09 22:52 - 2017-04-27 17:37 - 04559360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbgeng.dll 2017-05-09 22:52 - 2017-04-27 17:37 - 01626624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2017-05-09 22:52 - 2017-04-27 17:26 - 23677440 _____ (Microsoft Corporation) C:\Windows\system32\edgehtml.dll 2017-05-09 22:52 - 2017-04-27 17:15 - 03672064 _____ (Microsoft Corporation) C:\Windows\system32\win32kfull.sys 2017-05-09 22:52 - 2017-04-27 17:11 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\BasicRender.sys 2017-05-09 22:52 - 2017-04-27 17:08 - 00457728 _____ (Microsoft Corporation) C:\Windows\system32\webplatstorageserver.dll 2017-05-09 22:52 - 2017-04-27 17:08 - 00096256 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2017-05-09 22:52 - 2017-04-27 17:06 - 00386560 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2017-05-09 22:52 - 2017-04-27 17:06 - 00274944 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2017-05-09 22:52 - 2017-04-27 17:05 - 01075712 _____ (Microsoft Corporation) C:\Windows\system32\StoreAgent.dll 2017-05-09 22:52 - 2017-04-27 17:05 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2017-05-09 22:52 - 2017-04-27 17:04 - 23681024 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2017-05-09 22:52 - 2017-04-27 17:04 - 00422400 _____ (Microsoft Corporation) C:\Windows\system32\WpAXHolder.dll 2017-05-09 22:52 - 2017-04-27 17:04 - 00416256 _____ (Microsoft Corporation) C:\Windows\system32\InstallAgentUserBroker.exe 2017-05-09 22:52 - 2017-04-27 17:03 - 00925696 _____ (Microsoft Corporation) C:\Windows\system32\WpcWebFilter.dll 2017-05-09 22:52 - 2017-04-27 17:03 - 00751104 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2017-05-09 22:52 - 2017-04-27 17:01 - 02077184 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2017-05-09 22:52 - 2017-04-27 17:00 - 08244736 _____ (Microsoft Corporation) C:\Windows\system32\Chakra.dll 2017-05-09 22:52 - 2017-04-27 16:59 - 04396032 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_47.dll 2017-05-09 22:52 - 2017-04-27 16:59 - 03307008 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2017-05-09 22:52 - 2017-04-27 16:59 - 02056192 _____ (Microsoft Corporation) C:\Windows\system32\win32kbase.sys 2017-05-09 22:52 - 2017-04-27 16:59 - 01293824 _____ (Microsoft Corporation) C:\Windows\system32\aadtb.dll 2017-05-09 22:52 - 2017-04-27 16:59 - 00373760 _____ (Microsoft Corporation) C:\Windows\system32\InstallAgent.exe 2017-05-09 22:52 - 2017-04-27 16:58 - 12787200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2017-05-09 22:52 - 2017-04-27 16:57 - 05557760 _____ (Microsoft Corporation) C:\Windows\system32\dbgeng.dll 2017-05-09 22:52 - 2017-04-27 16:57 - 01803264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2017-05-09 22:51 - 2017-04-27 18:19 - 01839872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll 2017-05-09 22:51 - 2017-04-27 18:19 - 00605936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll 2017-05-09 22:51 - 2017-04-27 18:18 - 02259760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CoreUIComponents.dll 2017-05-09 22:51 - 2017-04-27 18:16 - 00599576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll 2017-05-09 22:51 - 2017-04-27 18:09 - 01557288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2017-05-09 22:51 - 2017-04-27 18:08 - 02399728 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll 2017-05-09 22:51 - 2017-04-27 18:08 - 02330520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\combase.dll 2017-05-09 22:51 - 2017-04-27 18:08 - 00775824 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll 2017-05-09 22:51 - 2017-04-27 18:07 - 00988168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll 2017-05-09 22:51 - 2017-04-27 18:06 - 02969880 _____ (Microsoft Corporation) C:\Windows\system32\CoreUIComponents.dll 2017-05-09 22:51 - 2017-04-27 18:06 - 00708712 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll 2017-05-09 22:51 - 2017-04-27 18:05 - 00923040 _____ (Microsoft Corporation) C:\Windows\system32\CoreMessaging.dll 2017-05-09 22:51 - 2017-04-27 18:04 - 00583160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CoreMessaging.dll 2017-05-09 22:51 - 2017-04-27 17:59 - 05477088 _____ (Microsoft Corporation) C:\Windows\system32\OneCoreUAPCommonProxyStub.dll 2017-05-09 22:51 - 2017-04-27 17:59 - 00207264 _____ (Microsoft Corporation) C:\Windows\system32\browserbroker.dll 2017-05-09 22:51 - 2017-04-27 17:59 - 00027040 _____ (Microsoft Corporation) C:\Windows\system32\browser_broker.exe 2017-05-09 22:51 - 2017-04-27 17:58 - 01852776 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2017-05-09 22:51 - 2017-04-27 17:58 - 00872472 _____ (Microsoft Corporation) C:\Windows\system32\ClipSVC.dll 2017-05-09 22:51 - 2017-04-27 17:57 - 03116184 _____ (Microsoft Corporation) C:\Windows\system32\combase.dll 2017-05-09 22:51 - 2017-04-27 17:55 - 21353200 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2017-05-09 22:51 - 2017-04-27 17:55 - 01325456 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll 2017-05-09 22:51 - 2017-04-27 17:53 - 00387928 _____ (Microsoft Corporation) C:\Windows\system32\wmpps.dll 2017-05-09 22:51 - 2017-04-27 17:52 - 00790528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.dll 2017-05-09 22:51 - 2017-04-27 17:52 - 00584192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIRibbonRes.dll 2017-05-09 22:51 - 2017-04-27 17:49 - 00072192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx 2017-05-09 22:51 - 2017-04-27 17:49 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\odbcconf.dll 2017-05-09 22:51 - 2017-04-27 17:46 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2017-05-09 22:51 - 2017-04-27 17:45 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll 2017-05-09 22:51 - 2017-04-27 17:41 - 01248768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AzureSettingSyncProvider.dll 2017-05-09 22:51 - 2017-04-27 17:40 - 00799232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TokenBroker.dll 2017-05-09 22:51 - 2017-04-27 17:40 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cldapi.dll 2017-05-09 22:51 - 2017-04-27 17:39 - 03655680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2017-05-09 22:51 - 2017-04-27 17:34 - 00891904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\autochk.exe 2017-05-09 22:51 - 2017-04-27 17:33 - 00089088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\olepro32.dll 2017-05-09 22:51 - 2017-04-27 17:15 - 01051648 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.dll 2017-05-09 22:51 - 2017-04-27 17:14 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\UIRibbonRes.dll 2017-05-09 22:51 - 2017-04-27 17:11 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx 2017-05-09 22:51 - 2017-04-27 17:11 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\odbcconf.dll 2017-05-09 22:51 - 2017-04-27 17:09 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2017-05-09 22:51 - 2017-04-27 17:09 - 00064512 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll 2017-05-09 22:51 - 2017-04-27 17:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\SettingsEnvironment.Desktop.dll 2017-05-09 22:51 - 2017-04-27 17:07 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2017-05-09 22:51 - 2017-04-27 17:06 - 01302528 _____ (Microsoft Corporation) C:\Windows\system32\MSVPXENC.dll 2017-05-09 22:51 - 2017-04-27 17:06 - 00527360 _____ (Microsoft Corporation) C:\Windows\system32\aadcloudap.dll 2017-05-09 22:51 - 2017-04-27 17:04 - 01878016 _____ (Microsoft Corporation) C:\Windows\system32\AzureSettingSyncProvider.dll 2017-05-09 22:51 - 2017-04-27 17:03 - 01085440 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll 2017-05-09 22:51 - 2017-04-27 17:03 - 01027584 _____ (Microsoft Corporation) C:\Windows\system32\modernexecserver.dll 2017-05-09 22:51 - 2017-04-27 17:03 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\cldapi.dll 2017-05-09 22:51 - 2017-04-27 17:02 - 01260544 _____ (Microsoft Corporation) C:\Windows\system32\GamePanel.exe 2017-05-09 22:51 - 2017-04-27 17:01 - 01886208 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentExtensions.onecore.dll 2017-05-09 22:51 - 2017-04-27 16:58 - 01054208 _____ (Microsoft Corporation) C:\Windows\system32\TokenBroker.dll 2017-05-09 22:51 - 2017-04-27 16:57 - 04730368 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2017-05-09 22:51 - 2017-04-27 16:57 - 02800128 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentServer.dll 2017-05-09 22:51 - 2017-04-27 16:54 - 00985600 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll 2017-05-09 22:51 - 2017-04-27 16:54 - 00970240 _____ (Microsoft Corporation) C:\Windows\system32\autochk.exe 2017-05-09 22:51 - 2017-04-27 16:54 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys 2017-05-09 22:51 - 2017-04-27 16:54 - 00414208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys 2017-05-09 22:51 - 2017-04-27 16:52 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.Streaming.ps.dll 2017-05-09 17:01 - 2017-05-09 17:01 - 00000759 _____ C:\Users\Rick 0\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\flashplayer_25_sa.lnk 2017-05-09 17:00 - 2017-05-09 17:00 - 14966264 _____ (Adobe Systems, Inc.) C:\Users\Rick 0\Documents\flashplayer_25_sa.exe 2017-05-09 16:53 - 2017-05-09 16:59 - 00004646 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier 2017-05-09 16:45 - 2017-05-09 16:59 - 00000000 ____D C:\Users\Neeko\AppData\Local\Adobe 2017-05-09 16:44 - 2017-05-09 16:59 - 00000000 ____D C:\Users\Rick 0\AppData\Local\Adobe 2017-05-09 16:35 - 2017-05-09 16:35 - 00000000 ____D C:\Users\Rick 0\Documents\sd thro 2017-05-08 22:26 - 2017-05-08 22:26 - 00000000 ____D C:\Users\Rick 0\AppData\LocalLow\Temp 2017-05-08 02:11 - 2017-05-08 02:11 - 00000000 ____D C:\Users\Rick 0\AppData\Local\Chromium 2017-05-08 02:08 - 2017-05-08 02:08 - 00000000 ____D C:\Users\Rick 0\AppData\Roaming\The Creative Assembly 2017-05-04 11:38 - 2017-05-04 11:38 - 00120000 _____ C:\Users\Rick 0\Documents\2016TurboTaxReturn.pdf 2017-05-04 00:32 - 2017-05-13 02:45 - 00000000 ____D C:\Users\Rick 0\AppData\Roaming\NVIDIA 2017-05-04 00:32 - 2017-05-04 00:32 - 00000000 ____D C:\Users\Rick 0\Documents\BioWare 2017-05-03 13:45 - 2017-05-03 13:45 - 00001166 _____ C:\Users\Public\Desktop\Mass Effect 2.lnk 2017-05-03 13:45 - 2017-05-03 13:45 - 00000000 ____D C:\Windows\SysWOW64\AGEIA 2017-05-03 13:45 - 2017-05-03 13:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation 2017-05-03 13:45 - 2017-05-03 13:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mass Effect 2 2017-05-03 13:45 - 2017-05-03 13:45 - 00000000 ____D C:\Program Files (x86)\AGEIA Technologies 2017-05-03 13:15 - 2017-05-03 13:32 - 00000000 ____D C:\Program Files (x86)\Mass Effect 2 2017-05-02 18:55 - 2017-05-19 19:53 - 00000000 ____D C:\Users\Rick 0\AppData\Roaming\Origin 2017-05-02 18:52 - 2017-05-02 18:56 - 00000000 ____D C:\Users\Rick 0\AppData\Local\Origin 2017-05-02 18:52 - 2017-05-02 18:52 - 00000000 ____D C:\Users\Rick 0\.QtWebEngineProcess 2017-05-02 18:52 - 2017-05-02 18:52 - 00000000 ____D C:\Users\Rick 0\.Origin 2017-04-29 23:07 - 2017-04-18 23:18 - 00118784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netvsc.sys 2017-04-29 23:07 - 2017-04-18 23:13 - 00980992 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bthport.sys 2017-04-29 23:07 - 2017-04-18 22:58 - 20374424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2017-04-29 23:07 - 2017-04-18 22:36 - 01291776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSVPXENC.dll 2017-04-29 23:07 - 2017-04-18 22:34 - 00507392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2017-04-29 23:07 - 2017-04-18 22:30 - 00909312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSyncCore.dll 2017-04-29 23:07 - 2017-04-18 22:29 - 02298880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll 2017-04-29 23:07 - 2017-04-13 16:43 - 04469832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe 2017-04-29 23:07 - 2017-04-13 16:31 - 01611776 _____ (Microsoft Corporation) C:\Windows\system32\SpeechPal.dll 2017-04-29 23:07 - 2017-04-13 16:21 - 06728192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll 2017-04-29 23:07 - 2017-04-13 16:18 - 00731136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmgaserver.exe 2017-04-29 23:07 - 2017-04-13 16:18 - 00362496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\daxexec.dll 2017-04-29 23:07 - 2017-04-13 16:13 - 00354304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InputSwitch.dll 2017-04-29 23:06 - 2017-04-19 00:06 - 00651680 _____ (Microsoft Corporation) C:\Windows\system32\SettingSyncHost.exe 2017-04-29 23:06 - 2017-04-19 00:04 - 00142240 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wcifs.sys 2017-04-29 23:06 - 2017-04-19 00:02 - 00716440 _____ (Microsoft Corporation) C:\Windows\system32\MSVideoDSP.dll 2017-04-29 23:06 - 2017-04-18 23:19 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\musdialoghandlers.dll 2017-04-29 23:06 - 2017-04-18 23:13 - 00585728 _____ (Microsoft Corporation) C:\Windows\system32\OneDriveSettingSyncProvider.dll 2017-04-29 23:06 - 2017-04-18 23:12 - 00805888 _____ (Microsoft Corporation) C:\Windows\system32\ieproxy.dll 2017-04-29 23:06 - 2017-04-18 23:12 - 00590848 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2017-04-29 23:06 - 2017-04-18 23:12 - 00203776 _____ (Microsoft Corporation) C:\Windows\system32\PackageStateRoaming.dll 2017-04-29 23:06 - 2017-04-18 23:11 - 04446208 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers_nt.dll 2017-04-29 23:06 - 2017-04-18 23:10 - 04175872 _____ (Microsoft Corporation) C:\Windows\system32\StartTileData.dll 2017-04-29 23:06 - 2017-04-18 23:10 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Shell.UnifiedTile.CuratedTileCollections.dll 2017-04-29 23:06 - 2017-04-18 23:10 - 01600512 _____ (Microsoft Corporation) C:\Windows\system32\dbghelp.dll 2017-04-29 23:06 - 2017-04-18 23:08 - 01103872 _____ (Microsoft Corporation) C:\Windows\system32\SettingSyncCore.dll 2017-04-29 23:06 - 2017-04-18 23:07 - 01242624 _____ (Microsoft Corporation) C:\Windows\system32\SharedStartModel.dll 2017-04-29 23:06 - 2017-04-18 23:07 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe 2017-04-29 23:06 - 2017-04-18 23:06 - 02651648 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll 2017-04-29 23:06 - 2017-04-18 23:04 - 01356800 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll 2017-04-29 23:06 - 2017-04-18 23:04 - 00624640 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll 2017-04-29 23:06 - 2017-04-18 23:02 - 00559000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSyncHost.exe 2017-04-29 23:06 - 2017-04-18 23:01 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\catsrvps.dll 2017-04-29 23:06 - 2017-04-18 22:59 - 02435584 _____ (Microsoft Corporation) C:\Windows\system32\ResetEngine.dll 2017-04-29 23:06 - 2017-04-18 22:37 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WiFiDisplay.dll 2017-04-29 23:06 - 2017-04-18 22:35 - 00476672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\OneDriveSettingSyncProvider.dll 2017-04-29 23:06 - 2017-04-18 22:34 - 00358400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieproxy.dll 2017-04-29 23:06 - 2017-04-18 22:34 - 00175616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PackageStateRoaming.dll 2017-04-29 23:06 - 2017-04-18 22:32 - 01285120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbghelp.dll 2017-04-29 23:06 - 2017-04-13 17:35 - 04848440 _____ (Microsoft Corporation) C:\Windows\explorer.exe 2017-04-29 23:06 - 2017-04-13 17:33 - 02085280 _____ (Microsoft Corporation) C:\Windows\system32\UpdateAgent.dll 2017-04-29 23:06 - 2017-04-13 17:30 - 00105456 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll 2017-04-29 23:06 - 2017-04-13 16:43 - 00523296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppResolver.dll 2017-04-29 23:06 - 2017-04-13 16:41 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\mssprxy.dll 2017-04-29 23:06 - 2017-04-13 16:40 - 00095584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll 2017-04-29 23:06 - 2017-04-13 16:39 - 07931392 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll 2017-04-29 23:06 - 2017-04-13 16:39 - 00974848 _____ (Microsoft Corporation) C:\Windows\system32\mmgaserver.exe 2017-04-29 23:06 - 2017-04-13 16:39 - 00334336 _____ (Microsoft Corporation) C:\Windows\system32\wc_storage.dll 2017-04-29 23:06 - 2017-04-13 16:39 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\VEStoreEventHandlers.dll 2017-04-29 23:06 - 2017-04-13 16:38 - 00251904 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Gaming.Preview.dll 2017-04-29 23:06 - 2017-04-13 16:37 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\NotificationObjFactory.dll 2017-04-29 23:06 - 2017-04-13 16:35 - 01433600 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettings.Handlers.dll 2017-04-29 23:06 - 2017-04-13 16:35 - 00510976 _____ (Microsoft Corporation) C:\Windows\system32\TDLMigration.dll 2017-04-29 23:06 - 2017-04-13 16:35 - 00257024 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2017-04-29 23:06 - 2017-04-13 16:34 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\InputSwitch.dll 2017-04-29 23:06 - 2017-04-13 16:33 - 01269760 _____ (Microsoft Corporation) C:\Windows\system32\enterprisecsps.dll 2017-04-29 23:06 - 2017-04-13 16:31 - 00673280 _____ (Microsoft Corporation) C:\Windows\system32\LockAppBroker.dll 2017-04-29 23:06 - 2017-04-13 16:29 - 01583616 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2017-04-29 23:06 - 2017-04-13 16:29 - 01295872 _____ (Microsoft Corporation) C:\Windows\system32\dosvc.dll 2017-04-29 23:06 - 2017-04-13 16:26 - 01257472 _____ (Microsoft Corporation) C:\Windows\system32\wpnapps.dll 2017-04-29 23:06 - 2017-04-13 16:25 - 00750080 _____ (Microsoft Corporation) C:\Windows\system32\StorSvc.dll 2017-04-29 23:06 - 2017-04-13 16:24 - 01628160 _____ (Microsoft Corporation) C:\Windows\system32\comsvcs.dll 2017-04-29 23:06 - 2017-04-13 16:21 - 00078848 _____ (Microsoft Corporation) C:\Windows\system32\offreg.dll 2017-04-29 23:06 - 2017-04-13 16:15 - 00282112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VEEventDispatcher.dll 2017-04-29 23:06 - 2017-04-13 16:15 - 00232448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CloudBackupSettings.dll 2017-04-29 23:06 - 2017-04-13 16:13 - 00232960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll 2017-04-29 23:06 - 2017-04-13 16:08 - 01463296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2017-04-29 23:06 - 2017-04-13 16:06 - 00987648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpnapps.dll 2017-04-29 23:06 - 2017-04-13 16:04 - 00392704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PlayToManager.dll 2017-04-29 23:06 - 2017-04-13 16:01 - 00057856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\offreg.dll 2017-04-29 23:05 - 2017-04-19 00:07 - 00712600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms2.sys 2017-04-29 23:05 - 2017-04-18 23:16 - 00280064 _____ (Microsoft Corporation) C:\Windows\system32\WiFiDisplay.dll 2017-04-29 23:05 - 2017-04-18 23:15 - 00232960 _____ (Microsoft Corporation) C:\Windows\system32\wcmcsp.dll 2017-04-29 23:05 - 2017-04-18 23:14 - 00646656 _____ (Microsoft Corporation) C:\Windows\system32\LockHostingFramework.dll 2017-04-29 23:05 - 2017-04-18 23:13 - 00409600 _____ (Microsoft Corporation) C:\Windows\system32\updatehandlers.dll 2017-04-29 23:05 - 2017-04-18 23:11 - 00687104 _____ (Microsoft Corporation) C:\Windows\system32\LogonController.dll 2017-04-29 23:05 - 2017-04-18 23:08 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\usocore.dll 2017-04-29 23:05 - 2017-04-18 22:59 - 01087488 _____ (Microsoft Corporation) C:\Windows\system32\reseteng.dll 2017-04-29 23:05 - 2017-04-13 17:35 - 00741784 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Internal.Shell.Broker.dll 2017-04-29 23:05 - 2017-04-13 17:35 - 00673112 _____ (Microsoft Corporation) C:\Windows\system32\AppResolver.dll 2017-04-29 23:05 - 2017-04-13 17:32 - 01320352 _____ (Microsoft Corporation) C:\Windows\system32\wpx.dll 2017-04-29 23:05 - 2017-04-13 16:41 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\EnterpriseModernAppMgmtCSP.dll 2017-04-29 23:05 - 2017-04-13 16:39 - 00517632 _____ (Microsoft Corporation) C:\Windows\system32\daxexec.dll 2017-04-29 23:05 - 2017-04-13 16:38 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.AppDefaults.dll 2017-04-29 23:05 - 2017-04-13 16:37 - 00450048 _____ (Microsoft Corporation) C:\Windows\system32\bcdedit.exe 2017-04-29 23:05 - 2017-04-13 16:37 - 00301056 _____ (Microsoft Corporation) C:\Windows\system32\EnterpriseAppMgmtSvc.dll 2017-04-29 23:05 - 2017-04-13 16:37 - 00246272 _____ (Microsoft Corporation) C:\Windows\system32\domgmt.dll 2017-04-29 23:05 - 2017-04-13 16:36 - 00524800 _____ (Microsoft Corporation) C:\Windows\system32\TileDataRepository.dll 2017-04-29 23:05 - 2017-04-13 16:36 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\CloudBackupSettings.dll 2017-04-29 23:05 - 2017-04-13 16:34 - 01468416 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentExtensions.desktop.dll 2017-04-29 23:05 - 2017-04-13 16:33 - 00864256 _____ (Microsoft Corporation) C:\Windows\system32\NotificationController.dll 2017-04-29 23:05 - 2017-04-13 16:29 - 02499584 _____ (Microsoft Corporation) C:\Windows\system32\twinui.pcshell.dll 2017-04-29 23:05 - 2017-04-13 16:29 - 00840192 _____ (Microsoft Corporation) C:\Windows\system32\fveapi.dll 2017-04-29 23:05 - 2017-04-13 16:29 - 00647168 _____ (Microsoft Corporation) C:\Windows\system32\RDXService.dll 2017-04-29 23:05 - 2017-04-13 16:28 - 02443776 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll 2017-04-28 19:07 - 2017-04-28 19:07 - 00000000 ____D C:\Users\Neeko\AppData\Roaming\Macromedia 2017-04-28 18:38 - 2017-04-28 18:38 - 00000000 ____D C:\Users\Rick 0\Documents\League of Legends 2017-04-28 18:32 - 2017-04-28 18:32 - 00067728 _____ C:\Users\Rick 0\Downloads\ListeningPortfolioSPAN202.pdf 2017-04-28 16:39 - 2017-04-28 16:39 - 00098256 _____ C:\Users\Rick 0\Downloads\ListeningPortfolio_Sugerencias_Spring2017.pdf 2017-04-28 16:30 - 2017-05-24 02:28 - 00000000 ____D C:\Users\Rick 0\AppData\Local\CrashDumps 2017-04-28 16:21 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll 2017-04-28 16:21 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll 2017-04-28 16:21 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll 2017-04-28 16:21 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll 2017-04-28 16:21 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll 2017-04-28 16:21 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll 2017-04-28 16:21 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll 2017-04-28 16:21 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll 2017-04-28 16:21 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll 2017-04-28 16:21 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_43.dll 2017-04-28 16:21 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll 2017-04-28 16:21 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll 2017-04-28 16:21 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll 2017-04-28 16:21 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll 2017-04-28 16:21 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll 2017-04-28 16:21 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll 2017-04-27 16:06 - 2017-04-27 16:06 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_esif_umdf2_02_00_00.Wdf 2017-04-27 16:06 - 2017-04-27 16:06 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_esif_lf_01011.Wdf 2017-04-27 16:05 - 2017-05-24 10:58 - 00000130 _____ C:\Users\Rick 0\Documents\New Text Document.txt 2017-04-27 16:05 - 2017-04-27 16:05 - 00000000 ____D C:\Windows\system32\Intel 2017-04-26 20:03 - 2017-04-26 20:03 - 00266367 _____ C:\Users\Rick 0\Downloads\EClare.pdf 2017-04-25 12:04 - 2017-04-25 12:04 - 00000000 ____D C:\Users\Rick 0\Documents\DAMN_ ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2017-05-25 18:38 - 2017-04-21 16:47 - 00000000 ____D C:\FRST 2017-05-25 18:37 - 2017-04-21 16:42 - 02429952 _____ (Farbar) C:\Users\Neeko\Desktop\FRST64.exe 2017-05-25 18:29 - 2017-04-21 16:11 - 00000000 ____D C:\Windows\system32\SleepStudy 2017-05-25 16:07 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\AppReadiness 2017-05-25 14:10 - 2017-03-18 14:03 - 00000000 ___HD C:\Program Files\WindowsApps 2017-05-25 14:02 - 2017-04-22 11:06 - 00000000 ____D C:\ProgramData\MCShield 2017-05-25 14:01 - 2017-04-23 01:40 - 00000000 ____D C:\Program Files (x86)\Steam 2017-05-25 14:01 - 2017-04-21 16:30 - 00000180 _____ C:\Windows\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat 2017-05-25 14:01 - 2017-04-21 16:30 - 00000000 __SHD C:\Users\Neeko\IntelGraphicsProfiles 2017-05-25 13:51 - 2017-04-23 02:02 - 00000000 __SHD C:\Users\Rick 0\IntelGraphicsProfiles 2017-05-25 13:41 - 2017-04-22 11:09 - 00000000 ____D C:\ProgramData\NVIDIA 2017-05-25 13:41 - 2017-04-21 16:28 - 00000000 ____D C:\ProgramData\Synaptics 2017-05-25 13:41 - 2017-04-21 16:11 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2017-05-25 13:37 - 2017-03-18 04:40 - 01310720 _____ C:\Windows\system32\config\BBI 2017-05-25 13:31 - 2017-04-21 16:20 - 01595598 _____ C:\Windows\system32\PerfStringBackup.INI 2017-05-25 00:33 - 2017-04-23 02:01 - 00000000 ____D C:\Users\Rick 0 2017-05-24 13:55 - 2017-04-23 02:02 - 00000000 ____D C:\Users\Rick 0\AppData\Local\Packages 2017-05-24 01:42 - 2017-04-23 03:09 - 00000000 ____D C:\Users\Rick 0\Documents\My Games 2017-05-23 15:06 - 2017-04-23 11:43 - 00000000 ____D C:\Users\Rick 0\Documents\Moduntandblade mods 2017-05-23 10:56 - 2017-04-23 10:59 - 00000000 ____D C:\Windows\system32\MRT 2017-05-23 10:54 - 2017-04-23 10:58 - 132223576 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe 2017-05-19 19:21 - 2017-04-23 02:03 - 00000000 ____D C:\Users\Rick 0\AppData\Roaming\Apple Computer 2017-05-19 19:00 - 2017-04-23 02:12 - 00004214 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1492938726 2017-05-19 19:00 - 2017-04-23 02:12 - 00001433 _____ C:\Users\Rick 0\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Opera.lnk 2017-05-16 16:02 - 2017-03-18 14:01 - 00000000 ____D C:\Windows\INF 2017-05-16 11:30 - 2017-04-21 16:23 - 00000000 ____D C:\Users\Neeko\AppData\Local\Packages 2017-05-16 11:29 - 2017-04-21 16:23 - 00000000 __RHD C:\Users\Public\AccountPictures 2017-05-14 18:50 - 2017-04-23 11:53 - 00000000 ____D C:\Users\Rick 0\Documents\PSU 2017-05-12 13:53 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\rescache 2017-05-11 13:39 - 2017-04-23 16:02 - 00000000 ____D C:\Users\Rick 0\Desktop\Nexus Mod Manager 2017-05-11 13:39 - 2017-04-23 02:07 - 00000000 ____D C:\Users\Rick 0\Desktop\mods 2017-05-10 00:17 - 2017-04-21 16:11 - 00217000 _____ C:\Windows\system32\FNTCACHE.DAT 2017-05-10 00:15 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\system32\appraiser 2017-05-10 00:15 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\ShellExperiences 2017-05-10 00:15 - 2017-03-18 14:03 - 00000000 ____D C:\Program Files\Windows Photo Viewer 2017-05-10 00:15 - 2017-03-18 14:03 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer 2017-05-09 22:56 - 2017-03-18 13:51 - 00000000 ____D C:\Windows\CbsTemp 2017-05-09 16:59 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\SysWOW64\Macromed 2017-05-09 16:59 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\system32\Macromed 2017-05-02 18:54 - 2017-04-23 11:13 - 00000000 ____D C:\ProgramData\Package Cache 2017-05-01 00:02 - 2017-03-18 14:03 - 00000000 ___SD C:\Windows\SysWOW64\F12 2017-05-01 00:02 - 2017-03-18 14:03 - 00000000 ___SD C:\Windows\system32\F12 2017-05-01 00:02 - 2017-03-18 14:03 - 00000000 ___RD C:\Windows\ImmersiveControlPanel 2017-05-01 00:02 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\SysWOW64\Dism 2017-05-01 00:02 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\system32\WinBioPlugIns 2017-05-01 00:02 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\Provisioning 2017-05-01 00:02 - 2017-03-18 04:40 - 00000000 ____D C:\Windows\system32\Dism 2017-04-28 18:38 - 2017-04-23 11:20 - 00001749 _____ C:\Users\Public\Desktop\League of Legends.lnk 2017-04-28 18:05 - 2017-03-18 14:06 - 00835576 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2017-04-28 18:05 - 2017-03-18 14:06 - 00177656 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2017-04-28 16:18 - 2017-03-18 14:03 - 00000000 ____D C:\Program Files\Common Files\microsoft shared 2017-04-26 10:38 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\appcompat Some files in TEMP: ==================== 2017-04-21 16:31 - 2017-03-18 13:57 - 1930320 _____ (Microsoft Corporation) C:\Users\Neeko\AppData\Local\Temp\dllnt_dump.dll ==================== Bamital & volsnap ====================== (There is no automatic fix for files that do not pass verification.) C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\dnsapi.dll => File is digitally signed C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2017-05-24 11:09 ==================== End of FRST.txt ============================ addition log Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-05-2017 Ran by Neeko (25-05-2017 18:38:40) Running from C:\Users\Neeko\Desktop Windows 10 Home Version 1703 (X64) (2017-04-21 23:17:14) Boot Mode: Normal ========================================================== ==================== Accounts: ============================= Administrator (S-1-5-21-166261395-844033189-1565394352-500 - Administrator - Disabled) DefaultAccount (S-1-5-21-166261395-844033189-1565394352-503 - Limited - Disabled) Guest (S-1-5-21-166261395-844033189-1565394352-501 - Limited - Disabled) Neeko (S-1-5-21-166261395-844033189-1565394352-1001 - Administrator - Enabled) => C:\Users\Neeko Rick 0 (S-1-5-21-166261395-844033189-1565394352-1002 - Limited - Enabled) => C:\Users\Rick 0 ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) 7-Zip 16.04 (x64) (HKLM\...\7-Zip) (Version: 16.04 - Igor Pavlov) Adobe Flash Player 11 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 11.1.102.55 - Adobe Systems Incorporated) Adobe Flash Player 25 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 25.0.0.171 - Adobe Systems Incorporated) Ansel (Version: 377.19 - NVIDIA Corporation) Hidden Apple Application Support (32-bit) (HKLM-x32\...\{05E07D23-91E9-4E70-A4CC-EF505088F967}) (Version: 5.4.1 - Apple Inc.) Apple Application Support (64-bit) (HKLM\...\{741291DA-2B34-4D44-8FB6-58EDE21261D8}) (Version: 5.4.1 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{DB18F1C0-846F-46F5-A074-5B97C8AF5C8E}) (Version: 10.3.1.2 - Apple Inc.) Apple Software Update (HKLM-x32\...\{52D87F32-70E4-4348-8148-C0B9F35B1314}) (Version: 2.3.0.177 - Apple Inc.) Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.) Chivalry: Medieval Warfare (HKLM\...\Steam App 219640) (Version: - Torn Banner Studios) Intel(R) Chipset Device Software (x32 Version: 10.1.1.42 - Intel(R) Corporation) Hidden Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.4549 - Intel Corporation) iTunes (HKLM\...\{6C01A0A7-7440-4D48-93C6-2927A1E93FE6}) (Version: 12.6.0.100 - Apple Inc.) League of Legends (HKLM-x32\...\League of Legends 4.1.2) (Version: 4.1.2 - Riot Games) League of Legends (x32 Version: 4.1.2 - Riot Games) Hidden Mass Effect 2 (HKLM-x32\...\{75D84EF7-0D8C-4e70-B3FA-7B42A5D4E0EB}) (Version: 1.00 - Electronic Arts, Inc.) MCShield ::Anti-Malware Tool:: (HKLM-x32\...\MCShield) (Version: 3.0.5.28 - MyCity) Microsoft OneDrive (HKU\S-1-5-21-166261395-844033189-1565394352-1001\...\OneDriveSetup.exe) (Version: 17.3.6816.0313 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation) Nexus Mod Manager (HKLM\...\6af12c54-643b-4752-87d0-8335503010de_is1) (Version: 0.63.14 - Black Tree Gaming) No More Room in Hell (HKLM\...\Steam App 224260) (Version: - No More Room in Hell Team) NVIDIA Graphics Driver 377.19 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 377.19 - NVIDIA Corporation) NVIDIA PhysX (HKLM-x32\...\{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}) (Version: 9.09.0814 - NVIDIA Corporation) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7730 - Realtek Semiconductor Corp.) Sophos Virus Removal Tool (HKLM-x32\...\{B829E117-D072-41EA-9606-9826A38D34C1}) (Version: 2.5.6 - Sophos Limited) STAR WARS™ Jedi Knight: Jedi Academy™ (HKLM\...\Steam App 6020) (Version: - Raven Software) Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation) Synaptics ClickPad Driver (HKLM\...\SynTPDeinstKey) (Version: 19.2.4.10 - Synaptics Incorporated) The Elder Scrolls V: Skyrim (HKLM\...\Steam App 72850) (Version: - Bethesda Game Studios) Total War: SHOGUN 2 (HKLM\...\Steam App 34330) (Version: - The Creative Assembly) Unchecky v1.0.2 (HKLM-x32\...\Unchecky) (Version: 1.0.2 - RaMMicHaeL) Vampire: The Masquerade - Bloodlines (HKLM\...\Steam App 2600) (Version: - Troika Games) VirtualDJ 8 (HKLM-x32\...\{CBE3A208-6EE2-4FD1-B888-00BA54022FDC}) (Version: 8.2.3734.0 - Atomix Productions) Vulkan Run Time Libraries 1.0.26.0 (HKLM\...\VulkanRT1.0.26.0) (Version: 1.0.26.0 - LunarG, Inc.) XCom Long War EW Mod version 1.0 (HKLM-x32\...\{860C3266-65B9-4BF2-937A-1778483046B5}_is1) (Version: 1.0 - JohnnyLump) XCOM: Enemy Unknown (HKLM\...\Steam App 200510) (Version: - Firaxis Games) ==================== Custom CLSID (Whitelisted): ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== Scheduled Tasks (Whitelisted) ============= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) Task: {227E73A4-94C7-4435-B06B-458EF8191271} - System32\Tasks\Opera scheduled Autoupdate 1492938726 => C:\Users\Rick 0\AppData\Local\Programs\Opera\launcher.exe [2017-05-14] (Opera Software) Task: {C2A36005-B47E-45D3-8EB5-B167E47CC5AE} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_25_0_0_171_pepper.exe [2017-05-09] (Adobe Systems Incorporated) (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) Task: C:\Windows\Tasks\CreateExplorerShellUnelevatedTask.job => C:\Windows\explorer.exe ==================== Shortcuts ============================= (The entries could be listed to be restored or removed.) ==================== Loaded Modules (Whitelisted) ============== 2017-03-16 16:08 - 2017-03-16 16:08 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll 2017-03-16 16:08 - 2017-03-16 16:08 - 01354040 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll 2017-03-18 13:58 - 2017-03-18 13:58 - 00138000 _____ () C:\Windows\SYSTEM32\inputhost.dll 2017-03-18 13:59 - 2017-03-18 19:31 - 01731072 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll ==================== Alternate Data Streams (Whitelisted) ========= (If an entry is included in the fixlist, only the ADS will be removed.) ==================== Safe Mode (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== Association (Whitelisted) =============== (If an entry is included in the fixlist, the registry item will be restored to default or removed.) ==================== Internet Explorer trusted/restricted =============== (If an entry is included in the fixlist, it will be removed from the registry.) ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2017-03-18 14:03 - 2017-05-25 13:41 - 00002024 _____ C:\Windows\system32\Drivers\etc\hosts 0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomaly 0.0.0.0 tracking.opencandy.com.s3.amazonaws.com 0.0.0.0 media.opencandy.com 0.0.0.0 cdn.opencandy.com 0.0.0.0 tracking.opencandy.com 0.0.0.0 api.opencandy.com 0.0.0.0 api.recommendedsw.com 0.0.0.0 installer.betterinstaller.com 0.0.0.0 installer.filebulldog.com 0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net 0.0.0.0 inno.bisrv.com 0.0.0.0 nsis.bisrv.com 0.0.0.0 cdn.file2desktop.com 0.0.0.0 cdn.goateastcach.us 0.0.0.0 cdn.guttastatdk.us 0.0.0.0 cdn.inskinmedia.com 0.0.0.0 cdn.insta.oibundles2.com 0.0.0.0 cdn.insta.playbryte.com 0.0.0.0 cdn.llogetfastcach.us 0.0.0.0 cdn.montiera.com 0.0.0.0 cdn.msdwnld.com 0.0.0.0 cdn.mypcbackup.com 0.0.0.0 cdn.ppdownload.com 0.0.0.0 cdn.riceateastcach.us 0.0.0.0 cdn.shyapotato.us 0.0.0.0 cdn.solimba.com 0.0.0.0 cdn.tuto4pc.com 0.0.0.0 cdn.appround.biz 0.0.0.0 cdn.bigspeedpro.com 0.0.0.0 cdn.bispd.com There are 4 more lines. ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-166261395-844033189-1565394352-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\Windows\img0.jpg DNS Servers: 66.253.214.16 - 50.30.184.16 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) Windows Firewall is enabled. ==================== MSCONFIG/TASK MANAGER disabled items == ==================== FirewallRules (Whitelisted) =============== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) FirewallRules: [{3C00E47E-854D-4D8B-A007-3A70ECF35823}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{7A9CE419-C4A6-428F-AE60-AC45929012AE}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{FE3F1B7F-7047-4430-A5CB-71E4493B86FB}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{8E239960-A4CC-4421-A5BD-09A255400A4F}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{635F5ECE-2183-4967-B139-97EBBF83F47E}] => (Allow) C:\Program Files\iTunes\iTunes.exe FirewallRules: [{BFD5C38A-6823-4F25-BA40-238731852BE4}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe FirewallRules: [{35FEEAC4-46A2-4410-9BE9-F005CEEA97CE}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe FirewallRules: [{B057F416-53A6-4C6F-8C21-C88420942318}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe FirewallRules: [{90D614FB-523B-4851-AFEA-6FC18F06EC25}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe FirewallRules: [{5D238DCD-CFF8-45DD-AE88-21C33C3CD67F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe FirewallRules: [{7FE60437-9651-4408-94F8-EA18ADB97E29}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe FirewallRules: [{68229938-B1CF-4D61-9C9E-FFD538720F47}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Total War SHOGUN 2\Shogun2.exe FirewallRules: [{6C669914-FFF6-4E4B-99A2-73A6B84F95D9}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Total War SHOGUN 2\Shogun2.exe FirewallRules: [{3742DBA0-3DE4-4B63-B472-D1F5ED252790}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\chivalrymedievalwarfare\Binaries\Win64\CMW.exe FirewallRules: [{FDA96598-BE4F-4926-A337-C41D33F2766C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\chivalrymedievalwarfare\Binaries\Win64\CMW.exe FirewallRules: [{9C86BCE6-DB0F-413A-B41D-246A5D14621B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\chivalrymedievalwarfare\Binaries\Win32\CMW.exe FirewallRules: [{41518BCE-A1D1-483E-8E98-7CEA964E26CF}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\chivalrymedievalwarfare\Binaries\Win32\CMW.exe FirewallRules: [{49F84B8A-C598-4767-8BCE-E0ACF0B1C2F8}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\chivalrymedievalwarfare\ChivLauncher.exe FirewallRules: [{DDE1C744-CFF9-4179-A653-F5CF4CC5143A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\chivalrymedievalwarfare\ChivLauncher.exe FirewallRules: [{EDC6298A-6F43-4C82-873E-0F23B26F7C16}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\nmrih\sdk\hl2.exe FirewallRules: [{C057B7F8-667E-4084-A1DB-FB302CB33836}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\nmrih\sdk\hl2.exe FirewallRules: [{66D0F362-AB4C-42C4-9301-C4F34A2A590A}] => (Allow) C:\Program Files (x86)\Mass Effect 2\Binaries\MassEffect2.exe FirewallRules: [{B2A87300-6B0D-4A3A-8428-179FA0194906}] => (Allow) C:\Program Files (x86)\Mass Effect 2\Binaries\MassEffect2.exe FirewallRules: [{989952DC-B4D2-4276-AAB7-FE2FF3B6566C}] => (Allow) C:\Program Files (x86)\Mass Effect 2\MassEffect2Launcher.exe FirewallRules: [{986BCF36-29D9-4324-A3E8-2DF1055B5739}] => (Allow) C:\Program Files (x86)\Mass Effect 2\MassEffect2Launcher.exe FirewallRules: [{DE36195A-5144-4221-A79B-7715DFBEA64F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Jedi Academy\GameData\jasp.exe FirewallRules: [{51C7DDE8-F514-43A3-86DB-21282164F264}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Jedi Academy\GameData\jasp.exe FirewallRules: [{4D47512C-C415-40E1-A8C5-835D03A9D044}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Jedi Academy\GameData\jamp.exe FirewallRules: [{4A10CDCB-29B0-49A1-B1A6-CA3ABEBEB6D6}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Jedi Academy\GameData\jamp.exe FirewallRules: [{B0D84DE2-67AC-40D7-9471-B1F31CD2F4E0}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\XCom-Enemy-Unknown\Binaries\Win32\XComGame.exe FirewallRules: [{32434A64-AEA7-4A9B-8343-F262C67AA9C4}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\XCom-Enemy-Unknown\Binaries\Win32\XComGame.exe FirewallRules: [{AF705E2C-102D-4F55-A5B4-13FCB92DF0CC}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Vampire The Masquerade - Bloodlines\vampire.exe FirewallRules: [{F52CB4FC-24F3-40DD-BC2A-94AC207C360E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Vampire The Masquerade - Bloodlines\vampire.exe FirewallRules: [TCP Query User{8C6CB43C-FA3C-4299-AF74-4F7A4FBD6443}C:\program files (x86)\steam\steamapps\common\xcom-enemy-unknown\xew\binaries\win32\xcomew.exe] => (Block) C:\program files (x86)\steam\steamapps\common\xcom-enemy-unknown\xew\binaries\win32\xcomew.exe FirewallRules: [UDP Query User{9BEEB072-F366-4B38-A00E-D511159F0086}C:\program files (x86)\steam\steamapps\common\xcom-enemy-unknown\xew\binaries\win32\xcomew.exe] => (Block) C:\program files (x86)\steam\steamapps\common\xcom-enemy-unknown\xew\binaries\win32\xcomew.exe ==================== Restore Points ========================= 23-05-2017 10:53:05 Windows Update 25-05-2017 14:18:13 JRT Pre-Junkware Removal ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (05/25/2017 05:37:30 PM) (Source: SecurityCenter) (EventID: 16) (User: ) Description: Error while updating Windows Defender status to SECURITY_PRODUCT_STATE_ON. Error: (05/25/2017 05:37:30 PM) (Source: SecurityCenter) (EventID: 16) (User: ) Description: Error while updating Windows Defender status to SECURITY_PRODUCT_STATE_ON. Error: (05/25/2017 05:33:28 PM) (Source: SecurityCenter) (EventID: 16) (User: ) Description: Error while updating Windows Defender status to SECURITY_PRODUCT_STATE_ON. Error: (05/25/2017 05:33:28 PM) (Source: SecurityCenter) (EventID: 16) (User: ) Description: Error while updating Windows Defender status to SECURITY_PRODUCT_STATE_ON. Error: (05/25/2017 02:10:37 PM) (Source: SecurityCenter) (EventID: 16) (User: ) Description: Error while updating Windows Defender status to SECURITY_PRODUCT_STATE_ON. Error: (05/25/2017 02:10:37 PM) (Source: SecurityCenter) (EventID: 16) (User: ) Description: Error while updating Windows Defender status to SECURITY_PRODUCT_STATE_ON. Error: (05/24/2017 07:49:29 PM) (Source: VSS) (EventID: 8193) (User: ) Description: Volume Shadow Copy Service error: Unexpected error calling routine QueryFullProcessImageNameW. hr = 0x80070006, The handle is invalid. . Operation: Executing Asynchronous Operation Context: Current State: DoSnapshotSet Error: (05/24/2017 11:40:29 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-M7IRLC6) Description: Activation of app Microsoft.WindowsStore_8wekyb3d8bbwe!App failed with error: -2144927142 See the Microsoft-Windows-TWinUI/Operational log for additional information. Error: (05/24/2017 11:28:44 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-M7IRLC6) Description: Activation of app Microsoft.Windows.Photos_8wekyb3d8bbwe!App failed with error: -2144927142 See the Microsoft-Windows-TWinUI/Operational log for additional information. Error: (05/24/2017 11:13:47 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-M7IRLC6) Description: Activation of app Microsoft.Windows.Photos_8wekyb3d8bbwe!App failed with error: -2144927142 See the Microsoft-Windows-TWinUI/Operational log for additional information. System errors: ============= Error: (05/25/2017 04:01:49 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY) Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D63B10C5-BB46-4990-A94F-E40B9D520160} and APPID {9CA88EE3-ACB7-47C8-AFC4-AB702511C276} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. Error: (05/25/2017 02:13:24 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY) Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D63B10C5-BB46-4990-A94F-E40B9D520160} and APPID {9CA88EE3-ACB7-47C8-AFC4-AB702511C276} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. Error: (05/25/2017 01:41:10 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The SecDrv service failed to start due to the following error: This driver has been blocked from loading Error: (05/25/2017 01:41:10 PM) (Source: Application Popup) (EventID: 1060) (User: ) Description: \??\C:\Windows\SysWow64\drivers\SECDRV.SYS Error: (05/25/2017 01:41:09 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The CldFlt service failed to start due to the following error: The request is not supported. Error: (05/25/2017 01:34:45 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY) Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} and APPID {4839DDB7-58C2-48F5-8283-E1D1807D0D7D} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. Error: (05/25/2017 01:34:45 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY) Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} and APPID {4839DDB7-58C2-48F5-8283-E1D1807D0D7D} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. Error: (05/25/2017 01:27:31 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY) Description: The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {C2F03A33-21F5-47FA-B4BB-156362A2F239} and APPID {316CDED5-E4AE-4B15-9113-7055D84DCC97} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. Error: (05/25/2017 01:27:31 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY) Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} and APPID {4839DDB7-58C2-48F5-8283-E1D1807D0D7D} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. Error: (05/25/2017 01:27:31 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY) Description: The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {C2F03A33-21F5-47FA-B4BB-156362A2F239} and APPID {316CDED5-E4AE-4B15-9113-7055D84DCC97} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. CodeIntegrity: =================================== Date: 2017-05-25 17:33:33.390 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Windows\System32\DriverStore\FileRepository\nvhm.inf_amd64_0460fff687def1f0\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2017-05-25 14:18:49.494 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2017-05-25 14:18:49.492 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2017-05-25 14:18:49.461 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2017-05-25 14:18:49.459 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2017-05-25 14:18:49.411 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2017-05-25 14:18:49.408 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2017-05-25 13:09:21.426 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2017-05-25 13:09:21.417 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2017-05-25 12:08:00.711 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements. ==================== Memory info =========================== Processor: Intel(R) Core(TM) i7-5500U CPU @ 2.40GHz Percentage of memory in use: 20% Total physical RAM: 8107.39 MB Available physical RAM: 6449.61 MB Total Virtual: 9387.39 MB Available Virtual: 7608.55 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:930.96 GB) (Free:524.13 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 931.5 GB) (Disk ID: 06A3DEBE) Partition: GPT. ==================== End of Addition.txt ============================

I posted about a week ago and no one has checked the topic it seems. But im not 100% sure i have a virus, but my disk usage spikes to 60-99% regularly on my windows 10. I have installed game patches and mods so im not sure if i picked up anything bad. I have scanned the computer with Sophos which detected no threats to my system, but i dont have malwarebytes i just use windows defender for day to day protection. Let me know if theres anythig else i can do, thank you.

I have made two previous topics, but this is the final one considering I believe I' have done everything correctly for my FRST logs to be as accurate as possible. I guess I also could've ran them in safe mode, but I will let you be the judge. I had a popup this morning, and now my disk space is ramped up to 60-99% while I cannot find my usual browser which is opera. Don't know, I'm using an admin account right now but whenever I search 'opera' in explorer nothing pops up for the application. Addition.txt Additional scan result of Farbar Recovery Scan Tool (x64) Version: 14-05-2017 Ran by Neeko (16-05-2017 20:31:15) Running from C:\Users\Neeko\Desktop Windows 10 Home Version 1703 (X64) (2017-04-21 23:17:14) Boot Mode: Normal ========================================================== ==================== Accounts: ============================= Administrator (S-1-5-21-166261395-844033189-1565394352-500 - Administrator - Disabled) DefaultAccount (S-1-5-21-166261395-844033189-1565394352-503 - Limited - Disabled) Guest (S-1-5-21-166261395-844033189-1565394352-501 - Limited - Disabled) Neeko (S-1-5-21-166261395-844033189-1565394352-1001 - Administrator - Enabled) => C:\Users\Neeko Rick 0 (S-1-5-21-166261395-844033189-1565394352-1002 - Limited - Enabled) => C:\Users\Rick 0 ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) 7-Zip 16.04 (x64) (HKLM\...\7-Zip) (Version: 16.04 - Igor Pavlov) Adobe Flash Player 11 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 11.1.102.55 - Adobe Systems Incorporated) Adobe Flash Player 25 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 25.0.0.171 - Adobe Systems Incorporated) Ansel (Version: 377.19 - NVIDIA Corporation) Hidden Apple Application Support (32-bit) (HKLM-x32\...\{05E07D23-91E9-4E70-A4CC-EF505088F967}) (Version: 5.4.1 - Apple Inc.) Apple Application Support (64-bit) (HKLM\...\{741291DA-2B34-4D44-8FB6-58EDE21261D8}) (Version: 5.4.1 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{DB18F1C0-846F-46F5-A074-5B97C8AF5C8E}) (Version: 10.3.1.2 - Apple Inc.) Apple Software Update (HKLM-x32\...\{52D87F32-70E4-4348-8148-C0B9F35B1314}) (Version: 2.3.0.177 - Apple Inc.) Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.) Chivalry: Medieval Warfare (HKLM\...\Steam App 219640) (Version: - Torn Banner Studios) Counter-Strike: Source (HKLM\...\Steam App 240) (Version: - Valve) Intel(R) Chipset Device Software (x32 Version: 10.1.1.42 - Intel(R) Corporation) Hidden Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.4549 - Intel Corporation) iTunes (HKLM\...\{6C01A0A7-7440-4D48-93C6-2927A1E93FE6}) (Version: 12.6.0.100 - Apple Inc.) Killing Floor (HKLM\...\Steam App 1250) (Version: - Tripwire Interactive) League of Legends (HKLM-x32\...\League of Legends 4.1.2) (Version: 4.1.2 - Riot Games) League of Legends (x32 Version: 4.1.2 - Riot Games) Hidden Mass Effect 2 (HKLM-x32\...\{75D84EF7-0D8C-4e70-B3FA-7B42A5D4E0EB}) (Version: 1.00 - Electronic Arts, Inc.) MCShield ::Anti-Malware Tool:: (HKLM-x32\...\MCShield) (Version: 3.0.5.28 - MyCity) Microsoft OneDrive (HKU\S-1-5-21-166261395-844033189-1565394352-1001\...\OneDriveSetup.exe) (Version: 17.3.6816.0313 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation) Nexus Mod Manager (HKLM\...\6af12c54-643b-4752-87d0-8335503010de_is1) (Version: 0.63.14 - Black Tree Gaming) No More Room in Hell (HKLM\...\Steam App 224260) (Version: - No More Room in Hell Team) NVIDIA Graphics Driver 377.19 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 377.19 - NVIDIA Corporation) NVIDIA PhysX (HKLM-x32\...\{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}) (Version: 9.09.0814 - NVIDIA Corporation) Origin (HKLM-x32\...\Origin) (Version: 10.4.9.38188 - Electronic Arts, Inc.) POSTAL 2 (HKLM\...\Steam App 223470) (Version: - Running With Scissors) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7730 - Realtek Semiconductor Corp.) RogueKiller version 12.10.5.0 (HKLM\...\8B3D7924-ED89-486B-8322-E8594065D5CB_is1) (Version: 12.10.5.0 - Adlice Software) Saints Row: The Third (HKLM\...\Steam App 55230) (Version: - Volition) Sophos Virus Removal Tool (HKLM-x32\...\{B829E117-D072-41EA-9606-9826A38D34C1}) (Version: 2.5.6 - Sophos Limited) STAR WARS™ Jedi Knight: Jedi Academy™ (HKLM\...\Steam App 6020) (Version: - Raven Software) Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation) Synaptics ClickPad Driver (HKLM\...\SynTPDeinstKey) (Version: 19.2.4.10 - Synaptics Incorporated) The Elder Scrolls V: Skyrim (HKLM\...\Steam App 72850) (Version: - Bethesda Game Studios) Total War: SHOGUN 2 (HKLM\...\Steam App 34330) (Version: - The Creative Assembly) Unchecky v1.0.2 (HKLM-x32\...\Unchecky) (Version: 1.0.2 - RaMMicHaeL) Vulkan Run Time Libraries 1.0.26.0 (HKLM\...\VulkanRT1.0.26.0) (Version: 1.0.26.0 - LunarG, Inc.) ==================== Custom CLSID (Whitelisted): ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== Scheduled Tasks (Whitelisted) ============= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) Task: {0FCC449D-7FB4-4395-AF03-5A06FBBD088F} - System32\Tasks\Opera scheduled Autoupdate 1492938726 => C:\Users\Rick 0\AppData\Local\Programs\Opera\launcher.exe [2017-04-11] (Opera Software) Task: {C2A36005-B47E-45D3-8EB5-B167E47CC5AE} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_25_0_0_171_pepper.exe [2017-05-09] (Adobe Systems Incorporated) (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) ==================== Shortcuts ============================= (The entries could be listed to be restored or removed.) ==================== Loaded Modules (Whitelisted) ============== 2017-03-16 16:08 - 2017-03-16 16:08 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll 2017-03-16 16:08 - 2017-03-16 16:08 - 01354040 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll 2017-04-22 11:09 - 2017-03-29 12:20 - 00133056 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll 2017-03-18 13:58 - 2017-03-18 13:58 - 00138000 _____ () C:\Windows\SYSTEM32\inputhost.dll 2017-03-18 13:59 - 2017-03-18 19:31 - 01731072 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll 2017-03-27 12:20 - 2017-03-27 12:20 - 00092472 _____ () C:\Program Files\iTunes\zlib1.dll 2017-03-27 12:20 - 2017-03-27 12:20 - 01354040 _____ () C:\Program Files\iTunes\libxml2.dll 2017-05-02 18:53 - 2017-05-02 18:52 - 02493440 _____ () C:\Program Files (x86)\Origin\libGLESv2.dll ==================== Alternate Data Streams (Whitelisted) ========= (If an entry is included in the fixlist, only the ADS will be removed.) ==================== Safe Mode (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== Association (Whitelisted) =============== (If an entry is included in the fixlist, the registry item will be restored to default or removed.) ==================== Internet Explorer trusted/restricted =============== (If an entry is included in the fixlist, it will be removed from the registry.) ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2017-03-18 14:03 - 2017-05-10 00:17 - 00002024 _____ C:\Windows\system32\Drivers\etc\hosts 0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomaly 0.0.0.0 tracking.opencandy.com.s3.amazonaws.com 0.0.0.0 media.opencandy.com 0.0.0.0 cdn.opencandy.com 0.0.0.0 tracking.opencandy.com 0.0.0.0 api.opencandy.com 0.0.0.0 api.recommendedsw.com 0.0.0.0 installer.betterinstaller.com 0.0.0.0 installer.filebulldog.com 0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net 0.0.0.0 inno.bisrv.com 0.0.0.0 nsis.bisrv.com 0.0.0.0 cdn.file2desktop.com 0.0.0.0 cdn.goateastcach.us 0.0.0.0 cdn.guttastatdk.us 0.0.0.0 cdn.inskinmedia.com 0.0.0.0 cdn.insta.oibundles2.com 0.0.0.0 cdn.insta.playbryte.com 0.0.0.0 cdn.llogetfastcach.us 0.0.0.0 cdn.montiera.com 0.0.0.0 cdn.msdwnld.com 0.0.0.0 cdn.mypcbackup.com 0.0.0.0 cdn.ppdownload.com 0.0.0.0 cdn.riceateastcach.us 0.0.0.0 cdn.shyapotato.us 0.0.0.0 cdn.solimba.com 0.0.0.0 cdn.tuto4pc.com 0.0.0.0 cdn.appround.biz 0.0.0.0 cdn.bigspeedpro.com 0.0.0.0 cdn.bispd.com There are 4 more lines. ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-166261395-844033189-1565394352-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\Windows\img0.jpg DNS Servers: 66.253.214.16 - 50.30.184.16 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) Windows Firewall is enabled. ==================== MSCONFIG/TASK MANAGER disabled items == ==================== FirewallRules (Whitelisted) =============== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) FirewallRules: [{3C00E47E-854D-4D8B-A007-3A70ECF35823}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{7A9CE419-C4A6-428F-AE60-AC45929012AE}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{FE3F1B7F-7047-4430-A5CB-71E4493B86FB}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{8E239960-A4CC-4421-A5BD-09A255400A4F}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{635F5ECE-2183-4967-B139-97EBBF83F47E}] => (Allow) C:\Program Files\iTunes\iTunes.exe FirewallRules: [{BFD5C38A-6823-4F25-BA40-238731852BE4}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe FirewallRules: [{35FEEAC4-46A2-4410-9BE9-F005CEEA97CE}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe FirewallRules: [{B057F416-53A6-4C6F-8C21-C88420942318}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe FirewallRules: [{90D614FB-523B-4851-AFEA-6FC18F06EC25}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe FirewallRules: [{5D238DCD-CFF8-45DD-AE88-21C33C3CD67F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe FirewallRules: [{7FE60437-9651-4408-94F8-EA18ADB97E29}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe FirewallRules: [{68229938-B1CF-4D61-9C9E-FFD538720F47}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Total War SHOGUN 2\Shogun2.exe FirewallRules: [{6C669914-FFF6-4E4B-99A2-73A6B84F95D9}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Total War SHOGUN 2\Shogun2.exe FirewallRules: [{BFBEAF80-45D6-44A8-9F20-58268BE312EE}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\KillingFloor\System\KillingFloor.exe FirewallRules: [{E56D00C1-E7F4-45DF-8AB9-59A927F2A88E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\KillingFloor\System\KillingFloor.exe FirewallRules: [{3742DBA0-3DE4-4B63-B472-D1F5ED252790}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\chivalrymedievalwarfare\Binaries\Win64\CMW.exe FirewallRules: [{FDA96598-BE4F-4926-A337-C41D33F2766C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\chivalrymedievalwarfare\Binaries\Win64\CMW.exe FirewallRules: [{9C86BCE6-DB0F-413A-B41D-246A5D14621B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\chivalrymedievalwarfare\Binaries\Win32\CMW.exe FirewallRules: [{41518BCE-A1D1-483E-8E98-7CEA964E26CF}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\chivalrymedievalwarfare\Binaries\Win32\CMW.exe FirewallRules: [{49F84B8A-C598-4767-8BCE-E0ACF0B1C2F8}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\chivalrymedievalwarfare\ChivLauncher.exe FirewallRules: [{DDE1C744-CFF9-4179-A653-F5CF4CC5143A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\chivalrymedievalwarfare\ChivLauncher.exe FirewallRules: [{7743C2DE-6170-4469-89EF-8201582C6306}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Source\hl2.exe FirewallRules: [{7F2DF85E-F47D-4A42-A8D6-3BE1631798CE}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Source\hl2.exe FirewallRules: [{EDC6298A-6F43-4C82-873E-0F23B26F7C16}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\nmrih\sdk\hl2.exe FirewallRules: [{C057B7F8-667E-4084-A1DB-FB302CB33836}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\nmrih\sdk\hl2.exe FirewallRules: [{66D0F362-AB4C-42C4-9301-C4F34A2A590A}] => (Allow) C:\Program Files (x86)\Mass Effect 2\Binaries\MassEffect2.exe FirewallRules: [{B2A87300-6B0D-4A3A-8428-179FA0194906}] => (Allow) C:\Program Files (x86)\Mass Effect 2\Binaries\MassEffect2.exe FirewallRules: [{989952DC-B4D2-4276-AAB7-FE2FF3B6566C}] => (Allow) C:\Program Files (x86)\Mass Effect 2\MassEffect2Launcher.exe FirewallRules: [{986BCF36-29D9-4324-A3E8-2DF1055B5739}] => (Allow) C:\Program Files (x86)\Mass Effect 2\MassEffect2Launcher.exe FirewallRules: [{1A832F3A-4119-427A-96EF-39E60058CF5C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Saints Row the Third\game_launcher.exe FirewallRules: [{B3617500-8D69-4439-9DD9-881D849E985C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Saints Row the Third\game_launcher.exe FirewallRules: [{6F39D994-F999-443B-8F91-A82A0B20C2D8}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Saints Row the Third\SaintsRowTheThird.exe FirewallRules: [{45DD0183-B4E4-481E-A986-70C301EFA98B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Saints Row the Third\SaintsRowTheThird.exe FirewallRules: [{C70BDE2F-DFB8-426D-A99A-2B3D28D9DDAF}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Saints Row the Third\SaintsRowTheThird_DX11.exe FirewallRules: [{D6ACBCE9-BA01-461B-A9D6-4B1E7A9AC37C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Saints Row the Third\SaintsRowTheThird_DX11.exe FirewallRules: [{5BC1DAEA-7F31-4CDB-8828-3D8EC64504AF}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\POSTAL2Complete\System\Postal2.exe FirewallRules: [{59C73002-71DE-446D-9CFB-E4B108374686}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\POSTAL2Complete\System\Postal2.exe FirewallRules: [{8F694C0F-273B-484C-9A38-BB0FE4C73CC1}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\POSTAL2Complete\ShareThePain\System\Postal2MP.exe FirewallRules: [{32C57E0E-5F4D-43DC-9B71-42D45C2B51B2}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\POSTAL2Complete\ShareThePain\System\Postal2MP.exe FirewallRules: [{DE36195A-5144-4221-A79B-7715DFBEA64F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Jedi Academy\GameData\jasp.exe FirewallRules: [{51C7DDE8-F514-43A3-86DB-21282164F264}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Jedi Academy\GameData\jasp.exe FirewallRules: [{4D47512C-C415-40E1-A8C5-835D03A9D044}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Jedi Academy\GameData\jamp.exe FirewallRules: [{4A10CDCB-29B0-49A1-B1A6-CA3ABEBEB6D6}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Jedi Academy\GameData\jamp.exe ==================== Restore Points ========================= ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (05/16/2017 11:27:30 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: opera_autoupdate.exe, version: 44.0.2510.1218, time stamp: 0x58ed11a0 Faulting module name: opera_autoupdate.exe, version: 44.0.2510.1218, time stamp: 0x58ed11a0 Exception code: 0xc0000005 Fault offset: 0x000000000034be04 Faulting process id: 0x1e38 Faulting application start time: 0x01d2ce7210c725b8 Faulting application path: C:\Users\Rick 0\AppData\Local\Programs\Opera\44.0.2510.1218\opera_autoupdate.exe Faulting module path: C:\Users\Rick 0\AppData\Local\Programs\Opera\44.0.2510.1218\opera_autoupdate.exe Report Id: e91b724a-46d4-4888-b0d7-67a66ed01f04 Faulting package full name: Faulting package-relative application ID: Error: (05/16/2017 10:32:25 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 1203 Error: (05/16/2017 10:32:25 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 1203 Error: (05/16/2017 10:32:25 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (05/15/2017 06:45:52 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-M7IRLC6) Description: Activation of app Microsoft.Windows.Photos_8wekyb3d8bbwe!App failed with error: -2147023170 See the Microsoft-Windows-TWinUI/Operational log for additional information. Error: (05/15/2017 04:54:58 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: opera_autoupdate.exe, version: 44.0.2510.1218, time stamp: 0x58ed11a0 Faulting module name: ntdll.dll, version: 10.0.15063.0, time stamp: 0xb79b6ddb Exception code: 0xc0000374 Fault offset: 0x00000000000f775f Faulting process id: 0x970 Faulting application start time: 0x01d2cdd6a46aba8d Faulting application path: C:\Users\Rick 0\AppData\Local\Programs\Opera\44.0.2510.1218\opera_autoupdate.exe Faulting module path: C:\Windows\SYSTEM32\ntdll.dll Report Id: 425a16ad-664e-42c4-ad79-c3d87a93c7ce Faulting package full name: Faulting package-relative application ID: Error: (05/14/2017 03:56:34 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: Shogun2.exe, version: 1.1.0.0, time stamp: 0x507716b8 Faulting module name: ntdll.dll, version: 10.0.15063.0, time stamp: 0xa82cc161 Exception code: 0xc0000374 Fault offset: 0x000d9a8a Faulting process id: 0x874 Faulting application start time: 0x01d2cc689b890a35 Faulting application path: C:\Program Files (x86)\Steam\steamapps\common\Total War SHOGUN 2\Shogun2.exe Faulting module path: C:\Windows\SYSTEM32\ntdll.dll Report Id: c8bf7418-e3d7-4aea-b53c-0b25880dc8f1 Faulting package full name: Faulting package-relative application ID: Error: (05/14/2017 12:50:56 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 636953 Error: (05/14/2017 12:50:56 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 636953 Error: (05/14/2017 12:50:56 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second System errors: ============= Error: (05/16/2017 08:28:52 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY) Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D63B10C5-BB46-4990-A94F-E40B9D520160} and APPID {9CA88EE3-ACB7-47C8-AFC4-AB702511C276} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. Error: (05/16/2017 08:28:22 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY) Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D63B10C5-BB46-4990-A94F-E40B9D520160} and APPID {9CA88EE3-ACB7-47C8-AFC4-AB702511C276} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. Error: (05/16/2017 08:27:39 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY) Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} and APPID {4839DDB7-58C2-48F5-8283-E1D1807D0D7D} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. Error: (05/16/2017 08:27:39 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY) Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} and APPID {4839DDB7-58C2-48F5-8283-E1D1807D0D7D} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. Error: (05/16/2017 08:25:36 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY) Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D63B10C5-BB46-4990-A94F-E40B9D520160} and APPID {9CA88EE3-ACB7-47C8-AFC4-AB702511C276} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. Error: (05/16/2017 08:25:15 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY) Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} and APPID {4839DDB7-58C2-48F5-8283-E1D1807D0D7D} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. Error: (05/16/2017 08:25:15 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY) Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} and APPID {4839DDB7-58C2-48F5-8283-E1D1807D0D7D} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. Error: (05/16/2017 04:12:15 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY) Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D63B10C5-BB46-4990-A94F-E40B9D520160} and APPID {9CA88EE3-ACB7-47C8-AFC4-AB702511C276} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. Error: (05/16/2017 01:44:51 PM) (Source: volsnap) (EventID: 36) (User: ) Description: The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit. Error: (05/16/2017 11:29:08 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY) Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} and APPID {4839DDB7-58C2-48F5-8283-E1D1807D0D7D} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. CodeIntegrity: =================================== Date: 2017-05-16 20:31:08.202 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2017-05-16 20:31:08.195 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2017-05-16 12:40:48.841 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2017-05-16 12:40:48.835 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2017-05-16 11:54:09.663 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2017-05-16 11:54:09.657 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2017-05-16 11:29:26.060 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2017-05-16 11:29:26.057 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2017-05-16 11:29:26.055 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2017-05-16 11:29:26.052 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements. ==================== Memory info =========================== Processor: Intel(R) Core(TM) i7-5500U CPU @ 2.40GHz Percentage of memory in use: 23% Total physical RAM: 8107.39 MB Available physical RAM: 6238.9 MB Total Virtual: 9387.39 MB Available Virtual: 7456.61 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:930.96 GB) (Free:541.23 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 931.5 GB) (Disk ID: 06A3DEBE) Partition: GPT. ==================== End of Addition.txt ============================ FRST.txt Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 14-05-2017 Ran by Neeko (administrator) on DESKTOP-M7IRLC6 (16-05-2017 20:29:19) Running from C:\Users\Neeko\Desktop Loaded Profiles: Neeko (Available Profiles: Neeko & Rick 0) Platform: Windows 10 Home Version 1703 (X64) Language: English (United States) Internet Explorer Version 11 (Default browser: Edge) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Intel Corporation) C:\Windows\System32\igfxCUIService.exe (HP) C:\Windows\System32\hpservice.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe (Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Intel Corporation) C:\Windows\System32\Intel\DPTF\esif_uf.exe (Synaptics Incorporated) C:\Windows\System32\valWBFPolicyService.exe (RaMMicHaeL) C:\Program Files (x86)\Unchecky\bin\unchecky_svc.exe (Electronic Arts) C:\Program Files (x86)\Origin\OriginWebHelperService.exe (Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (Intel Corporation) C:\Windows\Temp\DPTF\esif_assist_64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (RaMMicHaeL) C:\Program Files (x86)\Unchecky\bin\unchecky_bg.exe (Intel Corporation) C:\Windows\System32\igfxEM.exe (Intel Corporation) C:\Windows\System32\igfxHK.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Microsoft Corporation) C:\Windows\System32\smartscreen.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe (MyCity) C:\Program Files (x86)\MCShield\MCShieldRTM.exe (Microsoft Corporation) C:\Windows\System32\Taskmgr.exe (Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.15063.0_none_1a733a82001933cc\TiWorker.exe ==================== Registry (Whitelisted) ==================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [629152 2017-03-18] (Microsoft Corporation) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8843520 2016-01-28] (Realtek Semiconductor) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [303928 2017-03-22] (Apple Inc.) HKU\S-1-5-21-166261395-844033189-1565394352-1001\...\Run: [MCShield Monitor] => C:\Program Files (x86)\MCShield\MCShieldRTM.exe [650816 2014-04-11] (MyCity) HKU\S-1-5-21-166261395-844033189-1565394352-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3019552 2017-04-25] (Valve Corporation) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 66.253.214.16 50.30.184.16 Tcpip\..\Interfaces\{4b71d5e5-183c-42bf-abcf-210136008644}: [DhcpNameServer] 66.253.214.16 50.30.184.16 Tcpip\..\Interfaces\{9a33da33-3bcb-4a80-b5e2-687e90d240a5}: [DhcpNameServer] 66.253.214.16 50.30.184.16 Internet Explorer: ================== FireFox: ======== FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll [2017-04-28] () ==================== Services (Whitelisted) ==================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2017-03-17] (Apple Inc.) R2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2286848 2015-10-01] (Broadcom Corporation.) R2 esifsvc; C:\Windows\system32\Intel\DPTF\esif_uf.exe [2219072 2016-10-25] (Intel Corporation) R2 hpsrv; C:\Windows\system32\Hpservice.exe [38728 2016-10-12] (HP) R2 igfxCUIService2.0.0.0; C:\Windows\system32\igfxCUIService.exe [373720 2017-01-13] (Intel Corporation) R2 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [458176 2017-03-29] (NVIDIA Corporation) S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2147216 2017-05-02] (Electronic Arts) R2 Origin Web Helper Service; C:\Program Files (x86)\Origin\OriginWebHelperService.exe [3116440 2017-05-02] (Electronic Arts) R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [310016 2016-01-28] (Realtek Semiconductor) R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [269400 2016-10-05] (Synaptics Incorporated) R2 Unchecky; C:\Program Files (x86)\Unchecky\bin\unchecky_svc.exe [304408 2017-04-22] (RaMMicHaeL) R2 valWBFPolicyService; C:\Windows\system32\valWBFPolicyService.exe [100384 2016-03-09] (Synaptics Incorporated) R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [342264 2017-03-18] (Microsoft Corporation) R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [102816 2017-03-18] (Microsoft Corporation) ===================== Drivers (Whitelisted) ====================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R3 Accelerometer; C:\Windows\system32\DRIVERS\Accelerometer.sys [56128 2016-10-12] (HP) R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [177440 2016-01-27] (Broadcom Corporation.) R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [7585280 2017-03-18] (Broadcom Corporation) R3 dptf_acpi; C:\Windows\System32\drivers\dptf_acpi.sys [72592 2016-10-25] (Intel Corporation) R3 dptf_cpu; C:\Windows\System32\drivers\dptf_cpu.sys [67984 2016-10-25] (Intel Corporation) R3 esif_lf; C:\Windows\system32\DRIVERS\esif_lf.sys [355216 2016-10-25] (Intel Corporation) R0 hpdskflt; C:\Windows\System32\DRIVERS\hpdskflt.sys [42312 2016-10-12] (HP) R3 nvlddmkm; C:\Windows\System32\DriverStore\FileRepository\nvhm.inf_amd64_0460fff687def1f0\nvlddmkm.sys [14378544 2017-04-11] (NVIDIA Corporation) R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [604160 2017-03-18] (Realtek ) S3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [760968 2017-02-23] (Realsil Semiconductor Corporation) S3 SDFRd; C:\Windows\System32\drivers\SDFRd.sys [31128 2017-03-18] () R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [79960 2016-10-05] (Synaptics Incorporated) S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44632 2017-03-18] (Microsoft Corporation) R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [294816 2017-03-18] (Microsoft Corporation) R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [121248 2017-03-18] (Microsoft Corporation) R3 WirelessButtonDriver64; C:\Windows\system32\DRIVERS\WirelessButtonDriver64.sys [31656 2016-04-13] (HP) ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2017-05-16 20:29 - 2017-05-16 20:30 - 00008310 _____ C:\Users\Neeko\Desktop\FRST.txt 2017-05-16 16:01 - 2017-05-16 16:01 - 00000000 ____D C:\Users\Neeko\Desktop\FRST-OlderVersion 2017-05-16 11:30 - 2017-05-16 11:30 - 00000000 ____D C:\Users\Neeko\AppData\Local\Steam 2017-05-16 11:30 - 2017-05-16 11:30 - 00000000 ____D C:\Users\Neeko\AppData\Local\CEF 2017-05-15 16:57 - 2017-05-15 16:57 - 00634989 _____ C:\Users\Rick 0\Downloads\pathe and other film industry history the decline of euro film.pdf 2017-05-14 17:20 - 2017-05-14 17:20 - 03068415 _____ C:\Users\Rick 0\Downloads\Stam, The Structuring Absences of Silent Cinema.pdf 2017-05-14 17:20 - 2017-05-14 17:20 - 02090697 _____ C:\Users\Rick 0\Downloads\Stewart, We Were Never Immigrants.pdf 2017-05-14 17:18 - 2017-05-14 17:18 - 06436284 _____ C:\Users\Rick 0\Downloads\Abel French Film Industry.pdf 2017-05-14 17:18 - 2017-05-14 17:18 - 05206731 _____ C:\Users\Rick 0\Downloads\Abel, The French Rooster Rules the Roost.pdf 2017-05-14 17:12 - 2017-05-14 17:12 - 00593102 _____ C:\Users\Rick 0\Downloads\Film History I FSP 17 (1).pdf 2017-05-14 17:04 - 2017-05-14 17:04 - 00593102 _____ C:\Users\Rick 0\Downloads\Film History I FSP 17.pdf 2017-05-14 17:03 - 2017-05-14 17:03 - 04341528 _____ C:\Users\Rick 0\Downloads\Pathé.pptx 2017-05-13 14:13 - 2017-05-13 14:13 - 00646089 _____ C:\Users\Rick 0\Downloads\Abelson_Night and Day.pdf 2017-05-11 20:31 - 2017-05-11 20:33 - 00000000 ____D C:\Users\Rick 0\Downloads\ps 205 2017-05-11 12:57 - 2017-05-11 20:33 - 00000000 ____D C:\Users\Rick 0\Downloads\film 381 2017-05-10 12:08 - 2017-05-15 18:07 - 00000000 ____D C:\Users\Rick 0\Documents\Sound recordings 2017-05-09 22:52 - 2017-04-27 18:38 - 01411128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32full.dll 2017-05-09 22:52 - 2017-04-27 18:12 - 01604312 _____ (Microsoft Corporation) C:\Windows\system32\gdi32full.dll 2017-05-09 22:52 - 2017-04-27 18:12 - 00543640 _____ (Microsoft Corporation) C:\Windows\system32\securekernel.exe 2017-05-09 22:52 - 2017-04-27 18:11 - 02158544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2017-05-09 22:52 - 2017-04-27 18:08 - 08320920 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2017-05-09 22:52 - 2017-04-27 18:07 - 06759512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Media.Protection.PlayReady.dll 2017-05-09 22:52 - 2017-04-27 18:03 - 00667040 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll 2017-05-09 22:52 - 2017-04-27 18:00 - 02444192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys 2017-05-09 22:52 - 2017-04-27 17:59 - 02635336 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2017-05-09 22:52 - 2017-04-27 17:59 - 00388000 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBXHCI.SYS 2017-05-09 22:52 - 2017-04-27 17:56 - 07904784 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.Protection.PlayReady.dll 2017-05-09 22:52 - 2017-04-27 17:52 - 02957824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32kfull.sys 2017-05-09 22:52 - 2017-04-27 17:51 - 20505600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\edgehtml.dll 2017-05-09 22:52 - 2017-04-27 17:46 - 19335168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2017-05-09 22:52 - 2017-04-27 17:46 - 00329728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webplatstorageserver.dll 2017-05-09 22:52 - 2017-04-27 17:44 - 00338432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2017-05-09 22:52 - 2017-04-27 17:44 - 00266240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2017-05-09 22:52 - 2017-04-27 17:42 - 00806400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\StoreAgent.dll 2017-05-09 22:52 - 2017-04-27 17:42 - 00663040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2017-05-09 22:52 - 2017-04-27 17:42 - 00636416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WpcWebFilter.dll 2017-05-09 22:52 - 2017-04-27 17:42 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InstallAgentUserBroker.exe 2017-05-09 22:52 - 2017-04-27 17:40 - 11870208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2017-05-09 22:52 - 2017-04-27 17:40 - 06292992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Chakra.dll 2017-05-09 22:52 - 2017-04-27 17:40 - 02008576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2017-05-09 22:52 - 2017-04-27 17:40 - 00328704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InstallAgent.exe 2017-05-09 22:52 - 2017-04-27 17:39 - 05225984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll 2017-05-09 22:52 - 2017-04-27 17:39 - 02859520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2017-05-09 22:52 - 2017-04-27 17:38 - 03667456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_47.dll 2017-05-09 22:52 - 2017-04-27 17:38 - 01019904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aadtb.dll 2017-05-09 22:52 - 2017-04-27 17:37 - 04559360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbgeng.dll 2017-05-09 22:52 - 2017-04-27 17:37 - 01626624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2017-05-09 22:52 - 2017-04-27 17:26 - 23677440 _____ (Microsoft Corporation) C:\Windows\system32\edgehtml.dll 2017-05-09 22:52 - 2017-04-27 17:15 - 03672064 _____ (Microsoft Corporation) C:\Windows\system32\win32kfull.sys 2017-05-09 22:52 - 2017-04-27 17:11 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\BasicRender.sys 2017-05-09 22:52 - 2017-04-27 17:08 - 00457728 _____ (Microsoft Corporation) C:\Windows\system32\webplatstorageserver.dll 2017-05-09 22:52 - 2017-04-27 17:08 - 00096256 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2017-05-09 22:52 - 2017-04-27 17:06 - 00386560 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2017-05-09 22:52 - 2017-04-27 17:06 - 00274944 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2017-05-09 22:52 - 2017-04-27 17:05 - 01075712 _____ (Microsoft Corporation) C:\Windows\system32\StoreAgent.dll 2017-05-09 22:52 - 2017-04-27 17:05 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2017-05-09 22:52 - 2017-04-27 17:04 - 23681024 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2017-05-09 22:52 - 2017-04-27 17:04 - 00422400 _____ (Microsoft Corporation) C:\Windows\system32\WpAXHolder.dll 2017-05-09 22:52 - 2017-04-27 17:04 - 00416256 _____ (Microsoft Corporation) C:\Windows\system32\InstallAgentUserBroker.exe 2017-05-09 22:52 - 2017-04-27 17:03 - 00925696 _____ (Microsoft Corporation) C:\Windows\system32\WpcWebFilter.dll 2017-05-09 22:52 - 2017-04-27 17:03 - 00751104 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2017-05-09 22:52 - 2017-04-27 17:01 - 02077184 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2017-05-09 22:52 - 2017-04-27 17:00 - 08244736 _____ (Microsoft Corporation) C:\Windows\system32\Chakra.dll 2017-05-09 22:52 - 2017-04-27 16:59 - 04396032 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_47.dll 2017-05-09 22:52 - 2017-04-27 16:59 - 03307008 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2017-05-09 22:52 - 2017-04-27 16:59 - 02056192 _____ (Microsoft Corporation) C:\Windows\system32\win32kbase.sys 2017-05-09 22:52 - 2017-04-27 16:59 - 01293824 _____ (Microsoft Corporation) C:\Windows\system32\aadtb.dll 2017-05-09 22:52 - 2017-04-27 16:59 - 00373760 _____ (Microsoft Corporation) C:\Windows\system32\InstallAgent.exe 2017-05-09 22:52 - 2017-04-27 16:58 - 12787200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2017-05-09 22:52 - 2017-04-27 16:57 - 05557760 _____ (Microsoft Corporation) C:\Windows\system32\dbgeng.dll 2017-05-09 22:52 - 2017-04-27 16:57 - 01803264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2017-05-09 22:51 - 2017-04-27 18:19 - 01839872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll 2017-05-09 22:51 - 2017-04-27 18:19 - 00605936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll 2017-05-09 22:51 - 2017-04-27 18:18 - 02259760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CoreUIComponents.dll 2017-05-09 22:51 - 2017-04-27 18:16 - 00599576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll 2017-05-09 22:51 - 2017-04-27 18:09 - 01557288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2017-05-09 22:51 - 2017-04-27 18:08 - 02399728 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll 2017-05-09 22:51 - 2017-04-27 18:08 - 02330520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\combase.dll 2017-05-09 22:51 - 2017-04-27 18:08 - 00775824 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll 2017-05-09 22:51 - 2017-04-27 18:07 - 00988168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll 2017-05-09 22:51 - 2017-04-27 18:06 - 02969880 _____ (Microsoft Corporation) C:\Windows\system32\CoreUIComponents.dll 2017-05-09 22:51 - 2017-04-27 18:06 - 00708712 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll 2017-05-09 22:51 - 2017-04-27 18:05 - 00923040 _____ (Microsoft Corporation) C:\Windows\system32\CoreMessaging.dll 2017-05-09 22:51 - 2017-04-27 18:04 - 00583160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CoreMessaging.dll 2017-05-09 22:51 - 2017-04-27 17:59 - 05477088 _____ (Microsoft Corporation) C:\Windows\system32\OneCoreUAPCommonProxyStub.dll 2017-05-09 22:51 - 2017-04-27 17:59 - 00207264 _____ (Microsoft Corporation) C:\Windows\system32\browserbroker.dll 2017-05-09 22:51 - 2017-04-27 17:59 - 00027040 _____ (Microsoft Corporation) C:\Windows\system32\browser_broker.exe 2017-05-09 22:51 - 2017-04-27 17:58 - 01852776 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2017-05-09 22:51 - 2017-04-27 17:58 - 00872472 _____ (Microsoft Corporation) C:\Windows\system32\ClipSVC.dll 2017-05-09 22:51 - 2017-04-27 17:57 - 03116184 _____ (Microsoft Corporation) C:\Windows\system32\combase.dll 2017-05-09 22:51 - 2017-04-27 17:55 - 21353200 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2017-05-09 22:51 - 2017-04-27 17:55 - 01325456 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll 2017-05-09 22:51 - 2017-04-27 17:53 - 00387928 _____ (Microsoft Corporation) C:\Windows\system32\wmpps.dll 2017-05-09 22:51 - 2017-04-27 17:52 - 00790528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.dll 2017-05-09 22:51 - 2017-04-27 17:52 - 00584192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIRibbonRes.dll 2017-05-09 22:51 - 2017-04-27 17:49 - 00072192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx 2017-05-09 22:51 - 2017-04-27 17:49 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\odbcconf.dll 2017-05-09 22:51 - 2017-04-27 17:46 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2017-05-09 22:51 - 2017-04-27 17:45 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll 2017-05-09 22:51 - 2017-04-27 17:41 - 01248768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AzureSettingSyncProvider.dll 2017-05-09 22:51 - 2017-04-27 17:40 - 00799232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TokenBroker.dll 2017-05-09 22:51 - 2017-04-27 17:40 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cldapi.dll 2017-05-09 22:51 - 2017-04-27 17:39 - 03655680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2017-05-09 22:51 - 2017-04-27 17:34 - 00891904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\autochk.exe 2017-05-09 22:51 - 2017-04-27 17:33 - 00089088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\olepro32.dll 2017-05-09 22:51 - 2017-04-27 17:15 - 01051648 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.dll 2017-05-09 22:51 - 2017-04-27 17:14 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\UIRibbonRes.dll 2017-05-09 22:51 - 2017-04-27 17:11 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx 2017-05-09 22:51 - 2017-04-27 17:11 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\odbcconf.dll 2017-05-09 22:51 - 2017-04-27 17:09 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2017-05-09 22:51 - 2017-04-27 17:09 - 00064512 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll 2017-05-09 22:51 - 2017-04-27 17:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\SettingsEnvironment.Desktop.dll 2017-05-09 22:51 - 2017-04-27 17:07 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2017-05-09 22:51 - 2017-04-27 17:06 - 01302528 _____ (Microsoft Corporation) C:\Windows\system32\MSVPXENC.dll 2017-05-09 22:51 - 2017-04-27 17:06 - 00527360 _____ (Microsoft Corporation) C:\Windows\system32\aadcloudap.dll 2017-05-09 22:51 - 2017-04-27 17:04 - 01878016 _____ (Microsoft Corporation) C:\Windows\system32\AzureSettingSyncProvider.dll 2017-05-09 22:51 - 2017-04-27 17:03 - 01085440 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll 2017-05-09 22:51 - 2017-04-27 17:03 - 01027584 _____ (Microsoft Corporation) C:\Windows\system32\modernexecserver.dll 2017-05-09 22:51 - 2017-04-27 17:03 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\cldapi.dll 2017-05-09 22:51 - 2017-04-27 17:02 - 01260544 _____ (Microsoft Corporation) C:\Windows\system32\GamePanel.exe 2017-05-09 22:51 - 2017-04-27 17:01 - 01886208 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentExtensions.onecore.dll 2017-05-09 22:51 - 2017-04-27 16:58 - 01054208 _____ (Microsoft Corporation) C:\Windows\system32\TokenBroker.dll 2017-05-09 22:51 - 2017-04-27 16:57 - 04730368 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2017-05-09 22:51 - 2017-04-27 16:57 - 02800128 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentServer.dll 2017-05-09 22:51 - 2017-04-27 16:54 - 00985600 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll 2017-05-09 22:51 - 2017-04-27 16:54 - 00970240 _____ (Microsoft Corporation) C:\Windows\system32\autochk.exe 2017-05-09 22:51 - 2017-04-27 16:54 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys 2017-05-09 22:51 - 2017-04-27 16:54 - 00414208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys 2017-05-09 22:51 - 2017-04-27 16:52 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.Streaming.ps.dll 2017-05-09 17:01 - 2017-05-09 17:01 - 00000759 _____ C:\Users\Rick 0\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\flashplayer_25_sa.lnk 2017-05-09 17:00 - 2017-05-09 17:00 - 14966264 _____ (Adobe Systems, Inc.) C:\Users\Rick 0\Documents\flashplayer_25_sa.exe 2017-05-09 16:53 - 2017-05-09 16:59 - 00004646 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier 2017-05-09 16:45 - 2017-05-09 16:59 - 00000000 ____D C:\Users\Neeko\AppData\Local\Adobe 2017-05-09 16:44 - 2017-05-09 16:59 - 00000000 ____D C:\Users\Rick 0\AppData\Local\Adobe 2017-05-09 16:35 - 2017-05-09 16:35 - 00000000 ____D C:\Users\Rick 0\Documents\sd thro 2017-05-08 22:26 - 2017-05-08 22:26 - 00000000 ____D C:\Users\Rick 0\AppData\LocalLow\Temp 2017-05-08 02:11 - 2017-05-08 02:11 - 00000000 ____D C:\Users\Rick 0\AppData\Local\Chromium 2017-05-08 02:08 - 2017-05-08 02:08 - 00000000 ____D C:\Users\Rick 0\AppData\Roaming\The Creative Assembly 2017-05-04 11:38 - 2017-05-04 11:38 - 00120000 _____ C:\Users\Rick 0\Documents\2016TurboTaxReturn.pdf 2017-05-04 00:32 - 2017-05-13 02:45 - 00000000 ____D C:\Users\Rick 0\AppData\Roaming\NVIDIA 2017-05-04 00:32 - 2017-05-04 00:32 - 00000000 ____D C:\Users\Rick 0\Documents\BioWare 2017-05-03 13:45 - 2017-05-03 13:45 - 00001166 _____ C:\Users\Public\Desktop\Mass Effect 2.lnk 2017-05-03 13:45 - 2017-05-03 13:45 - 00000000 ____D C:\Windows\SysWOW64\AGEIA 2017-05-03 13:45 - 2017-05-03 13:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation 2017-05-03 13:45 - 2017-05-03 13:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mass Effect 2 2017-05-03 13:45 - 2017-05-03 13:45 - 00000000 ____D C:\Program Files (x86)\AGEIA Technologies 2017-05-03 13:15 - 2017-05-03 13:32 - 00000000 ____D C:\Program Files (x86)\Mass Effect 2 2017-05-02 18:56 - 2017-05-02 18:56 - 00000000 ____D C:\Program Files (x86)\Origin Games 2017-05-02 18:55 - 2017-05-02 18:57 - 00000000 ____D C:\Users\Rick 0\AppData\Roaming\Origin 2017-05-02 18:53 - 2017-05-02 18:53 - 00001062 _____ C:\Users\Public\Desktop\Origin.lnk 2017-05-02 18:53 - 2017-05-02 18:53 - 00000000 ____D C:\Users\Neeko\AppData\Local\Origin 2017-05-02 18:53 - 2017-05-02 18:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin 2017-05-02 18:53 - 2017-05-02 18:53 - 00000000 ____D C:\Program Files (x86)\Origin 2017-05-02 18:52 - 2017-05-02 18:57 - 00000000 ____D C:\ProgramData\Origin 2017-05-02 18:52 - 2017-05-02 18:56 - 00000000 ____D C:\Users\Rick 0\AppData\Local\Origin 2017-05-02 18:52 - 2017-05-02 18:52 - 00000000 ____D C:\Users\Rick 0\.QtWebEngineProcess 2017-05-02 18:52 - 2017-05-02 18:52 - 00000000 ____D C:\Users\Rick 0\.Origin 2017-05-02 14:14 - 2017-05-02 14:59 - 1279333529 _____ C:\Users\Rick 0\Downloads\knowing is half the battle..muthacensoreders.mp4 2017-04-29 23:07 - 2017-04-18 23:18 - 00118784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netvsc.sys 2017-04-29 23:07 - 2017-04-18 23:13 - 00980992 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bthport.sys 2017-04-29 23:07 - 2017-04-18 22:58 - 20374424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2017-04-29 23:07 - 2017-04-18 22:36 - 01291776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSVPXENC.dll 2017-04-29 23:07 - 2017-04-18 22:34 - 00507392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2017-04-29 23:07 - 2017-04-18 22:30 - 00909312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSyncCore.dll 2017-04-29 23:07 - 2017-04-18 22:29 - 02298880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll 2017-04-29 23:07 - 2017-04-13 16:43 - 04469832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe 2017-04-29 23:07 - 2017-04-13 16:31 - 01611776 _____ (Microsoft Corporation) C:\Windows\system32\SpeechPal.dll 2017-04-29 23:07 - 2017-04-13 16:21 - 06728192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll 2017-04-29 23:07 - 2017-04-13 16:18 - 00731136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmgaserver.exe 2017-04-29 23:07 - 2017-04-13 16:18 - 00362496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\daxexec.dll 2017-04-29 23:07 - 2017-04-13 16:13 - 00354304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InputSwitch.dll 2017-04-29 23:06 - 2017-04-19 00:06 - 00651680 _____ (Microsoft Corporation) C:\Windows\system32\SettingSyncHost.exe 2017-04-29 23:06 - 2017-04-19 00:04 - 00142240 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wcifs.sys 2017-04-29 23:06 - 2017-04-19 00:02 - 00716440 _____ (Microsoft Corporation) C:\Windows\system32\MSVideoDSP.dll 2017-04-29 23:06 - 2017-04-18 23:19 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\musdialoghandlers.dll 2017-04-29 23:06 - 2017-04-18 23:13 - 00585728 _____ (Microsoft Corporation) C:\Windows\system32\OneDriveSettingSyncProvider.dll 2017-04-29 23:06 - 2017-04-18 23:12 - 00805888 _____ (Microsoft Corporation) C:\Windows\system32\ieproxy.dll 2017-04-29 23:06 - 2017-04-18 23:12 - 00590848 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2017-04-29 23:06 - 2017-04-18 23:12 - 00203776 _____ (Microsoft Corporation) C:\Windows\system32\PackageStateRoaming.dll 2017-04-29 23:06 - 2017-04-18 23:11 - 04446208 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers_nt.dll 2017-04-29 23:06 - 2017-04-18 23:10 - 04175872 _____ (Microsoft Corporation) C:\Windows\system32\StartTileData.dll 2017-04-29 23:06 - 2017-04-18 23:10 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Shell.UnifiedTile.CuratedTileCollections.dll 2017-04-29 23:06 - 2017-04-18 23:10 - 01600512 _____ (Microsoft Corporation) C:\Windows\system32\dbghelp.dll 2017-04-29 23:06 - 2017-04-18 23:08 - 01103872 _____ (Microsoft Corporation) C:\Windows\system32\SettingSyncCore.dll 2017-04-29 23:06 - 2017-04-18 23:07 - 01242624 _____ (Microsoft Corporation) C:\Windows\system32\SharedStartModel.dll 2017-04-29 23:06 - 2017-04-18 23:07 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe 2017-04-29 23:06 - 2017-04-18 23:06 - 02651648 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll 2017-04-29 23:06 - 2017-04-18 23:04 - 01356800 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll 2017-04-29 23:06 - 2017-04-18 23:04 - 00624640 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll 2017-04-29 23:06 - 2017-04-18 23:02 - 00559000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSyncHost.exe 2017-04-29 23:06 - 2017-04-18 23:01 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\catsrvps.dll 2017-04-29 23:06 - 2017-04-18 22:59 - 02435584 _____ (Microsoft Corporation) C:\Windows\system32\ResetEngine.dll 2017-04-29 23:06 - 2017-04-18 22:37 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WiFiDisplay.dll 2017-04-29 23:06 - 2017-04-18 22:35 - 00476672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\OneDriveSettingSyncProvider.dll 2017-04-29 23:06 - 2017-04-18 22:34 - 00358400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieproxy.dll 2017-04-29 23:06 - 2017-04-18 22:34 - 00175616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PackageStateRoaming.dll 2017-04-29 23:06 - 2017-04-18 22:32 - 01285120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbghelp.dll 2017-04-29 23:06 - 2017-04-13 17:35 - 04848440 _____ (Microsoft Corporation) C:\Windows\explorer.exe 2017-04-29 23:06 - 2017-04-13 17:33 - 02085280 _____ (Microsoft Corporation) C:\Windows\system32\UpdateAgent.dll 2017-04-29 23:06 - 2017-04-13 17:30 - 00105456 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll 2017-04-29 23:06 - 2017-04-13 16:43 - 00523296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppResolver.dll 2017-04-29 23:06 - 2017-04-13 16:41 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\mssprxy.dll 2017-04-29 23:06 - 2017-04-13 16:40 - 00095584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll 2017-04-29 23:06 - 2017-04-13 16:39 - 07931392 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll 2017-04-29 23:06 - 2017-04-13 16:39 - 00974848 _____ (Microsoft Corporation) C:\Windows\system32\mmgaserver.exe 2017-04-29 23:06 - 2017-04-13 16:39 - 00334336 _____ (Microsoft Corporation) C:\Windows\system32\wc_storage.dll 2017-04-29 23:06 - 2017-04-13 16:39 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\VEStoreEventHandlers.dll 2017-04-29 23:06 - 2017-04-13 16:38 - 00251904 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Gaming.Preview.dll 2017-04-29 23:06 - 2017-04-13 16:37 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\NotificationObjFactory.dll 2017-04-29 23:06 - 2017-04-13 16:35 - 01433600 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettings.Handlers.dll 2017-04-29 23:06 - 2017-04-13 16:35 - 00510976 _____ (Microsoft Corporation) C:\Windows\system32\TDLMigration.dll 2017-04-29 23:06 - 2017-04-13 16:35 - 00257024 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2017-04-29 23:06 - 2017-04-13 16:34 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\InputSwitch.dll 2017-04-29 23:06 - 2017-04-13 16:33 - 01269760 _____ (Microsoft Corporation) C:\Windows\system32\enterprisecsps.dll 2017-04-29 23:06 - 2017-04-13 16:31 - 00673280 _____ (Microsoft Corporation) C:\Windows\system32\LockAppBroker.dll 2017-04-29 23:06 - 2017-04-13 16:29 - 01583616 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2017-04-29 23:06 - 2017-04-13 16:29 - 01295872 _____ (Microsoft Corporation) C:\Windows\system32\dosvc.dll 2017-04-29 23:06 - 2017-04-13 16:26 - 01257472 _____ (Microsoft Corporation) C:\Windows\system32\wpnapps.dll 2017-04-29 23:06 - 2017-04-13 16:25 - 00750080 _____ (Microsoft Corporation) C:\Windows\system32\StorSvc.dll 2017-04-29 23:06 - 2017-04-13 16:24 - 01628160 _____ (Microsoft Corporation) C:\Windows\system32\comsvcs.dll 2017-04-29 23:06 - 2017-04-13 16:21 - 00078848 _____ (Microsoft Corporation) C:\Windows\system32\offreg.dll 2017-04-29 23:06 - 2017-04-13 16:15 - 00282112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VEEventDispatcher.dll 2017-04-29 23:06 - 2017-04-13 16:15 - 00232448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CloudBackupSettings.dll 2017-04-29 23:06 - 2017-04-13 16:13 - 00232960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll 2017-04-29 23:06 - 2017-04-13 16:08 - 01463296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2017-04-29 23:06 - 2017-04-13 16:06 - 00987648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpnapps.dll 2017-04-29 23:06 - 2017-04-13 16:04 - 00392704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PlayToManager.dll 2017-04-29 23:06 - 2017-04-13 16:01 - 00057856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\offreg.dll 2017-04-29 23:05 - 2017-04-19 00:07 - 00712600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms2.sys 2017-04-29 23:05 - 2017-04-18 23:16 - 00280064 _____ (Microsoft Corporation) C:\Windows\system32\WiFiDisplay.dll 2017-04-29 23:05 - 2017-04-18 23:15 - 00232960 _____ (Microsoft Corporation) C:\Windows\system32\wcmcsp.dll 2017-04-29 23:05 - 2017-04-18 23:14 - 00646656 _____ (Microsoft Corporation) C:\Windows\system32\LockHostingFramework.dll 2017-04-29 23:05 - 2017-04-18 23:13 - 00409600 _____ (Microsoft Corporation) C:\Windows\system32\updatehandlers.dll 2017-04-29 23:05 - 2017-04-18 23:11 - 00687104 _____ (Microsoft Corporation) C:\Windows\system32\LogonController.dll 2017-04-29 23:05 - 2017-04-18 23:08 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\usocore.dll 2017-04-29 23:05 - 2017-04-18 22:59 - 01087488 _____ (Microsoft Corporation) C:\Windows\system32\reseteng.dll 2017-04-29 23:05 - 2017-04-13 17:35 - 00741784 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Internal.Shell.Broker.dll 2017-04-29 23:05 - 2017-04-13 17:35 - 00673112 _____ (Microsoft Corporation) C:\Windows\system32\AppResolver.dll 2017-04-29 23:05 - 2017-04-13 17:32 - 01320352 _____ (Microsoft Corporation) C:\Windows\system32\wpx.dll 2017-04-29 23:05 - 2017-04-13 16:41 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\EnterpriseModernAppMgmtCSP.dll 2017-04-29 23:05 - 2017-04-13 16:39 - 00517632 _____ (Microsoft Corporation) C:\Windows\system32\daxexec.dll 2017-04-29 23:05 - 2017-04-13 16:38 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.AppDefaults.dll 2017-04-29 23:05 - 2017-04-13 16:37 - 00450048 _____ (Microsoft Corporation) C:\Windows\system32\bcdedit.exe 2017-04-29 23:05 - 2017-04-13 16:37 - 00301056 _____ (Microsoft Corporation) C:\Windows\system32\EnterpriseAppMgmtSvc.dll 2017-04-29 23:05 - 2017-04-13 16:37 - 00246272 _____ (Microsoft Corporation) C:\Windows\system32\domgmt.dll 2017-04-29 23:05 - 2017-04-13 16:36 - 00524800 _____ (Microsoft Corporation) C:\Windows\system32\TileDataRepository.dll 2017-04-29 23:05 - 2017-04-13 16:36 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\CloudBackupSettings.dll 2017-04-29 23:05 - 2017-04-13 16:34 - 01468416 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentExtensions.desktop.dll 2017-04-29 23:05 - 2017-04-13 16:33 - 00864256 _____ (Microsoft Corporation) C:\Windows\system32\NotificationController.dll 2017-04-29 23:05 - 2017-04-13 16:29 - 02499584 _____ (Microsoft Corporation) C:\Windows\system32\twinui.pcshell.dll 2017-04-29 23:05 - 2017-04-13 16:29 - 00840192 _____ (Microsoft Corporation) C:\Windows\system32\fveapi.dll 2017-04-29 23:05 - 2017-04-13 16:29 - 00647168 _____ (Microsoft Corporation) C:\Windows\system32\RDXService.dll 2017-04-29 23:05 - 2017-04-13 16:28 - 02443776 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll 2017-04-28 19:07 - 2017-04-28 19:07 - 00000000 ____D C:\Users\Neeko\AppData\Roaming\Macromedia 2017-04-28 18:38 - 2017-04-28 18:38 - 00000000 ____D C:\Users\Rick 0\Documents\League of Legends 2017-04-28 18:32 - 2017-04-28 18:32 - 00067728 _____ C:\Users\Rick 0\Downloads\ListeningPortfolioSPAN202.pdf 2017-04-28 16:39 - 2017-04-28 16:39 - 00098256 _____ C:\Users\Rick 0\Downloads\ListeningPortfolio_Sugerencias_Spring2017.pdf 2017-04-28 16:30 - 2017-05-16 11:27 - 00000000 ____D C:\Users\Rick 0\AppData\Local\CrashDumps 2017-04-28 16:21 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll 2017-04-28 16:21 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll 2017-04-28 16:21 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll 2017-04-28 16:21 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll 2017-04-28 16:21 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll 2017-04-28 16:21 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll 2017-04-28 16:21 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll 2017-04-28 16:21 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll 2017-04-28 16:21 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll 2017-04-28 16:21 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_43.dll 2017-04-28 16:21 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll 2017-04-28 16:21 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll 2017-04-28 16:21 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll 2017-04-28 16:21 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll 2017-04-28 16:21 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll 2017-04-28 16:21 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll 2017-04-27 16:06 - 2017-04-27 16:06 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_esif_umdf2_02_00_00.Wdf 2017-04-27 16:06 - 2017-04-27 16:06 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_esif_lf_01011.Wdf 2017-04-27 16:05 - 2017-05-16 11:26 - 00000613 _____ C:\Users\Rick 0\Documents\New Text Document.txt 2017-04-27 16:05 - 2017-04-27 16:05 - 00000000 ____D C:\Windows\system32\Intel 2017-04-26 20:03 - 2017-04-26 20:03 - 00266367 _____ C:\Users\Rick 0\Downloads\EClare.pdf 2017-04-25 12:04 - 2017-04-25 12:04 - 00000000 ____D C:\Users\Rick 0\Documents\DAMN_ 2017-04-24 13:52 - 2017-04-24 13:52 - 00002710 _____ C:\Users\Rick 0\Desktop\thuglife.txt 2017-04-24 12:29 - 2017-04-24 13:34 - 00002632 _____ C:\Users\Rick 0\Desktop\GenerateFNISforUsers - Shortcut.lnk 2017-04-24 12:29 - 2017-04-24 12:29 - 00002991 _____ C:\Users\Neeko\Desktop\GenerateFNISforUsers.lnk 2017-04-23 23:43 - 2017-04-23 23:43 - 00000000 ____D C:\Users\Rick 0\AppData\Roaming\Macromedia 2017-04-23 23:42 - 2017-04-23 23:42 - 00000000 ____D C:\Users\Rick 0\AppData\Roaming\LolClient 2017-04-23 22:15 - 2017-04-23 22:15 - 00000000 ____D C:\Users\Rick 0\AppData\Local\DBG 2017-04-23 21:46 - 2017-04-23 21:46 - 00001969 _____ C:\Users\Rick 0\Desktop\skse_loader.lnk 2017-04-23 21:26 - 2017-04-23 21:26 - 00000221 _____ C:\Users\Rick 0\Desktop\The Elder Scrolls V Skyrim.url 2017-04-23 17:22 - 2017-04-23 17:22 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf 2017-04-23 17:22 - 2017-04-23 17:22 - 00000000 ____D C:\Users\Rick 0\AppData\Local\Apple Computer 2017-04-23 16:02 - 2017-05-11 13:39 - 00000000 ____D C:\Users\Rick 0\Desktop\Nexus Mod Manager 2017-04-23 16:02 - 2017-04-23 16:02 - 00001303 _____ C:\Users\Public\Desktop\Nexus Mod Manager.lnk 2017-04-23 16:02 - 2017-04-23 16:02 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nexus Mod Manager 2017-04-23 16:00 - 2017-04-23 16:01 - 00000000 ____D C:\Users\Neeko\AppData\Local\Black_Tree_Gaming 2017-04-23 16:00 - 2017-04-23 16:00 - 00000000 ____D C:\Users\Neeko\Documents\Nexus Mod Manager 2017-04-23 15:55 - 2017-04-23 16:03 - 00000000 ____D C:\Users\Rick 0\AppData\Local\Black_Tree_Gaming 2017-04-23 15:55 - 2017-04-23 16:01 - 00000000 ____D C:\Program Files\Nexus Mod Manager 2017-04-23 15:55 - 2017-04-23 15:56 - 00000000 ____D C:\Users\Rick 0\Documents\Nexus Mod Manager 2017-04-23 14:16 - 2017-04-23 14:16 - 00000000 ____D C:\Users\Neeko\AppData\Roaming\Synaptics 2017-04-23 13:59 - 2017-04-23 13:59 - 00490108 _____ C:\Users\Rick 0\Downloads\LRupp History.pdf 2017-04-23 12:30 - 2017-03-26 17:52 - 15701641 _____ C:\Users\Rick 0\Documents\sdthroa and lol mod of it.7z 2017-04-23 12:00 - 2016-11-20 02:57 - 97963309 _____ (JohnnyLump ) C:\Users\Rick 0\Downloads\Long War EW 1.0 for PC-88-1-0.exe 2017-04-23 11:57 - 2016-05-26 13:44 - 1587902929 _____ C:\Users\Rick 0\Documents\AvPRedux2.0part1.7z 2017-04-23 11:57 - 2016-05-26 13:44 - 1244707449 _____ C:\Users\Rick 0\Documents\AvPRedux2.0part2.7z 2017-04-23 11:53 - 2017-05-14 18:50 - 00000000 ____D C:\Users\Rick 0\Documents\PSU 2017-04-23 11:52 - 2017-04-23 11:52 - 00000000 ____D C:\Users\Rick 0\Documents\NullDC 2017-04-23 11:44 - 2017-04-23 11:52 - 00000000 ____D C:\Users\Rick 0\Documents\my mind 2017-04-23 11:43 - 2017-04-23 11:44 - 00000000 ____D C:\Users\Rick 0\Documents\Moduntandblade mods 2017-04-23 11:40 - 2017-04-23 11:43 - 00000000 ____D C:\Users\Rick 0\Documents\Lstudio9 2017-04-23 11:25 - 2017-04-23 11:25 - 00000000 ____D C:\Users\Rick 0\Documents\Hardcore_Modestarwarsjedioutcast 2017-04-23 11:25 - 2017-04-23 11:25 - 00000000 ____D C:\Users\Rick 0\Documents\FK2jedioutcast 2017-04-23 11:21 - 2017-04-23 11:21 - 00000000 ____D C:\ProgramData\Riot Games 2017-04-23 11:20 - 2017-04-28 18:38 - 00001749 _____ C:\Users\Public\Desktop\League of Legends.lnk 2017-04-23 11:20 - 2017-04-23 11:20 - 00000000 ____D C:\Riot Games 2017-04-23 11:20 - 2008-07-12 08:18 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll 2017-04-23 11:20 - 2008-07-12 08:18 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll 2017-04-23 11:20 - 2008-07-12 08:18 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll 2017-04-23 11:19 - 2017-04-23 11:21 - 00000000 ____D C:\Users\Rick 0\AppData\Roaming\Riot Games 2017-04-23 11:13 - 2017-05-02 18:54 - 00000000 ____D C:\ProgramData\Package Cache 2017-04-23 11:12 - 2017-04-23 11:12 - 03176930 _____ C:\Users\Rick 0\Downloads\Chipset_10.1.1.42_Public.zip 2017-04-23 11:08 - 2017-04-23 11:08 - 00000000 ____D C:\Users\Rick 0\AppData\Roaming\Synaptics 2017-04-23 11:00 - 2017-04-23 11:00 - 00000000 ____D C:\Users\Neeko\AppData\Local\ElevatedDiagnostics 2017-04-23 10:59 - 2017-05-09 22:55 - 00000000 ____D C:\Windows\system32\MRT 2017-04-23 10:58 - 2017-05-09 22:53 - 156335152 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe 2017-04-23 10:58 - 2017-03-31 17:29 - 01518088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2017-04-23 10:58 - 2017-03-31 17:09 - 00094720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UserDataTimeUtil.dll 2017-04-23 10:58 - 2017-03-31 17:04 - 00364032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msIso.dll 2017-04-23 10:58 - 2017-03-31 17:02 - 00252928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsDocumentTargetPrint.dll 2017-04-23 10:58 - 2017-03-31 17:01 - 00429568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winspool.drv 2017-04-23 10:58 - 2017-03-31 16:56 - 01060352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsPrint.dll 2017-04-23 10:58 - 2017-03-31 16:52 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmjpegdec.dll 2017-04-23 10:58 - 2017-03-31 16:52 - 00078336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\asycfilt.dll 2017-04-23 10:57 - 2017-04-23 10:57 - 00000571 _____ C:\Users\Rick 0\Downloads\DeviceDiagnostic.diagcab 2017-04-23 10:57 - 2017-03-31 17:57 - 00626520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontdrvhost.exe 2017-04-23 10:57 - 2017-03-31 17:57 - 00311192 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll 2017-04-23 10:57 - 2017-03-31 17:51 - 01760264 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2017-04-23 10:57 - 2017-03-31 17:28 - 00354360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcryptprimitives.dll 2017-04-23 10:57 - 2017-03-31 17:11 - 00038912 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll 2017-04-23 10:57 - 2017-03-31 17:04 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\UserDataTimeUtil.dll 2017-04-23 10:57 - 2017-03-31 16:58 - 01506816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll 2017-04-23 10:57 - 2017-03-31 14:00 - 00032004 _____ C:\Windows\system32\edgehtmlpluginpolicy.bin 2017-04-23 10:56 - 2017-03-31 18:05 - 00750560 _____ (Microsoft Corporation) C:\Windows\system32\fontdrvhost.exe 2017-04-23 10:56 - 2017-03-31 18:04 - 01147296 _____ (Microsoft Corporation) C:\Windows\system32\hvix64.exe 2017-04-23 10:56 - 2017-03-31 18:04 - 01024416 _____ (Microsoft Corporation) C:\Windows\system32\hvax64.exe 2017-04-23 10:56 - 2017-03-31 18:04 - 00382368 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll 2017-04-23 10:56 - 2017-03-31 17:52 - 00409504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys 2017-04-23 10:56 - 2017-03-31 17:05 - 00047104 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll 2017-04-23 10:56 - 2017-03-31 16:58 - 00433664 _____ (Microsoft Corporation) C:\Windows\system32\msIso.dll 2017-04-23 10:56 - 2017-03-31 16:55 - 00545792 _____ (Microsoft Corporation) C:\Windows\system32\winspool.drv 2017-04-23 10:56 - 2017-03-31 16:55 - 00347136 _____ (Microsoft Corporation) C:\Windows\system32\XpsDocumentTargetPrint.dll 2017-04-23 10:56 - 2017-03-31 16:50 - 01657344 _____ (Microsoft Corporation) C:\Windows\system32\XpsPrint.dll 2017-04-23 10:56 - 2017-03-31 16:50 - 01605632 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll 2017-04-23 10:56 - 2017-03-31 16:45 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\mfmjpegdec.dll 2017-04-23 10:56 - 2017-03-31 16:44 - 00087552 _____ (Microsoft Corporation) C:\Windows\system32\asycfilt.dll 2017-04-23 10:48 - 2017-04-23 21:34 - 00000000 ____D C:\Users\Rick 0\AppData\Local\Skyrim 2017-04-23 03:13 - 2017-04-23 03:13 - 00000000 ____D C:\Program Files\Reference Assemblies 2017-04-23 03:13 - 2017-04-23 03:13 - 00000000 ____D C:\Program Files\MSBuild 2017-04-23 03:13 - 2017-04-23 03:13 - 00000000 ____D C:\Program Files (x86)\Reference Assemblies 2017-04-23 03:13 - 2017-04-23 03:13 - 00000000 ____D C:\Program Files (x86)\MSBuild 2017-04-23 03:12 - 2017-02-10 11:26 - 01166520 _____ (Microsoft Corporation) C:\Windows\system32\PresentationNative_v0300.dll 2017-04-23 03:12 - 2017-02-10 11:26 - 00124624 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll 2017-04-23 03:12 - 2017-02-10 11:26 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe 2017-04-23 03:12 - 2017-02-10 11:21 - 00778936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationNative_v0300.dll 2017-04-23 03:12 - 2017-02-10 11:21 - 00103120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll 2017-04-23 03:12 - 2017-02-10 11:21 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe 2017-04-23 03:12 - 2010-02-04 10:01 - 00530776 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_6.dll 2017-04-23 03:12 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_6.dll 2017-04-23 03:12 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_6.dll 2017-04-23 03:12 - 2010-02-04 10:01 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_6.dll 2017-04-23 03:12 - 2010-02-04 10:01 - 00078680 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_4.dll 2017-04-23 03:12 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_4.dll 2017-04-23 03:12 - 2010-02-04 10:01 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_7.dll 2017-04-23 03:12 - 2010-02-04 10:01 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_7.dll 2017-04-23 03:12 - 2009-09-04 17:44 - 00517960 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_5.dll 2017-04-23 03:12 - 2009-09-04 17:44 - 00515416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_5.dll 2017-04-23 03:12 - 2009-09-04 17:44 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_5.dll 2017-04-23 03:12 - 2009-09-04 17:44 - 00176968 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_5.dll 2017-04-23 03:12 - 2009-09-04 17:44 - 00073544 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_3.dll 2017-04-23 03:12 - 2009-09-04 17:44 - 00069464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_3.dll 2017-04-23 03:12 - 2009-09-04 17:29 - 05554512 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_42.dll 2017-04-23 03:12 - 2009-09-04 17:29 - 05501792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_42.dll 2017-04-23 03:12 - 2009-09-04 17:29 - 02582888 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_42.dll 2017-04-23 03:12 - 2009-09-04 17:29 - 02475352 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_42.dll 2017-04-23 03:12 - 2009-09-04 17:29 - 01974616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_42.dll 2017-04-23 03:12 - 2009-09-04 17:29 - 01892184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_42.dll 2017-04-23 03:12 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll 2017-04-23 03:12 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll 2017-04-23 03:12 - 2009-09-04 17:29 - 00285024 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_42.dll 2017-04-23 03:12 - 2009-09-04 17:29 - 00235344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_42.dll 2017-04-23 03:12 - 2009-03-16 14:18 - 00521560 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_4.dll 2017-04-23 03:12 - 2009-03-16 14:18 - 00517448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_4.dll 2017-04-23 03:12 - 2009-03-16 14:18 - 00235352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_4.dll 2017-04-23 03:12 - 2009-03-16 14:18 - 00174936 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_4.dll 2017-04-23 03:12 - 2009-03-16 14:18 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_6.dll 2017-04-23 03:12 - 2009-03-16 14:18 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_6.dll 2017-04-23 03:12 - 2009-03-09 15:27 - 05425496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_41.dll 2017-04-23 03:12 - 2009-03-09 15:27 - 04178264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_41.dll 2017-04-23 03:12 - 2009-03-09 15:27 - 02430312 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_41.dll 2017-04-23 03:12 - 2009-03-09 15:27 - 01846632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_41.dll 2017-04-23 03:12 - 2009-03-09 15:27 - 00520544 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_41.dll 2017-04-23 03:12 - 2009-03-09 15:27 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_41.dll 2017-04-23 03:12 - 2008-10-27 10:04 - 00518480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_3.dll 2017-04-23 03:12 - 2008-10-27 10:04 - 00514384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_3.dll 2017-04-23 03:12 - 2008-10-27 10:04 - 00235856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_3.dll 2017-04-23 03:12 - 2008-10-27 10:04 - 00175440 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_3.dll 2017-04-23 03:12 - 2008-10-27 10:04 - 00074576 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_2.dll 2017-04-23 03:12 - 2008-10-27 10:04 - 00070992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_2.dll 2017-04-23 03:12 - 2008-10-27 10:04 - 00025936 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_5.dll 2017-04-23 03:12 - 2008-10-27 10:04 - 00023376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_5.dll 2017-04-23 03:12 - 2008-10-15 06:22 - 05631312 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_40.dll 2017-04-23 03:12 - 2008-10-15 06:22 - 04379984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_40.dll 2017-04-23 03:12 - 2008-10-15 06:22 - 02605920 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_40.dll 2017-04-23 03:12 - 2008-10-15 06:22 - 02036576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_40.dll 2017-04-23 03:12 - 2008-10-15 06:22 - 00519000 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_40.dll 2017-04-23 03:12 - 2008-10-15 06:22 - 00452440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_40.dll 2017-04-23 03:12 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_2.dll 2017-04-23 03:12 - 2008-07-31 10:41 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_2.dll 2017-04-23 03:12 - 2008-07-31 10:41 - 00072200 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_1.dll 2017-04-23 03:12 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll 2017-04-23 03:12 - 2008-07-31 10:40 - 00513544 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_2.dll 2017-04-23 03:12 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll 2017-04-23 03:12 - 2008-07-10 11:00 - 04992520 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_39.dll 2017-04-23 03:12 - 2008-07-10 11:00 - 01942552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_39.dll 2017-04-23 03:12 - 2008-07-10 11:00 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_39.dll 2017-04-23 03:12 - 2008-05-30 14:19 - 00511496 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_1.dll 2017-04-23 03:12 - 2008-05-30 14:19 - 00507400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_1.dll 2017-04-23 03:12 - 2008-05-30 14:18 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_1.dll 2017-04-23 03:12 - 2008-05-30 14:18 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_1.dll 2017-04-23 03:12 - 2008-05-30 14:17 - 00068104 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_0.dll 2017-04-23 03:12 - 2008-05-30 14:17 - 00065032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_0.dll 2017-04-23 03:12 - 2008-05-30 14:17 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_4.dll 2017-04-23 03:12 - 2008-05-30 14:16 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_4.dll 2017-04-23 03:12 - 2008-05-30 14:11 - 04991496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_38.dll 2017-04-23 03:12 - 2008-05-30 14:11 - 03850760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_38.dll 2017-04-23 03:12 - 2008-05-30 14:11 - 01941528 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_38.dll 2017-04-23 03:12 - 2008-05-30 14:11 - 01491992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_38.dll 2017-04-23 03:12 - 2008-05-30 14:11 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_38.dll 2017-04-23 03:12 - 2008-05-30 14:11 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_38.dll 2017-04-23 03:12 - 2008-03-05 16:04 - 00489480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_0.dll 2017-04-23 03:12 - 2008-03-05 16:03 - 00479752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_0.dll 2017-04-23 03:12 - 2008-03-05 16:03 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_0.dll 2017-04-23 03:12 - 2008-03-05 16:03 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_0.dll 2017-04-23 03:12 - 2008-03-05 16:00 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_3.dll 2017-04-23 03:12 - 2008-03-05 16:00 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_3.dll 2017-04-23 03:12 - 2008-03-05 15:56 - 01860120 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_37.dll 2017-04-23 03:12 - 2008-03-05 15:56 - 01420824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_37.dll 2017-04-23 03:12 - 2008-02-05 23:07 - 00529424 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_37.dll 2017-04-23 03:12 - 2008-02-05 23:07 - 00462864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_37.dll 2017-04-23 03:11 - 2008-03-05 15:56 - 04910088 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_37.dll 2017-04-23 03:11 - 2008-03-05 15:56 - 03786760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_37.dll 2017-04-23 03:11 - 2007-10-22 03:40 - 00411656 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_10.dll 2017-04-23 03:11 - 2007-10-22 03:39 - 00267272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_10.dll 2017-04-23 03:11 - 2007-10-22 03:37 - 00021000 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_2.dll 2017-04-23 03:11 - 2007-10-22 03:37 - 00017928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_2.dll 2017-04-23 03:11 - 2007-10-12 15:14 - 05081608 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_36.dll 2017-04-23 03:11 - 2007-10-12 15:14 - 03734536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_36.dll 2017-04-23 03:11 - 2007-10-12 15:14 - 02006552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_36.dll 2017-04-23 03:11 - 2007-10-12 15:14 - 01374232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_36.dll 2017-04-23 03:11 - 2007-10-02 09:56 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_36.dll 2017-04-23 03:11 - 2007-10-02 09:56 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_36.dll 2017-04-23 03:11 - 2007-07-20 00:57 - 00411496 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_9.dll 2017-04-23 03:11 - 2007-07-20 00:57 - 00267112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_9.dll 2017-04-23 03:11 - 2007-07-19 18:14 - 05073256 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_35.dll 2017-04-23 03:11 - 2007-07-19 18:14 - 03727720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_35.dll 2017-04-23 03:11 - 2007-07-19 18:14 - 01985904 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_35.dll 2017-04-23 03:11 - 2007-07-19 18:14 - 01358192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_35.dll 2017-04-23 03:11 - 2007-07-19 18:14 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_35.dll 2017-04-23 03:11 - 2007-07-19 18:14 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_35.dll 2017-04-23 03:11 - 2007-06-20 20:49 - 00409960 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_8.dll 2017-04-23 03:11 - 2007-06-20 20:46 - 00266088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_8.dll 2017-04-23 03:11 - 2007-05-16 16:45 - 04496232 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_34.dll 2017-04-23 03:11 - 2007-05-16 16:45 - 03497832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_34.dll 2017-04-23 03:11 - 2007-05-16 16:45 - 01401200 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_34.dll 2017-04-23 03:11 - 2007-05-16 16:45 - 01124720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_34.dll 2017-04-23 03:11 - 2007-05-16 16:45 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_34.dll 2017-04-23 03:11 - 2007-05-16 16:45 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_34.dll 2017-04-23 03:11 - 2007-04-04 18:55 - 00403304 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_7.dll 2017-04-23 03:11 - 2007-04-04 18:55 - 00261480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_7.dll 2017-04-23 03:11 - 2007-04-04 18:54 - 00107368 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_3.dll 2017-04-23 03:11 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_3.dll 2017-04-23 03:11 - 2007-03-15 16:57 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_33.dll 2017-04-23 03:11 - 2007-03-15 16:57 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_33.dll 2017-04-23 03:11 - 2007-03-12 16:42 - 04494184 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_33.dll 2017-04-23 03:11 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_33.dll 2017-04-23 03:11 - 2007-03-12 16:42 - 01400176 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_33.dll 2017-04-23 03:11 - 2007-03-12 16:42 - 01123696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_33.dll 2017-04-23 03:11 - 2007-03-05 12:42 - 00017688 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_1.dll 2017-04-23 03:11 - 2007-03-05 12:42 - 00015128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_1.dll 2017-04-23 03:11 - 2007-01-24 15:27 - 00393576 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_6.dll 2017-04-23 03:11 - 2007-01-24 15:27 - 00255848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_6.dll 2017-04-23 03:11 - 2006-12-08 12:02 - 00251672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_5.dll 2017-04-23 03:11 - 2006-12-08 12:00 - 00390424 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_5.dll 2017-04-23 03:11 - 2006-11-29 13:06 - 04398360 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll 2017-04-23 03:11 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_32.dll 2017-04-23 03:11 - 2006-11-29 13:06 - 00469264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10.dll 2017-04-23 03:11 - 2006-11-29 13:06 - 00440080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10.dll 2017-04-23 03:11 - 2006-09-28 16:05 - 03977496 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_31.dll 2017-04-23 03:11 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll 2017-04-23 03:11 - 2006-09-28 16:05 - 00237848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_4.dll 2017-04-23 03:11 - 2006-09-28 16:04 - 00364824 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_4.dll 2017-04-23 03:11 - 2006-07-28 09:31 - 00083736 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_2.dll 2017-04-23 03:11 - 2006-07-28 09:30 - 00363288 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_3.dll 2017-04-23 03:11 - 2006-07-28 09:30 - 00236824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_3.dll 2017-04-23 03:11 - 2006-07-28 09:30 - 00062744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_2.dll 2017-04-23 03:11 - 2006-05-31 07:24 - 00230168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_2.dll 2017-04-23 03:11 - 2006-05-31 07:22 - 00354072 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_2.dll 2017-04-23 03:11 - 2006-03-31 12:41 - 03927248 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_30.dll 2017-04-23 03:11 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_30.dll 2017-04-23 03:11 - 2006-03-31 12:40 - 00352464 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_1.dll 2017-04-23 03:11 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_1.dll 2017-04-23 03:11 - 2006-03-31 12:39 - 00083664 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_1.dll 2017-04-23 03:11 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_1.dll 2017-04-23 03:11 - 2006-02-03 08:43 - 03830992 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_29.dll 2017-04-23 03:11 - 2006-02-03 08:43 - 02332368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_29.dll 2017-04-23 03:11 - 2006-02-03 08:42 - 00355536 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_0.dll 2017-04-23 03:11 - 2006-02-03 08:42 - 00230096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_0.dll 2017-04-23 03:11 - 2006-02-03 08:41 - 00016592 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_0.dll 2017-04-23 03:11 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_0.dll 2017-04-23 03:11 - 2005-12-05 18:09 - 03815120 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_28.dll 2017-04-23 03:11 - 2005-12-05 18:09 - 02323664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_28.dll 2017-04-23 03:11 - 2005-07-22 19:59 - 03807440 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_27.dll 2017-04-23 03:11 - 2005-07-22 19:59 - 02319568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_27.dll 2017-04-23 03:11 - 2005-05-26 15:34 - 03767504 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_26.dll 2017-04-23 03:11 - 2005-05-26 15:34 - 02297552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_26.dll 2017-04-23 03:11 - 2005-03-18 17:19 - 03823312 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_25.dll 2017-04-23 03:11 - 2005-03-18 17:19 - 02337488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_25.dll 2017-04-23 03:11 - 2005-02-05 19:45 - 03544272 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_24.dll 2017-04-23 03:11 - 2005-02-05 19:45 - 02222800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_24.dll 2017-04-23 03:09 - 2017-04-28 03:03 - 00000000 ____D C:\Users\Rick 0\Documents\My Games 2017-04-23 02:19 - 2017-04-23 02:19 - 00000000 ____D C:\Users\Rick 0\AppData\Local\Comms 2017-04-23 02:16 - 2017-04-23 02:16 - 00000000 ____D C:\Users\Rick 0\AppData\Local\Steam 2017-04-23 02:16 - 2017-04-23 02:16 - 00000000 ____D C:\Users\Rick 0\AppData\Local\CEF 2017-04-23 02:12 - 2017-04-23 02:12 - 00004214 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1492938726 2017-04-23 02:12 - 2017-04-23 02:12 - 00001427 _____ C:\Users\Rick 0\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Opera.lnk 2017-04-23 02:12 - 2017-04-23 02:12 - 00000000 ____D C:\Users\Rick 0\AppData\Roaming\Opera Software 2017-04-23 02:12 - 2017-04-23 02:12 - 00000000 ____D C:\Users\Rick 0\AppData\Local\Opera Software 2017-04-23 02:11 - 2017-04-23 02:11 - 01186224 _____ (Opera Software) C:\Users\Rick 0\Downloads\OperaSetup.exe 2017-04-23 02:07 - 2017-05-11 13:39 - 00000000 ____D C:\Users\Rick 0\Desktop\mods 2017-04-23 02:07 - 2017-04-23 02:07 - 00000000 ____D C:\Users\Rick 0\AppData\Local\MicrosoftEdge 2017-04-23 02:04 - 2017-04-23 02:04 - 00002366 _____ C:\Users\Rick 0\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk 2017-04-23 02:04 - 2017-04-23 02:04 - 00000000 ___RD C:\Users\Rick 0\OneDrive 2017-04-23 02:03 - 2017-04-23 17:27 - 00000000 ____D C:\Users\Rick 0\AppData\Roaming\Apple Computer 2017-04-23 02:02 - 2017-05-16 20:25 - 00000000 __SHD C:\Users\Rick 0\IntelGraphicsProfiles 2017-04-23 02:02 - 2017-05-04 11:19 - 00000000 ____D C:\Users\Rick 0\AppData\Local\Packages 2017-04-23 02:02 - 2017-04-23 02:02 - 00000000 ____D C:\Users\Rick 0\AppData\Roaming\Adobe 2017-04-23 02:02 - 2017-04-23 02:02 - 00000000 ____D C:\Users\Rick 0\AppData\Local\VirtualStore 2017-04-23 02:02 - 2017-04-23 02:02 - 00000000 ____D C:\Users\Rick 0\AppData\Local\TileDataLayer 2017-04-23 02:02 - 2017-04-23 02:02 - 00000000 ____D C:\Users\Rick 0\AppData\Local\Publishers 2017-04-23 02:02 - 2017-04-23 02:02 - 00000000 ____D C:\Users\Rick 0\AppData\Local\ConnectedDevicesPlatform 2017-04-23 02:01 - 2017-05-16 00:25 - 00000000 ____D C:\Users\Rick 0 2017-04-23 02:01 - 2017-04-23 02:01 - 00000020 ___SH C:\Users\Rick 0\ntuser.ini 2017-04-23 02:01 - 2017-04-23 02:01 - 00000000 _SHDL C:\Users\Rick 0\My Documents 2017-04-23 02:01 - 2017-04-23 02:01 - 00000000 _SHDL C:\Users\Rick 0\Documents\My Videos 2017-04-23 02:01 - 2017-04-23 02:01 - 00000000 _SHDL C:\Users\Rick 0\Documents\My Pictures 2017-04-23 02:01 - 2017-04-23 02:01 - 00000000 _SHDL C:\Users\Rick 0\Documents\My Music 2017-04-23 01:40 - 2017-05-16 20:28 - 00000000 ____D C:\Program Files (x86)\Steam 2017-04-23 01:40 - 2017-04-23 01:40 - 01446792 _____ C:\Users\Neeko\Downloads\SteamSetup.exe 2017-04-23 01:40 - 2017-04-23 01:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam 2017-04-23 01:36 - 2017-04-23 01:37 - 00000000 ____D C:\Users\Neeko\AppData\Roaming\Apple Computer 2017-04-23 01:36 - 2017-04-23 01:36 - 00000000 ____D C:\Users\Neeko\AppData\Local\Apple Computer 2017-04-23 01:36 - 2017-04-23 01:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes 2017-04-23 01:36 - 2017-04-23 01:36 - 00000000 ____D C:\ProgramData\Apple Computer 2017-04-23 01:36 - 2017-04-23 01:36 - 00000000 ____D C:\Program Files\iTunes 2017-04-23 01:36 - 2017-04-23 01:36 - 00000000 ____D C:\Program Files\iPod 2017-04-23 01:34 - 2017-04-23 01:34 - 00002535 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk 2017-04-23 01:34 - 2017-04-23 01:34 - 00000000 ____D C:\Users\Neeko\AppData\Local\Apple 2017-04-23 01:34 - 2017-04-23 01:34 - 00000000 ____D C:\Program Files\Common Files\Apple 2017-04-23 01:34 - 2017-04-23 01:34 - 00000000 ____D C:\Program Files\Bonjour 2017-04-23 01:34 - 2017-04-23 01:34 - 00000000 ____D C:\Program Files (x86)\Bonjour 2017-04-23 01:34 - 2017-04-23 01:34 - 00000000 ____D C:\Program Files (x86)\Apple Software Update 2017-04-23 01:33 - 2017-04-23 01:34 - 00000000 ____D C:\ProgramData\Apple 2017-04-23 01:29 - 2017-04-23 01:31 - 257659208 _____ (Apple Inc.) C:\Users\Neeko\Downloads\iTunes64Setup.exe 2017-04-22 13:44 - 2017-04-22 13:44 - 00000000 ____D C:\ProgramData\Sophos 2017-04-22 13:43 - 2017-04-22 13:43 - 00002775 _____ C:\Users\Public\Desktop\Sophos Virus Removal Tool.lnk 2017-04-22 13:43 - 2017-04-22 13:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sophos 2017-04-22 13:42 - 2017-04-22 13:42 - 00000000 ____D C:\Program Files (x86)\Sophos 2017-04-22 13:39 - 2017-04-22 13:40 - 165798592 _____ (Sophos Limited) C:\Users\Neeko\Desktop\Sophos Virus Removal Tool.exe 2017-04-22 13:30 - 2017-04-22 13:30 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_SynTP_01011.Wdf 2017-04-22 13:30 - 2017-04-22 13:30 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_Smb_driver_Intel_01011.Wdf 2017-04-22 13:30 - 2017-04-22 13:30 - 00000000 ____D C:\Program Files\Synaptics 2017-04-22 13:30 - 2016-10-05 00:44 - 00079960 _____ (Synaptics Incorporated) C:\Windows\system32\Drivers\Smb_driver_Intel.sys 2017-04-22 11:15 - 2017-04-22 11:11 - 00532136 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2017-04-22 11:11 - 2017-04-22 11:11 - 00014568 _____ C:\Windows\system32\Drivers\rtkhdasetting.zip 2017-04-22 11:11 - 2017-04-22 11:11 - 00002026 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bang & Olufsen.lnk 2017-04-22 11:11 - 2017-04-22 11:11 - 00000000 ____D C:\Windows\SysWOW64\RTCOM 2017-04-22 11:11 - 2017-04-22 11:11 - 00000000 ____D C:\Windows\system32\SRSLabs 2017-04-22 11:11 - 2017-04-22 11:11 - 00000000 ____D C:\ProgramData\SRS Labs 2017-04-22 11:11 - 2017-04-22 11:11 - 00000000 ____D C:\Program Files\Realtek 2017-04-22 11:10 - 2017-04-22 11:10 - 00000000 ____D C:\Program Files (x86)\VulkanRT 2017-04-22 11:10 - 2016-09-09 11:25 - 00269600 _____ C:\Windows\SysWOW64\vulkan-1.dll 2017-04-22 11:10 - 2016-09-09 11:25 - 00261920 _____ C:\Windows\system32\vulkan-1.dll 2017-04-22 11:10 - 2016-09-09 11:25 - 00110880 _____ C:\Windows\SysWOW64\vulkaninfo.exe 2017-04-22 11:10 - 2016-09-09 11:24 - 00125216 _____ C:\Windows\system32\vulkaninfo.exe 2017-04-22 11:09 - 2017-05-10 00:16 - 00000000 ____D C:\ProgramData\NVIDIA 2017-04-22 11:09 - 2017-04-22 11:09 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation 2017-04-22 11:09 - 2017-03-29 12:20 - 06399544 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll 2017-04-22 11:09 - 2017-03-29 12:20 - 02476480 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll 2017-04-22 11:09 - 2017-03-29 12:20 - 01762752 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll 2017-04-22 11:09 - 2017-03-29 12:20 - 00548408 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshext.dll 2017-04-22 11:09 - 2017-03-29 12:20 - 00393784 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll 2017-04-22 11:09 - 2017-03-29 12:20 - 00081856 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshextr.dll 2017-04-22 11:09 - 2017-03-29 12:20 - 00069568 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll 2017-04-22 11:09 - 2017-03-29 12:13 - 00001951 _____ C:\Windows\NvContainerRecovery.bat 2017-04-22 11:09 - 2017-03-29 00:30 - 07847617 _____ C:\Windows\system32\nvcoproc.bin 2017-04-22 11:08 - 2017-04-22 11:09 - 00000000 ____D C:\Program Files\NVIDIA Corporation 2017-04-22 11:08 - 2017-04-22 11:08 - 00000000 ____D C:\ProgramData\NVIDIA Corporation 2017-04-22 11:07 - 2017-04-22 11:07 - 01381582 _____ (Igor Pavlov) C:\Users\Neeko\Downloads\7z1604-x64.exe 2017-04-22 11:07 - 2017-04-22 11:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip 2017-04-22 11:07 - 2017-04-22 11:07 - 00000000 ____D C:\Program Files\7-Zip 2017-04-22 11:06 - 2017-05-16 20:28 - 00000000 ____D C:\ProgramData\MCShield 2017-04-22 11:06 - 2017-04-22 11:06 - 00001145 _____ C:\Users\Public\Desktop\MCShield Real-Time Monitor.lnk 2017-04-22 11:06 - 2017-04-22 11:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MCShield 2017-04-22 11:06 - 2017-04-22 11:06 - 00000000 ____D C:\Program Files (x86)\MCShield 2017-04-22 11:05 - 2017-04-22 11:05 - 02856736 _____ (MyCity) C:\Users\Neeko\Downloads\MCShield-Setup.exe 2017-04-22 11:04 - 2017-04-22 11:04 - 01551792 _____ (RaMMicHaeL) C:\Users\Neeko\Downloads\unchecky_setup.exe 2017-04-22 11:04 - 2017-04-22 11:04 - 00001088 _____ C:\Users\Public\Desktop\Unchecky.lnk 2017-04-22 11:04 - 2017-04-22 11:04 - 00000000 ____D C:\ProgramData\Unchecky 2017-04-22 11:04 - 2017-04-22 11:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Unchecky 2017-04-22 11:04 - 2017-04-22 11:04 - 00000000 ____D C:\Program Files (x86)\Unchecky 2017-04-21 17:10 - 2017-04-21 16:15 - 00000000 ____D C:\Windows\Panther 2017-04-21 16:47 - 2017-05-16 20:29 - 00000000 ____D C:\FRST 2017-04-21 16:46 - 2017-04-21 16:46 - 00003326 _____ C:\Users\Neeko\Desktop\rk_5BE3.tmp.txt 2017-04-21 16:42 - 2017-05-16 16:01 - 02429952 _____ (Farbar) C:\Users\Neeko\Desktop\FRST64.exe 2017-04-21 16:42 - 2017-04-21 16:42 - 00000000 ____D C:\Windows\SysWOW64\sda 2017-04-21 16:42 - 2017-04-21 16:42 - 00000000 ____D C:\Users\Neeko\AppData\Local\Comms 2017-04-21 16:31 - 2017-04-21 16:47 - 00000000 ____D C:\ProgramData\RogueKiller 2017-04-21 16:31 - 2017-04-21 16:31 - 00028272 _____ C:\Windows\system32\Drivers\TrueSight.sys 2017-04-21 16:31 - 2017-04-21 16:31 - 00000899 _____ C:\Users\Public\Desktop\RogueKiller.lnk 2017-04-21 16:31 - 2017-04-21 16:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller 2017-04-21 16:30 - 2017-05-16 20:27 - 00000180 _____ C:\Windows\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat 2017-04-21 16:30 - 2017-05-16 20:27 - 00000000 __SHD C:\Users\Neeko\IntelGraphicsProfiles 2017-04-21 16:30 - 2017-04-23 11:13 - 00000000 ____D C:\Program Files\Intel 2017-04-21 16:30 - 2017-04-21 16:31 - 00000000 ____D C:\Program Files\RogueKiller 2017-04-21 16:30 - 2017-04-21 16:30 - 00000200 _____ C:\Windows\system32\{EC94D02F-D200-4428-9531-05AF7F9799CB}.bat 2017-04-21 16:30 - 2017-04-21 16:30 - 00000000 ____D C:\Program Files (x86)\Intel 2017-04-21 16:30 - 2017-04-21 16:30 - 00000000 ____D C:\Intel 2017-04-21 16:30 - 2017-04-21 16:30 - 00000000 _____ C:\Windows\system32\GfxValDisplayLog.bin 2017-04-21 16:30 - 2017-01-13 19:38 - 00103936 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.DLL 2017-04-21 16:30 - 2017-01-13 19:38 - 00099840 _____ (Khronos Group) C:\Windows\system32\OpenCL.DLL 2017-04-21 16:29 - 2017-04-21 16:30 - 35331712 _____ (Adlice Software ) C:\Users\Neeko\Downloads\setup.exe 2017-04-21 16:28 - 2017-05-10 00:16 - 00000000 ____D C:\ProgramData\Synaptics 2017-04-21 16:28 - 2017-04-21 16:28 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_wbf_vfs_0050_01_09_00.Wdf 2017-04-21 16:28 - 2017-04-21 16:28 - 00000000 ____D C:\Program Files (x86)\HP 2017-04-21 16:27 - 2017-04-21 16:27 - 00003290 _____ C:\Windows\System32\Tasks\OneDrive Standalone Update Task v2 2017-04-21 16:27 - 2017-04-21 16:27 - 00002363 _____ C:\Users\Neeko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk 2017-04-21 16:27 - 2017-04-21 16:27 - 00000000 ___RD C:\Users\Neeko\OneDrive 2017-04-21 16:26 - 2017-04-21 16:26 - 00000000 ____D C:\Users\Neeko\AppData\Local\MicrosoftEdge 2017-04-21 16:26 - 2017-04-21 16:26 - 00000000 ____D C:\ProgramData\USOShared 2017-04-21 16:25 - 2017-04-21 16:25 - 00000000 ____D C:\ProgramData\Microsoft OneDrive 2017-04-21 16:23 - 2017-05-16 11:30 - 00000000 ____D C:\Users\Neeko\AppData\Local\Packages 2017-04-21 16:23 - 2017-05-16 11:29 - 00000000 __RHD C:\Users\Public\AccountPictures 2017-04-21 16:23 - 2017-04-23 01:27 - 00000000 ____D C:\Users\Neeko\AppData\Local\ConnectedDevicesPlatform 2017-04-21 16:23 - 2017-04-21 16:23 - 00000000 ____D C:\Users\Neeko\AppData\Roaming\Adobe 2017-04-21 16:23 - 2017-04-21 16:23 - 00000000 ____D C:\Users\Neeko\AppData\Local\VirtualStore 2017-04-21 16:23 - 2017-04-21 16:23 - 00000000 ____D C:\Users\Neeko\AppData\Local\TileDataLayer 2017-04-21 16:23 - 2017-04-21 16:23 - 00000000 ____D C:\Users\Neeko\AppData\Local\Publishers 2017-04-21 16:22 - 2017-04-23 01:26 - 00000000 ____D C:\Users\Neeko 2017-04-21 16:22 - 2017-04-21 16:22 - 00000020 ___SH C:\Users\Neeko\ntuser.ini 2017-04-21 16:22 - 2017-04-21 16:22 - 00000000 _SHDL C:\Users\Neeko\My Documents 2017-04-21 16:22 - 2017-04-21 16:22 - 00000000 _SHDL C:\Users\Neeko\Documents\My Videos 2017-04-21 16:22 - 2017-04-21 16:22 - 00000000 _SHDL C:\Users\Neeko\Documents\My Pictures 2017-04-21 16:22 - 2017-04-21 16:22 - 00000000 _SHDL C:\Users\Neeko\Documents\My Music 2017-04-21 16:20 - 2017-05-11 12:21 - 01491364 _____ C:\Windows\system32\PerfStringBackup.INI 2017-04-21 16:18 - 2017-03-18 13:56 - 02233344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PrintConfig.dll 2017-04-21 16:16 - 2017-04-21 16:16 - 00000000 _SHDL C:\Users\Public\Documents\My Videos 2017-04-21 16:16 - 2017-04-21 16:16 - 00000000 _SHDL C:\Users\Public\Documents\My Pictures 2017-04-21 16:16 - 2017-04-21 16:16 - 00000000 _SHDL C:\Users\Public\Documents\My Music 2017-04-21 16:16 - 2017-04-21 16:16 - 00000000 _SHDL C:\Users\Default\My Documents 2017-04-21 16:16 - 2017-04-21 16:16 - 00000000 _SHDL C:\Users\Default\Documents\My Videos 2017-04-21 16:16 - 2017-04-21 16:16 - 00000000 _SHDL C:\Users\Default\Documents\My Pictures 2017-04-21 16:16 - 2017-04-21 16:16 - 00000000 _SHDL C:\Users\Default\Documents\My Music 2017-04-21 16:16 - 2017-04-21 16:16 - 00000000 _SHDL C:\Users\Default User\Documents\My Videos 2017-04-21 16:16 - 2017-04-21 16:16 - 00000000 _SHDL C:\Users\Default User\Documents\My Pictures 2017-04-21 16:16 - 2017-04-21 16:16 - 00000000 _SHDL C:\Users\Default User\Documents\My Music 2017-04-21 16:16 - 2017-04-21 16:16 - 00000000 _SHDL C:\Documents and Settings 2017-04-21 16:11 - 2017-05-16 16:00 - 00000000 ____D C:\Windows\system32\SleepStudy 2017-04-21 16:11 - 2017-05-10 00:17 - 00217000 _____ C:\Windows\system32\FNTCACHE.DAT 2017-04-21 16:11 - 2017-05-10 00:16 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2017-04-21 16:11 - 2017-04-21 16:11 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf 2017-04-21 16:11 - 2017-04-21 16:11 - 00000000 ____D C:\Windows\ServiceProfiles ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2017-05-16 20:25 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\AppReadiness 2017-05-16 16:02 - 2017-03-18 14:01 - 00000000 ____D C:\Windows\INF 2017-05-16 13:49 - 2017-03-18 14:03 - 00000000 ___HD C:\Program Files\WindowsApps 2017-05-12 13:53 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\rescache 2017-05-10 00:16 - 2017-03-18 04:40 - 01310720 _____ C:\Windows\system32\config\BBI 2017-05-10 00:15 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\system32\appraiser 2017-05-10 00:15 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\ShellExperiences 2017-05-10 00:15 - 2017-03-18 14:03 - 00000000 ____D C:\Program Files\Windows Photo Viewer 2017-05-10 00:15 - 2017-03-18 14:03 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer 2017-05-09 22:56 - 2017-03-18 13:51 - 00000000 ____D C:\Windows\CbsTemp 2017-05-09 16:59 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\SysWOW64\Macromed 2017-05-09 16:59 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\system32\Macromed 2017-05-01 00:02 - 2017-03-18 14:03 - 00000000 ___SD C:\Windows\SysWOW64\F12 2017-05-01 00:02 - 2017-03-18 14:03 - 00000000 ___SD C:\Windows\system32\F12 2017-05-01 00:02 - 2017-03-18 14:03 - 00000000 ___RD C:\Windows\ImmersiveControlPanel 2017-05-01 00:02 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\SysWOW64\Dism 2017-05-01 00:02 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\system32\WinBioPlugIns 2017-05-01 00:02 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\Provisioning 2017-05-01 00:02 - 2017-03-18 04:40 - 00000000 ____D C:\Windows\system32\Dism 2017-04-28 18:05 - 2017-03-18 14:06 - 00835576 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2017-04-28 18:05 - 2017-03-18 14:06 - 00177656 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2017-04-28 16:18 - 2017-03-18 14:03 - 00000000 ____D C:\Program Files\Common Files\microsoft shared 2017-04-26 10:38 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\appcompat 2017-04-23 01:22 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\system32\WinBioDatabase 2017-04-22 11:09 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\Help 2017-04-21 17:10 - 2017-03-18 14:03 - 00028672 _____ C:\Windows\system32\config\BCD-Template 2017-04-21 16:44 - 2017-03-18 14:03 - 00000000 ___HD C:\Windows\system32\GroupPolicy 2017-04-21 16:26 - 2017-03-18 14:03 - 00000000 ____D C:\ProgramData\USOPrivate 2017-04-21 16:18 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\system32\spool 2017-04-21 16:18 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\system32\FxsTmp 2017-04-21 16:17 - 2017-03-18 14:03 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft 2017-04-21 16:15 - 2017-03-18 04:40 - 00000000 ____D C:\Windows\system32\Sysprep 2017-04-21 16:12 - 2017-03-18 19:31 - 00000000 ____D C:\Windows\HoloShell 2017-04-21 16:12 - 2017-03-18 14:03 - 00000000 ___RD C:\Windows\PrintDialog 2017-04-21 16:12 - 2017-03-18 14:03 - 00000000 ___RD C:\Windows\MiracastView 2017-04-21 16:11 - 2017-03-18 04:40 - 00032768 _____ C:\Windows\system32\config\ELAM Some files in TEMP: ==================== 2017-04-21 16:31 - 2017-03-18 13:57 - 1930320 _____ (Microsoft Corporation) C:\Users\Neeko\AppData\Local\Temp\dllnt_dump.dll ==================== Bamital & volsnap ====================== (There is no automatic fix for files that do not pass verification.) C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\dnsapi.dll => File is digitally signed C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2017-05-08 03:04 ==================== End of FRST.txt ============================ Thank you!