Jump to content

DoucheMcBaggins

Members
  • Content Count

    10
  • Joined

  • Last visited

About DoucheMcBaggins

  • Rank
    New Member

Recent Profile Visitors

The recent visitors block is disabled and is not being shown to other users.

  1. Did a scan with MBAM and RogueKiller and they both came back negative.
  2. It's greatly appreciated. Getting rid of the malware has taken a lot of weight off my mind, and the performance boost is a lovely bonus.
  3. A lot better, thanks! My CPU monitor on Rainmeter usually registered anywhere from 40-80% with a browser open. Now I'm rarely getting more than 20%. I've got 2-factor-authentication on all my stuff just to be sure.
  4. Fix result of Farbar Recovery Scan Tool (x64) Version: 04-06-2019 Ran by LeonM (04-06-2019 20:06:32) Run:1 Running from C:\Users\LeonM\Documents Loaded Profiles: LeonM (Available Profiles: LeonM) Boot Mode: Normal ============================================== fixlist content: ***************** CreateRestorePoint: EmptyTemp: CloseProcesses: HKU\S-1-5-21-2322255856-1445579512-3484448224-1001\...\Winlogon: [Shell] C:\Windows\explorer.exe [3933296 2019-03-14] (Microsoft Windows -> Microsoft Corporation) <==== ATTENTION FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION Task: {A3337E02-50C7-4E63-87AC-E92087DEB6CF} - System32\Tasks\R@1n-KMS\Windows64Professional => wmic path SoftwareLicensingProduct where (ID="2de67392-b7a7-462a-b1ca-108dd189f588") call Activate Task: {BD1A2573-3AF5-42C1-AA1D-D45AEEB8FA4A} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION Task: {BD1A2573-3AF5-42C1-AA1D-D45AEEB8FA4A} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION HKLM\SYSTEM\CurrentControlSet\Services\aswSP <==== ATTENTION (Rootkit!) HKLM\SYSTEM\CurrentControlSet\Services\aswMonFlt <==== ATTENTION (Rootkit!) HKLM\SYSTEM\CurrentControlSet\Services\aswSnx <==== ATTENTION (Rootkit!) ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => -> No File ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => -> No File ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => -> No File ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => -> No File ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => -> No File ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => -> No File ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => -> No File ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => -> No File ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => -> No File ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => -> No File ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => -> No File ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => -> No File ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => -> No File ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => -> No File AlternateDataStreams: C:\Users\LeonM\AppData\Local\Temp:$DATA? [16] HKU\S-1-5-21-2322255856-1445579512-3484448224-1001\Software\Classes\regfile: regedit.exe "%1" <==== ATTENTION FirewallRules: [{DA4AB33C-0913-467D-A6A1-A62F561223B5}] => (Block) %ProgramFiles% (x86)\IK Multimedia\AmpliTube 3\AmpliTube 3.exe No File ***************** Restore point was successfully created. Processes closed successfully. "HKU\S-1-5-21-2322255856-1445579512-3484448224-1001\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell" => removed successfully HKLM\SOFTWARE\Policies\Mozilla => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A3337E02-50C7-4E63-87AC-E92087DEB6CF}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A3337E02-50C7-4E63-87AC-E92087DEB6CF}" => removed successfully C:\WINDOWS\System32\Tasks\R@1n-KMS\Windows64Professional => moved successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\R@1n-KMS\Windows64Professional" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{BD1A2573-3AF5-42C1-AA1D-D45AEEB8FA4A}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BD1A2573-3AF5-42C1-AA1D-D45AEEB8FA4A}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UNP\RunCampaignManager" => not found "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BD1A2573-3AF5-42C1-AA1D-D45AEEB8FA4A}" => not found "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UNP\RunCampaignManager" => not found HKLM\SYSTEM\CurrentControlSet\Services\aswSP <==== ATTENTION (Rootkit!) => Error: No automatic fix found for this entry. HKLM\SYSTEM\CurrentControlSet\Services\aswMonFlt <==== ATTENTION (Rootkit!) => Error: No automatic fix found for this entry. HKLM\SYSTEM\CurrentControlSet\Services\aswSnx <==== ATTENTION (Rootkit!) => Error: No automatic fix found for this entry. HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive1 => removed successfully HKLM\Software\Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524} => not found HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive2 => removed successfully HKLM\Software\Classes\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282} => not found HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive3 => removed successfully HKLM\Software\Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30} => not found HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive4 => removed successfully HKLM\Software\Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A} => not found HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive5 => removed successfully HKLM\Software\Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => not found HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive6 => removed successfully HKLM\Software\Classes\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3} => not found HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive7 => removed successfully HKLM\Software\Classes\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => not found HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00asw => removed successfully HKLM\Software\Classes\CLSID\{472083B0-C522-11CF-8763-00608CC02F24} => not found HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive1 => removed successfully HKLM\Software\Wow6432Node\Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524} => not found HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive2 => removed successfully HKLM\Software\Wow6432Node\Classes\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282} => not found HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive3 => removed successfully HKLM\Software\Wow6432Node\Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30} => not found HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive4 => removed successfully HKLM\Software\Wow6432Node\Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A} => not found HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive5 => removed successfully HKLM\Software\Wow6432Node\Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => not found HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive6 => removed successfully HKLM\Software\Wow6432Node\Classes\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3} => not found HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive7 => removed successfully HKLM\Software\Wow6432Node\Classes\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => not found C:\Users\LeonM\AppData\Local\Temp => ":$DATA?" ADS could not remove. HKU\S-1-5-21-2322255856-1445579512-3484448224-1001\Software\Classes\regfile => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{DA4AB33C-0913-467D-A6A1-A62F561223B5}" => removed successfully =========== EmptyTemp: ========== BITS transfer queue => 10772480 B DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 240716704 B Java, Flash, Steam htmlcache => 441095926 B Windows/system/drivers => 8995088 B Edge => 19542 B Chrome => 587532746 B Firefox => 0 B Opera => 0 B Temp, IE cache, history, cookies, recent: Default => 0 B Users => 0 B ProgramData => 0 B Public => 0 B systemprofile => 0 B systemprofile32 => 0 B LocalService => 2800 B LocalService => 0 B NetworkService => 8210 B NetworkService => 0 B LeonM => 3832497966 B RecycleBin => 0 B EmptyTemp: => 4.8 GB temporary data Removed. ================================ The system needed a reboot. ==== End of Fixlog 20:10:48 ====
  5. RogueKiller Anti-Malware V13.2.1.0 (x64) [May 22 2019] (Free) by Adlice Software mail : https://adlice.com/contact/ Website : https://adlice.com/download/roguekiller/ Operating System : Windows 10 (10.0.17134) 64 bits Started in : Normal mode User : LeonM [Administrator] Started from : C:\Program Files\RogueKiller\RogueKiller64.exe Signatures : 20190603_120845, Driver : Loaded Mode : Standard Scan, Scan -- Date : 2019/06/03 17:43:15 (Duration : 00:23:49) Switches : -refid 3 ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ [PUP.HackTool (Potentially Malicious)] KMS-R@1n.exe (3432) -- C:\Windows\KMS-R@1n.exe -> Found ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Process Modules ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Services ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ [PUP.HackTool (Potentially Malicious)] KMS-R@1n (3432) -- C:\Windows\KMS-R@1n.exe -> Found ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Tasks ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ [Suspicious.Path (Potentially Malicious)] \Scheduled Updater - {07942618-bd98-47fa-bb01-a7ddc1fec6b0} -- C:\ProgramData\{07942618-BD98-47FA-BB01-A7DDC1FEC6B0}\SystemSettings.exe -> Found [Suspicious.Path (Potentially Malicious)] \SystemMaintanceService -- C:\Users\LeonM\AppData\Roaming\Star.Wars.Battlefront.II.Classic.v1.1.REPACK\zsetgsar.exe [/upgradeid=f561932c-0bef-41b9-9289-b7d5c099b86b] -> Found ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Registry ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ >>>>>> XX - Software [PUP.Gen1 (Potentially Malicious)] (X64) HKEY_USERS\S-1-5-21-2322255856-1445579512-3484448224-1001\Software\ProductSetup -- N/A -> Found >>>>>> O23 - Services [PUP.HackTool (Potentially Malicious)] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\KMS-R@1n -- C:\Windows\KMS-R@1n.exe -> Found >>>>>> O87 - Firewall [PUP.HackTool (Potentially Malicious)] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules|{3954CDCC-E875-4F33-B9C2-40164143C151} -- v2.25|Action=Allow|Active=TRUE|Dir=Out|Protocol=6|LPort=1688|App=C:\Windows\KMS-R@1n.exe|Name=KMS-R@1n| (C:\Windows\KMS-R@1n.exe) -> Found [PUP.HackTool (Potentially Malicious)] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules|{92F37B89-81E5-4F4C-B99C-D7BE91E0EDCD} -- v2.25|Action=Allow|Active=TRUE|Dir=In|Protocol=6|LPort=1688|App=C:\Windows\KMS-R@1n.exe|Name=KMS-R@1n| (C:\Windows\KMS-R@1n.exe) -> Found >>>>>> XX - System Policies [PUM.Policies (Potentially Malicious)] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System|ConsentPromptBehaviorAdmin -- 0 -> Found ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ WMI ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Hosts File ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Files ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ [PUP.HackTool (Potentially Malicious)] (file) KMS-R@1n.exe -- C:\Windows\KMS-R@1n.exe -> Found [PUP.HackTool (Potentially Malicious)] (file) SECOH-QAD.exe -- C:\Windows\SECOH-QAD.exe -> Found [PUP.Gen1 (Potentially Malicious)] (folder) PackageAware -- C:\Users\LeonM\AppData\Local\PackageAware -> Found [PUP.ByteFence|PUP.Gen1 (Potentially Malicious)] (folder) ByteFence -- C:\ProgramData\ByteFence -> Found [PUP.HackTool (Potentially Malicious)] (folder) KMSpico -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico -> Found [PUP.HackTool (Potentially Malicious)] (folder) KMSpico -- C:\Program Files\KMSpico -> Found ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Web browsers ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 01-06-2019 Ran by LeonM (administrator) on LEON-PC (Micro-Star International Co., Ltd MS-7A34) (03-06-2019 19:10:33) Running from C:\Users\LeonM\Desktop Loaded Profiles: LeonM (Available Profiles: LeonM) Platform: Windows 10 Pro Version 1803 17134.766 (X64) Language: English (United States) Default browser: Chrome Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Adlice -> ) C:\Program Files\RogueKiller\RogueKiller64.exe (Adobe Systems, Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Corsair Components, Inc. -> Corsair Memory, Inc.) C:\Program Files (x86)\Corsair\CORSAIR iCUE Software\Corsair.Service.CpuIdRemote64.exe (Corsair Components, Inc. -> Corsair Memory, Inc.) C:\Program Files (x86)\Corsair\CORSAIR iCUE Software\Corsair.Service.DisplayAdapter.exe (Corsair Components, Inc. -> Corsair Memory, Inc.) C:\Program Files (x86)\Corsair\CORSAIR iCUE Software\Corsair.Service.exe (EnigmaSoft Limited -> EnigmaSoft Limited) C:\Program Files\EnigmaSoft\SpyHunter\ShMonitor.exe (Even Balance, Inc. -> ) C:\Windows\SysWOW64\PnkBstrA.exe (Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Logitech Inc -> Logitech Inc.) C:\Program Files\Logitech Gaming Software\Drivers\APOService\LogiRegistryService.exe (Logitech Inc -> Logitech) C:\Program Files\Logitech\FlightSupport\FlightSupport.exe (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1904.1-0\MsMpEng.exe (Microsoft Corporation -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1904.1-0\NisSrv.exe (Microsoft Windows -> Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\DataExchangeHost.exe (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\wbem\WMIC.exe (NATIVE INSTRUMENTS GmbH -> Native Instruments GmbH) C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe (NVIDIA Corporation -> Node.js) C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe (Open Source Developer, Stefan KUENG -> hxxp://tortoisesvn.net) C:\Program Files\TortoiseSVN\bin\TSVNCache.exe (Open Source Developer, Stefan KUENG -> hxxp://tortoisesvn.net) C:\Program Files\TortoiseSVN\bin\TSVNCache.exe (Oracle America, Inc. -> Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Samsung Electronics CO., LTD. -> DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe (Wondershare Technology Co.,Ltd -> Wondershare) C:\Program Files (x86)\Wondershare\WAF\2.4.3.237\WsAppService.exe ==================== Registry (Whitelisted) =========================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [638872 2018-04-12] (Microsoft Windows -> Microsoft Corporation) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [9192960 2017-03-30] (Realtek Semiconductor Corp. -> Realtek Semiconductor) HKLM\...\Run: [Launch LCore] => C:\Program Files\Logitech Gaming Software\LCore.exe [17988216 2017-08-18] (Logitech Inc -> Logitech Inc.) HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [112512 2010-03-13] (Microsoft Corporation -> Microsoft Corporation) HKLM\...\Run: [FlightSupport] => C:\Program Files\Logitech\FlightSupport\FlightSupport.exe [362616 2017-05-17] (Logitech Inc -> Logitech) HKLM\...\Run: [X52] => C:\Program Files\Logitech\X52\X52_Profiler.exe [17408 2017-05-17] (Logitech) [File not signed] HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [638872 2018-04-12] (Microsoft Windows -> Microsoft Corporation) HKLM-x32\...\Run: [PWRISOVM.EXE] => C:\Program Files\PowerISO\PWRISOVM.EXE [456328 2017-06-07] (Power Software Limited -> Power Software Ltd) HKLM-x32\...\Run: [CORSAIR iCUE Software] => C:\Program Files (x86)\Corsair\CORSAIR iCUE Software\iCUE Launcher.exe [392240 2018-11-23] (Corsair Components, Inc. -> Corsair Memory, Inc.) HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2012-02-20] (Apple Inc. -> Apple Inc.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [645456 2019-04-01] (Oracle America, Inc. -> Oracle Corporation) HKU\S-1-5-19\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-12] (Microsoft Windows -> Microsoft Corporation) HKU\S-1-5-20\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-12] (Microsoft Windows -> Microsoft Corporation) HKU\S-1-5-21-2322255856-1445579512-3484448224-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3148576 2019-05-23] (Valve -> Valve Corporation) HKU\S-1-5-21-2322255856-1445579512-3484448224-1001\...\Run: [Gyazo] => C:\Program Files (x86)\Gyazo\GyStation.exe [1427848 2019-04-10] (Nota Inc. -> Nota Inc.) HKU\S-1-5-21-2322255856-1445579512-3484448224-1001\...\Run: [CCleaner Smart Cleaning] => C:\Program Files\CCleaner\CCleaner64.exe [22588760 2019-05-09] (Piriform Software Ltd -> Piriform Software Ltd) HKU\S-1-5-21-2322255856-1445579512-3484448224-1001\...\Run: [Pushbullet] => C:\Program Files (x86)\Pushbullet\pushbullet.exe [345600 2015-07-01] (Pushbullet inc) [File not signed] HKU\S-1-5-21-2322255856-1445579512-3484448224-1001\...\Run: [SoundSwitch] => C:\Program Files\SoundSwitch\SoundSwitch.exe [1820352 2019-04-19] (SoundSwitch -> SoundSwitch) HKU\S-1-5-21-2322255856-1445579512-3484448224-1001\...\Winlogon: [Shell] C:\Windows\explorer.exe [3933296 2019-03-14] (Microsoft Windows -> Microsoft Corporation) <==== ATTENTION HKU\S-1-5-21-2322255856-1445579512-3484448224-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Users\LeonM\Desktop\INVENT~1.SCR HKLM\...\Drivers32: [msacm.vorbis] => C:\Windows\system32\vorbis.acm [1470976 2015-03-11] (HMS hxxp://hp.vector.co.jp/authors/VA012897/) [File not signed] HKLM\...\Drivers32: [msacm.voxacm160] => C:\Windows\system32\vct3216.acm [82944 2003-05-21] (Voxware, Inc.) [File not signed] HKLM\...\Drivers32: [msacm.scg726] => C:\Windows\system32\scg726.acm [13239 2000-03-14] (SHARP Corporation) [File not signed] HKLM\...\Drivers32: [msacm.alf2cd] => C:\Windows\system32\alf2cd.acm [38912 2003-05-21] (NCT Company) [File not signed] HKLM\...\Drivers32: [msacm.ac3acm] => C:\Windows\system32\AC3ACM.acm [81920 2004-02-04] (fccHandler) [File not signed] HKLM\...\Drivers32: [msacm.lame] => C:\Windows\system32\lame.ax [245760 2005-08-01] () [File not signed] HKLM\...\Drivers32: [vidc.dvsd] => C:\Windows\system32\mcdvd_32.dll [261632 2003-05-21] (MainConcept) [File not signed] HKLM\...\Drivers32: [vidc.mpg4] => C:\Windows\system32\mpg4c32.dll [413760 2002-08-19] (Microsoft Corporation) [File not signed] HKLM\...\Drivers32: [vidc.mp42] => C:\Windows\system32\mpg4c32.dll [413760 2002-08-19] (Microsoft Corporation) [File not signed] HKLM\...\Drivers32: [vidc.mp43] => C:\Windows\system32\mpg4c32.dll [413760 2002-08-19] (Microsoft Corporation) [File not signed] HKLM\...\Drivers32: [vidc.xvid] => C:\Windows\system32\xvidvfw.dll [139264 2004-07-03] () [File not signed] HKLM\...\Drivers32: [vidc.DIVX] => C:\Windows\system32\DivX.dll [638976 2003-05-22] (DivXNetworks, Inc.) [File not signed] HKLM\...\Drivers32: [vidc.VP60] => C:\Windows\system32\vp6vfw.dll [438272 2004-12-10] (On2.com) [File not signed] HKLM\...\Drivers32: [vidc.VP61] => C:\Windows\system32\vp6vfw.dll [438272 2004-12-10] (On2.com) [File not signed] HKLM\...\Drivers32: [vidc.VP62] => C:\Windows\system32\vp6vfw.dll [438272 2004-12-10] (On2.com) [File not signed] HKLM\...\Drivers32: [vidc.LAGS] => C:\Windows\system32\lagarith.dll [216064 2011-12-07] ( ) [File not signed] HKLM\...\Drivers32: [msacm.vorbis] => C:\Windows\SysWOW64\vorbis.acm [1554944 2015-03-11] (HMS hxxp://hp.vector.co.jp/authors/VA012897/) [File not signed] HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\74.0.3729.169\Installer\chrmstp.exe [2019-05-23] (Google LLC -> Google Inc.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SteelSeries Engine 3.lnk [2019-05-02] ShortcutTarget: SteelSeries Engine 3.lnk -> C:\Program Files\SteelSeries\SteelSeries Engine 3\SteelSeriesEngine3.exe (SteelSeries ApS -> SteelSeries ApS) GroupPolicy: Restriction ? <==== ATTENTION FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION ==================== Scheduled Tasks (Whitelisted) ============= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) Task: {054BC319-EB25-42F8-9985-C5A740BFB47F} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1904.1-0\MpCmdRun.exe [480352 2019-04-23] (Microsoft Corporation -> Microsoft Corporation) Task: {1224EFA6-7D0A-4763-A2F8-29E8655F4BE3} - System32\Tasks\GyazoUpdateTaskMachine => C:\Program Files (x86)\Gyazo\GyazoUpdate.exe [6785448 2019-04-10] (Nota Inc. -> Nota Inc.) Task: {13501EBB-43F9-4821-9395-1F5423C4D8A4} - System32\Tasks\RogueKiller Anti-Malware => C:\Program Files\RogueKiller\RogueKiller64.exe [33971256 2019-05-22] (Adlice -> ) Task: {14575FF2-D294-4405-9227-0DF3F288EA29} - System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe [702504 2019-01-30] (NVIDIA Corporation -> NVIDIA Corporation) Task: {19BEFE2E-A665-44D5-87E9-B8D55021AA94} - System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe [572456 2019-01-30] (NVIDIA Corporation -> NVIDIA Corporation) Task: {204DD6E1-6DB2-4A04-BF58-816E80DD6AA5} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1904.1-0\MpCmdRun.exe [480352 2019-04-23] (Microsoft Corporation -> Microsoft Corporation) Task: {20B5B2C1-6108-48A8-AED7-A9F72FD3626E} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [840744 2019-01-30] (NVIDIA Corporation -> NVIDIA Corporation) Task: {244C0A1C-90E3-40A7-B906-5C1D7FA61774} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1904.1-0\MpCmdRun.exe [480352 2019-04-23] (Microsoft Corporation -> Microsoft Corporation) Task: {2CA728FA-BFBC-40EC-8805-6DFBE65A5A6E} - System32\Tasks\NvTmRepCR2_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [877096 2019-01-30] (NVIDIA Corporation -> NVIDIA Corporation) Task: {2E894152-B907-459F-A103-ADFC031CD8A5} - System32\Tasks\Avast Software\Overseer => C:\Program Files\Common Files\AVAST Software\Overseer\overseer.exe [2380088 2019-05-16] (AVAST Software s.r.o. -> AVAST Software) Task: {3D18883B-2EF3-44E4-82BC-06FC5630256D} - System32\Tasks\GyazoUpdateTaskMachineDaily => C:\Program Files (x86)\Gyazo\GyazoUpdate.exe [6785448 2019-04-10] (Nota Inc. -> Nota Inc.) Task: {40E78899-8A55-4CF2-9402-A5E83A5469EB} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1904.1-0\MpCmdRun.exe [480352 2019-04-23] (Microsoft Corporation -> Microsoft Corporation) Task: {4643E492-39A9-4B92-BC87-18F7979402C1} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64 => {429BC048-379E-45E0-80E4-EB1977941B5C} C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentasklauncher.dll [29360 2018-04-12] (Microsoft Corporation -> Microsoft Corporation) Task: {500A6521-888C-4589-BD8D-CD9AF4CB43D3} - System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [877096 2019-01-30] (NVIDIA Corporation -> NVIDIA Corporation) Task: {50DE6B25-98BC-40DF-9B5D-F77F075C007C} - System32\Tasks\Microsoft\VisualStudio\Updates\BackgroundDownload => C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\BackgroundDownload.exe [72328 2019-04-09] (Microsoft Corporation -> Microsoft Corporation) Task: {62573B62-C559-4528-9136-AA80E1ABCD40} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 => {84F0FAE1-C27B-4F6F-807B-28CF6F96287D} C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentasklauncher.dll [29360 2018-04-12] (Microsoft Corporation -> Microsoft Corporation) Task: {65087063-A2DD-4BF6-B11B-A30FF252E555} - System32\Tasks\NvTmRepCR3_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [877096 2019-01-30] (NVIDIA Corporation -> NVIDIA Corporation) Task: {750BD6CA-6B6A-4E27-AFB7-D0BDDAB2EEAC} - System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [790568 2019-01-30] (NVIDIA Corporation -> NVIDIA Corporation) Task: {7D361F01-8EE8-4F04-9D48-DE967596B2E2} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [619416 2019-05-09] (Piriform Software Ltd -> Piriform Software Ltd) Task: {8057BAF3-8C25-4BEA-9BF3-4748D69AEF95} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [152216 2017-10-04] (Google Inc -> Google Inc.) Task: {83795B87-BDC9-4F80-A96D-48ED113712D9} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 Critical => {DE434264-8FE9-4C0B-A83B-89EBEEBFF78E} C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentasklauncher.dll [29360 2018-04-12] (Microsoft Corporation -> Microsoft Corporation) Task: {85B67656-A53E-4DDD-8676-F3558AFCDE29} - System32\Tasks\NvBatteryBoostCheckOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [790568 2019-01-30] (NVIDIA Corporation -> NVIDIA Corporation) Task: {94B9393E-E407-4C7C-99D7-EA930A4093D5} - System32\Tasks\BlueStacksHelper => C:\ProgramData\BlueStacks\Client\Helper\BlueStacksHelper.exe [745480 2019-04-16] (BlueStack Systems, Inc. -> BlueStack Systems, Inc.) Task: {9C4F4ACB-5122-40E1-9D7E-99555BC2F2C1} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64 Critical => {613FBA38-A3DF-4AB8-9674-5604984A299A} C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentasklauncher.dll [29360 2018-04-12] (Microsoft Corporation -> Microsoft Corporation) Task: {9D846470-5439-47D9-9045-9ACBDB625265} - System32\Tasks\AMD Updater => C:\Program Files\AMD\CIM\\Bin64\RadeonInstaller.exe [29305736 2018-10-12] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.) Task: {9F99298A-635D-4656-97C9-730657B6383B} - System32\Tasks\Hybrid => C:\IORRT\IORRT.bat [855 2018-10-01] () [File not signed] Task: {A3337E02-50C7-4E63-87AC-E92087DEB6CF} - System32\Tasks\R@1n-KMS\Windows64Professional => wmic path SoftwareLicensingProduct where (ID="2de67392-b7a7-462a-b1ca-108dd189f588") call Activate Task: {A8B0ADBC-DD56-4EC2-A7B0-12E5D5FA1A59} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [16571320 2019-05-09] (Piriform Software Ltd -> Piriform Software Ltd) Task: {A910B6BE-4EC6-415B-ACE6-06C1DDE522D4} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1195544 2018-12-16] (Adobe Systems, Incorporated -> Adobe Systems Incorporated) Task: {BD1A2573-3AF5-42C1-AA1D-D45AEEB8FA4A} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION Task: {BEB8CC8D-233A-4C83-9A93-63E15F96AE44} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [152216 2017-10-04] (Google Inc -> Google Inc.) Task: {C4FE69E3-3735-4D89-B789-89CDBA85E9C8} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [840744 2019-01-30] (NVIDIA Corporation -> NVIDIA Corporation) Task: {D38B8AF3-7E2C-4C39-8D42-D4DE10697F3A} - System32\Tasks\MSIAfterburner => C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe Task: {E532516E-9E10-4D9D-BFAB-886E2DFAF37F} - System32\Tasks\IORRT => C:\IORRT\IORRT.bat [855 2018-10-01] () [File not signed] Task: {EDE2722B-B49B-4484-9927-BDB2B47F3A07} - System32\Tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA GeForce Experience.exe [3724328 2019-01-30] (NVIDIA Corporation -> NVIDIA Corporation) Task: {F5111CFB-48B6-4D4B-9F02-C075EA078A4F} - System32\Tasks\NvTmRepCR1_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [877096 2019-01-30] (NVIDIA Corporation -> NVIDIA Corporation) (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 Tcpip\..\Interfaces\{286395b6-8942-4ad9-b841-1db84e74d0e8}: [DhcpNameServer] 192.168.1.1 Internet Explorer: ================== SearchScopes: HKU\S-1-5-21-2322255856-1445579512-3484448224-1001 -> DefaultScope {2f23ab71-4ac6-41f2-a955-ea576e553146} URL = BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation -> Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_211\bin\ssv.dll [2019-05-26] (Oracle America, Inc. -> Oracle Corporation) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation -> Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_211\bin\jp2ssv.dll [2019-05-26] (Oracle America, Inc. -> Oracle Corporation) Handler: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll [2008-05-23] (Microsoft Corporation) [File not signed] FireFox: ======== FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation -> Microsoft Corporation) FF Plugin-x32: @java.com/DTPlugin,version=11.211.2 -> C:\Program Files (x86)\Java\jre1.8.0_211\bin\dtplugin\npDeployJava1.dll [2019-05-26] (Oracle America, Inc. -> Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.211.2 -> C:\Program Files (x86)\Java\jre1.8.0_211\bin\plugin2\npjp2.dll [2019-05-26] (Oracle America, Inc. -> Oracle Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\Program Files (x86)\Microsoft Office\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation -> Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation -> Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2019-03-01] (NVIDIA Corporation -> NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2019-03-01] (NVIDIA Corporation -> NVIDIA Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.34.11\npGoogleUpdate3.dll [2019-05-15] (Google Inc -> Google LLC) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.34.11\npGoogleUpdate3.dll [2019-05-15] (Google Inc -> Google LLC) FF Plugin-x32: @videolan.org/vlc,version=3.0.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2019-01-10] (VideoLAN -> VideoLAN) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2019-05-03] (Adobe Inc. -> Adobe Systems Inc.) Chrome: ======= CHR Profile: C:\Users\LeonM\AppData\Local\Google\Chrome\User Data\Default [2019-06-03] CHR Extension: (Slides) - C:\Users\LeonM\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-13] CHR Extension: (Docs) - C:\Users\LeonM\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-13] CHR Extension: (Google Drive) - C:\Users\LeonM\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-10-04] CHR Extension: (YouTube) - C:\Users\LeonM\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-10-04] CHR Extension: (Improve YouTube! (Open-Source for YouTube)) - C:\Users\LeonM\AppData\Local\Google\Chrome\User Data\Default\Extensions\bnomihfieiccainjcjblhegjgglakjdd [2019-05-26] CHR Extension: (X-notifier (for Gmail™,Hotmail,Yahoo,AOL...)) - C:\Users\LeonM\AppData\Local\Google\Chrome\User Data\Default\Extensions\cdfjbkbddpfnoplfhceolpopfoepleco [2019-02-26] CHR Extension: (uBlock Origin) - C:\Users\LeonM\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjpalhdlnbpafiamejdnhcphjbkeiagm [2019-05-24] CHR Extension: (Sheets) - C:\Users\LeonM\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-13] CHR Extension: (Stylish - Custom themes for any website) - C:\Users\LeonM\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjnbnpbmkenffdnngjfgmeleoegfcffe [2019-01-06] CHR Extension: (WebSID - Commodore 64 synthesizer) - C:\Users\LeonM\AppData\Local\Google\Chrome\User Data\Default\Extensions\gegajffeckfifipchbbnibbgncjpcjio [2018-05-16] CHR Extension: (Google Docs Offline) - C:\Users\LeonM\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-08-21] CHR Extension: (Social Fixer for Facebook) - C:\Users\LeonM\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifmhoabcaeehkljcfclfiieohkohdgbb [2019-06-01] CHR Extension: (Reddit Enhancement Suite) - C:\Users\LeonM\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbmfpngjjgdllneeigpgjifpgocmfgmb [2019-06-03] CHR Extension: (Simple Material Theme) - C:\Users\LeonM\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdnphgdednjnpcoeamekbogoblkdajep [2018-07-07] CHR Extension: (Chrome Web Store Payments) - C:\Users\LeonM\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-04-03] CHR Extension: (Gmail) - C:\Users\LeonM\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2019-04-24] CHR Extension: (Chrome Media Router) - C:\Users\LeonM\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2019-05-23] ==================== Services (Whitelisted) ==================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) HKLM\SYSTEM\CurrentControlSet\Services\aswSP <==== ATTENTION (Rootkit!) HKLM\SYSTEM\CurrentControlSet\Services\aswMonFlt <==== ATTENTION (Rootkit!) HKLM\SYSTEM\CurrentControlSet\Services\aswSnx <==== ATTENTION (Rootkit!) S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [6076936 2018-04-07] (BattlEye Innovations e.K. -> ) S3 BRSptStub; C:\ProgramData\BitRaider\BRSptStub.exe [363208 2018-01-05] (BitRaider LLC -> BitRaider, LLC) R2 CorsairService; C:\Program Files (x86)\Corsair\CORSAIR iCUE Software\Corsair.Service.exe [47664 2018-11-23] (Corsair Components, Inc. -> Corsair Memory, Inc.) S3 EasyAntiCheat; C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe [779392 2019-01-24] (EasyAntiCheat Oy -> EasyAntiCheat Ltd) S2 EsgShKernel; C:\Program Files\EnigmaSoft\SpyHunter\ShKernel.exe [11457840 2019-06-03] (EnigmaSoft Limited -> EnigmaSoft Limited) R2 LogiRegistryService; C:\Program Files\Logitech Gaming Software\Drivers\APOService\LogiRegistryService.exe [225400 2017-08-18] (Logitech Inc -> Logitech Inc.) S2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6562472 2019-02-01] (Malwarebytes Corporation -> Malwarebytes) R2 NvContainerLocalSystem; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [790568 2019-01-30] (NVIDIA Corporation -> NVIDIA Corporation) S3 NvContainerNetworkService; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [790568 2019-01-30] (NVIDIA Corporation -> NVIDIA Corporation) S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2298688 2019-02-01] (Electronic Arts, Inc. -> Electronic Arts) S2 Origin Web Helper Service; C:\Program Files (x86)\Origin\OriginWebHelperService.exe [3171144 2019-02-01] (Electronic Arts, Inc. -> Electronic Arts) R2 PnkBstrA; C:\WINDOWS\SysWOW64\PnkBstrA.exe [76888 2018-09-15] (Even Balance, Inc. -> ) S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [5074120 2019-03-14] (Microsoft Windows Publisher -> Microsoft Corporation) R2 ShMonitor; C:\Program Files\EnigmaSoft\SpyHunter\ShMonitor.exe [512816 2019-06-03] (EnigmaSoft Limited -> EnigmaSoft Limited) R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [752224 2017-01-16] (Samsung Electronics CO., LTD. -> DEVGURU Co., LTD.) S3 VSStandardCollectorService150; C:\Program Files (x86)\Microsoft Visual Studio\Shared\Common\DiagnosticsHub.Collection.Service\StandardCollector.Service.exe [152480 2019-02-21] (Microsoft Corporation -> Microsoft Corporation) R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1904.1-0\NisSrv.exe [3851264 2019-04-23] (Microsoft Corporation -> Microsoft Corporation) R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1904.1-0\MsMpEng.exe [118144 2019-04-23] (Microsoft Corporation -> Microsoft Corporation) R2 WsAppService; C:\Program Files (x86)\Wondershare\WAF\2.4.3.237\WsAppService.exe [495720 2018-07-04] (Wondershare Technology Co.,Ltd -> Wondershare) R2 NVDisplay.ContainerLocalSystem; "C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe" -s NVDisplay.ContainerLocalSystem -f "C:\ProgramData\NVIDIA\NVDisplay.ContainerLocalSystem.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem" -r -p 30000 R2 NvTelemetryContainer; "C:\Program Files\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe" -s NvTelemetryContainer -f "C:\ProgramData\NVIDIA\NvTelemetryContainer.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\NvTelemetry\plugins" -r ===================== Drivers (Whitelisted) ====================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R3 amdgpio2; C:\WINDOWS\System32\drivers\amdgpio2.sys [34568 2018-10-03] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc) R3 amdgpio3; C:\WINDOWS\System32\drivers\amdgpio3.sys [24288 2018-10-02] (AMD PMP-PE CB Code Signer v20160415 -> Advanced Micro Devices, Inc) S3 amdkmcsp; C:\WINDOWS\system32\DRIVERS\amdkmcsp.sys [95080 2017-06-12] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc. ) R3 AMDPCIDev; C:\WINDOWS\System32\drivers\AMDPCIDev.sys [31704 2018-10-03] (Advanced Micro Devices Inc. -> Advanced Micro Devices) R0 amdpsp; C:\WINDOWS\System32\drivers\amdpsp.sys [137688 2018-10-02] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc. ) R2 atksgt; C:\WINDOWS\System32\DRIVERS\atksgt.sys [312480 2018-07-19] (Tages SA -> ) S3 BlueStacksDrv; C:\Program Files\BlueStacks\BstkDrv.sys [303712 2019-02-04] (Bluestack Systems, Inc. -> Bluestack System Inc. ) R3 CorsairVBusDriver; C:\WINDOWS\System32\drivers\CorsairVBusDriver.sys [46944 2018-08-16] (Microsoft Windows Hardware Compatibility Publisher -> Corsair) R3 CorsairVHidDriver; C:\WINDOWS\System32\drivers\CorsairVHidDriver.sys [23392 2018-08-16] (Microsoft Windows Hardware Compatibility Publisher -> Corsair) R3 cpuz148; C:\WINDOWS\temp\cpuz148\cpuz148_x64.sys [44832 2019-06-03] (CPUID S.A.R.L.U. -> CPUID) S3 DFX11_1; C:\WINDOWS\system32\drivers\dfx11_1x64.sys [28008 2017-06-19] (Power Technology -> Windows (R) Win 7 DDK provider) S3 DFX12; C:\WINDOWS\system32\drivers\dfx12x64.sys [39048 2017-06-19] (Power Technology -> Windows (R) Win 7 DDK provider) S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131712 2017-01-16] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.) R3 FocusriteUSBSwRoot; C:\WINDOWS\System32\drivers\FocusriteUSBSwRoot.sys [97936 2018-01-09] (Focusrite Audio Engineering Ltd. -> Focusrite Audio Engineering Ltd.) R2 LGCoreTemp; C:\Program Files\Logitech Gaming Software\Drivers\LgCoreTemp\lgcoretemp.sys [14184 2015-06-21] (Logitech -> Logitech) R3 LGJoyXlCore; C:\WINDOWS\system32\drivers\LGJoyXlCore.sys [67736 2017-08-18] (Logitech Inc -> Logitech Inc.) R2 lirsgt; C:\WINDOWS\System32\DRIVERS\lirsgt.sys [43168 2018-07-19] (Tages SA -> ) R3 LSaiMini; C:\WINDOWS\System32\drivers\LSaiMini.sys [20720 2017-05-17] (WDKTestCert SYSTEM,131245371151827277 -> Logitech) R3 LSaiNtBus; C:\WINDOWS\system32\drivers\LSaiBus.sys [60336 2017-05-17] (WDKTestCert SYSTEM,131245371151827277 -> Logitech) S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [20936 2019-02-01] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes) R3 nvlddmkm; C:\WINDOWS\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_9c0cfd0baad9a756\nvlddmkm.sys [20736440 2019-03-11] (NVIDIA Corporation -> NVIDIA Corporation) S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [30336 2019-01-16] (NVIDIA Corporation -> NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\WINDOWS\system32\drivers\nvvad64v.sys [70024 2018-10-01] (NVIDIA Corporation -> NVIDIA Corporation) R3 nvvhci; C:\WINDOWS\System32\drivers\nvvhci.sys [66792 2018-10-03] (NVIDIA Corporation -> NVIDIA Corporation) R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [943112 2016-08-22] (Realtek Semiconductor Corp. -> Realtek ) S3 SaiK0255; C:\WINDOWS\system32\DRIVERS\SaiK0255.sys [217408 2017-05-17] (WDKTestCert SYSTEM,131245371151827277 -> Logitech) S3 SaiU0255; C:\WINDOWS\system32\DRIVERS\SaiU0255.sys [24816 2017-05-17] (WDKTestCert SYSTEM,131245371151827277 -> Logitech) R3 ScpVBus; C:\WINDOWS\System32\drivers\ScpVBus.sys [39168 2013-05-19] (Bruce James -> Scarlet.Crush Productions) R3 ssdevfactory; C:\WINDOWS\System32\drivers\ssdevfactory.sys [46776 2018-12-21] (SteelSeries ApS -> ) R3 sshid; C:\WINDOWS\System32\drivers\sshid.sys [48032 2018-12-21] (SteelSeries ApS -> SteelSeries ApS) S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [165504 2017-01-16] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.) U3 TrueSight; C:\Windows\System32\drivers\truesight.sys [28272 2019-06-03] (Adlice -> ) S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [46472 2019-04-23] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation) R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [344544 2019-04-23] (Microsoft Windows -> Microsoft Corporation) S3 wdm_usb; C:\WINDOWS\system32\DRIVERS\usb2ser.sys [151184 2016-07-15] (NGO -> MBB) R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [60896 2019-04-23] (Microsoft Windows -> Microsoft Corporation) S3 BRDriver64_1_3_3_E02B25FC; \??\C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver64.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One month (created) ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2019-06-03 19:10 - 2019-06-03 19:12 - 000034953 _____ C:\Users\LeonM\Desktop\FRST.txt 2019-06-03 19:10 - 2019-06-03 19:10 - 000000000 ____D C:\FRST 2019-06-03 19:09 - 2019-06-03 19:09 - 002433536 _____ (Farbar) C:\Users\LeonM\Desktop\FRST64.exe 2019-06-03 19:07 - 2019-06-03 19:07 - 000006972 _____ C:\Users\LeonM\Downloads\ReportRogue.txt 2019-06-03 17:43 - 2019-06-03 17:43 - 000028272 _____ C:\WINDOWS\system32\Drivers\truesight.sys 2019-06-03 17:42 - 2019-06-03 17:43 - 000000000 ____D C:\ProgramData\RogueKiller 2019-06-03 17:42 - 2019-06-03 17:42 - 000003136 _____ C:\WINDOWS\System32\Tasks\RogueKiller Anti-Malware 2019-06-03 17:41 - 2019-06-03 17:41 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller 2019-06-03 17:41 - 2019-06-03 17:41 - 000000000 ____D C:\Program Files\RogueKiller 2019-06-03 05:00 - 2019-06-03 05:00 - 000000000 ____D C:\Users\LeonM\AppData\Roaming\AVAST Software 2019-06-03 05:00 - 2019-06-03 05:00 - 000000000 ____D C:\Users\LeonM\AppData\Local\AVAST Software 2019-06-03 04:56 - 2019-06-03 17:30 - 000225608 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswa24c484be74624a3.tmp 2019-06-03 04:56 - 2019-06-03 04:57 - 000385880 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw615a1e3b769e4c6d.tmp 2019-06-03 04:56 - 2019-06-03 04:55 - 000477584 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw750e03971f4d6b0e.tmp 2019-06-03 04:56 - 2019-06-03 04:55 - 000363400 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe 2019-06-03 04:56 - 2019-06-03 04:55 - 000279120 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw514e7df4fb735b37.tmp 2019-06-03 04:56 - 2019-06-03 04:55 - 000225096 ____N (AVAST Software) C:\WINDOWS\system32\Drivers\aswStm.sys.155957944446801 2019-06-03 04:56 - 2019-06-03 04:55 - 000207448 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw0fa8b3b627e0170f.tmp 2019-06-03 04:56 - 2019-06-03 04:55 - 000167872 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw6de0449fa399f629.tmp 2019-06-03 04:56 - 2019-06-03 04:55 - 000112312 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswcde1b4f82566246e.tmp 2019-06-03 04:56 - 2019-06-03 04:55 - 000087944 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswfbd3bbf2f63699ff.tmp 2019-06-03 04:56 - 2019-06-03 04:55 - 000042288 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswa21a186922b6a1b7.tmp 2019-06-03 04:56 - 2019-06-03 04:55 - 000037104 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswa0138ccbca99031b.tmp 2019-06-03 04:56 - 2019-06-03 04:55 - 000015488 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswcce30048ef2773ea.tmp 2019-06-03 04:56 - 2019-06-03 04:54 - 001030784 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw77bf1d103c1b2b69.tmp 2019-06-03 04:56 - 2019-06-03 04:54 - 000262496 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw7833afce8b257f78.tmp 2019-06-03 04:56 - 2019-06-03 04:54 - 000205848 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswf181e56e2814467c.tmp 2019-06-03 04:56 - 2019-06-03 04:54 - 000061472 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw84b656017aed7106.tmp 2019-06-03 04:55 - 2019-06-03 04:55 - 000000016 _____ C:\spyhunter.fix 2019-06-03 04:54 - 2019-06-03 04:54 - 000000000 ____D C:\Program Files\AVAST Software 2019-06-03 04:48 - 2019-06-03 04:48 - 000000000 ___HD C:\uBUwMiKz7RzCKrMm 2019-06-03 04:27 - 2019-06-03 04:27 - 000000218 _____ C:\Users\LeonM\AppData\Local\recently-used.xbel 2019-06-03 03:58 - 2019-06-03 04:02 - 000001979 _____ C:\Users\LeonM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LuteBot.lnk 2019-06-03 03:57 - 2019-06-03 03:58 - 000000000 ____D C:\Users\LeonM\Documents\Lutebot 2.0 Final 2019-06-03 02:43 - 2019-06-03 02:43 - 000000000 ____D C:\sh5ldr 2019-06-03 02:43 - 2019-06-03 02:43 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EnigmaSoft 2019-06-03 02:43 - 2019-06-03 02:43 - 000000000 ____D C:\ProgramData\EnigmaSoft Limited 2019-06-03 02:43 - 2019-06-03 02:43 - 000000000 ____D C:\Program Files\EnigmaSoft 2019-06-03 02:24 - 2019-06-03 02:24 - 000003806 _____ C:\Users\LeonM\Documents\cc_20190603_022404.reg 2019-06-03 01:09 - 2019-06-03 01:09 - 000000000 ____D C:\WINDOWS\pss 2019-06-03 00:22 - 2019-06-03 00:22 - 000254226 _____ C:\Users\LeonM\Documents\cc_20190603_002233.reg 2019-06-02 23:25 - 2019-06-02 23:25 - 001799680 _____ (NTWind Software) C:\Users\Public\lcqk.exe 2019-06-02 23:25 - 2019-06-02 23:25 - 000000000 __SHD C:\ProgramData\{07942618-BD98-47FA-BB01-A7DDC1FEC6B0} 2019-06-01 13:46 - 2019-06-01 13:46 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BOSS 2019-06-01 13:46 - 2019-06-01 13:46 - 000000000 ____D C:\BOSS 2019-05-31 22:52 - 2019-05-31 22:52 - 000070416 _____ C:\Users\LeonM\Documents\foo_dsp_soundtouch.zip 2019-05-31 22:04 - 2019-05-31 22:05 - 000000000 ____D C:\Users\LeonM\Downloads\D2 audio 2019-05-31 01:26 - 2019-05-31 22:08 - 000000000 ____D C:\Users\LeonM\Documents\Notification Sounds 2019-05-30 00:14 - 2019-05-30 00:14 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Destiny 2 2019-05-29 22:32 - 2019-05-30 00:14 - 000000000 ____D C:\Program Files (x86)\Destiny 2 2019-05-29 22:30 - 2019-05-29 22:30 - 000000000 ____D C:\Users\LeonM\AppData\Local\.IdentityService 2019-05-29 20:51 - 2019-05-29 20:51 - 000000000 ____D C:\Users\LeonM\Documents\ffmpeg-win-2.2.2 2019-05-29 14:54 - 2019-05-29 15:18 - 000002092 _____ C:\Users\Public\Desktop\The Witcher.lnk 2019-05-29 14:54 - 2019-05-29 14:54 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\The Witcher Rise of the White Wolf 2019-05-29 14:49 - 2019-05-29 14:49 - 000000000 ____D C:\Users\LeonM\AppData\Roaming\CD Projekt RED 2019-05-29 14:48 - 2019-05-29 15:05 - 000000000 ____D C:\Users\LeonM\Documents\Witcher 1 Mods 2019-05-23 20:10 - 2019-05-23 20:20 - 000000000 ____D C:\Users\LeonM\AppData\Local\AdiIRC 2019-05-23 20:10 - 2019-05-23 20:10 - 000000000 ____D C:\Users\LeonM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AdiIRC 2019-05-23 20:10 - 2019-05-23 20:10 - 000000000 ____D C:\Program Files\AdiIRC 2019-05-23 12:40 - 2019-05-17 13:10 - 001364992 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvruserservice.dll 2019-05-23 12:40 - 2019-05-17 10:16 - 001008640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.MixedRealityCapture.dll 2019-05-23 12:40 - 2019-05-17 09:12 - 000868864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.MixedRealityCapture.dll 2019-05-23 12:40 - 2019-05-17 07:49 - 001035040 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplyTrustOffline.exe 2019-05-23 12:40 - 2019-05-17 07:43 - 000076088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hvservice.sys 2019-05-23 12:40 - 2019-05-17 07:42 - 005625160 _____ (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll 2019-05-23 12:40 - 2019-05-17 07:42 - 001027384 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe 2019-05-23 12:40 - 2019-05-17 07:41 - 001220112 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe 2019-05-23 12:40 - 2019-05-17 07:41 - 000568320 _____ (Microsoft Corporation) C:\WINDOWS\system32\tcblaunch.exe 2019-05-23 12:40 - 2019-05-17 07:41 - 000135184 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll 2019-05-23 12:40 - 2019-05-17 07:39 - 009084216 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe 2019-05-23 12:40 - 2019-05-17 07:39 - 007519896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll 2019-05-23 12:40 - 2019-05-17 07:39 - 002768952 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2019-05-23 12:40 - 2019-05-17 07:39 - 001459120 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi 2019-05-23 12:40 - 2019-05-17 07:39 - 001260272 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe 2019-05-23 12:40 - 2019-05-17 07:39 - 001140992 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi 2019-05-23 12:40 - 2019-05-17 07:39 - 001098064 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvproc.dll 2019-05-23 12:40 - 2019-05-17 07:39 - 000983424 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe 2019-05-23 12:40 - 2019-05-17 07:22 - 006568016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll 2019-05-23 12:40 - 2019-05-17 07:22 - 002256560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2019-05-23 12:40 - 2019-05-17 07:21 - 001130784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvproc.dll 2019-05-23 12:40 - 2019-05-17 07:07 - 003400192 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll 2019-05-23 12:40 - 2019-05-17 07:06 - 001307648 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVPXENC.dll 2019-05-23 12:40 - 2019-05-17 07:06 - 000209408 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXApplicabilityBlob.dll 2019-05-23 12:40 - 2019-05-17 07:04 - 002175488 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll 2019-05-23 12:40 - 2019-05-17 07:04 - 001826816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.CloudStore.dll 2019-05-23 12:40 - 2019-05-17 07:04 - 001708544 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSPhotography.dll 2019-05-23 12:40 - 2019-05-17 07:03 - 005307392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll 2019-05-23 12:40 - 2019-05-17 07:03 - 004937728 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll 2019-05-23 12:40 - 2019-05-17 07:03 - 001560576 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll 2019-05-23 12:40 - 2019-05-17 07:03 - 001361408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSPhotography.dll 2019-05-23 12:40 - 2019-05-17 07:01 - 000507392 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgeIso.dll 2019-05-23 12:40 - 2019-05-17 07:00 - 001295360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVPXENC.dll 2019-05-23 12:40 - 2019-05-17 07:00 - 000333824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgeIso.dll 2019-05-23 12:40 - 2019-05-17 06:59 - 004516352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll 2019-05-23 12:40 - 2019-05-17 06:57 - 000251904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll 2019-05-23 12:40 - 2019-05-17 05:44 - 000001310 _____ C:\WINDOWS\system32\tcbres.wim 2019-05-16 11:16 - 2019-05-16 11:16 - 000000077 _____ C:\WINDOWS\system32\Drivers\aswSP.sys.sum 2019-05-16 11:16 - 2019-05-16 11:16 - 000000000 ____D C:\WINDOWS\System32\Tasks\Avast Software 2019-05-16 11:15 - 2019-05-16 11:15 - 000000000 ____D C:\Program Files\Common Files\AVAST Software 2019-05-16 11:14 - 2019-06-03 04:53 - 000000000 ____D C:\ProgramData\AVAST Software 2019-05-15 12:55 - 2019-05-03 13:13 - 001376472 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll 2019-05-15 12:55 - 2019-05-03 12:51 - 003613696 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys 2019-05-15 12:55 - 2019-05-03 12:50 - 001663488 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll 2019-05-15 12:55 - 2019-05-03 12:28 - 002882048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys 2019-05-15 12:55 - 2019-05-03 12:25 - 001471488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll 2019-05-15 12:55 - 2019-05-03 07:31 - 007436536 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll 2019-05-15 12:55 - 2019-05-03 07:31 - 002811192 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys 2019-05-15 12:55 - 2019-05-03 07:19 - 006043712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll 2019-05-15 12:55 - 2019-05-03 07:12 - 025855488 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll 2019-05-15 12:55 - 2019-05-03 07:10 - 022017024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll 2019-05-15 12:55 - 2019-05-03 07:05 - 022716416 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2019-05-15 12:55 - 2019-05-03 07:02 - 019401216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2019-05-15 12:55 - 2019-05-03 07:02 - 004866048 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2019-05-15 12:55 - 2019-05-03 07:01 - 008189440 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll 2019-05-15 12:55 - 2019-05-03 07:00 - 006661632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll 2019-05-15 12:55 - 2019-05-03 06:59 - 007593472 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll 2019-05-15 12:55 - 2019-05-03 06:59 - 005788672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll 2019-05-15 12:55 - 2019-05-03 06:59 - 003710976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2019-05-15 12:55 - 2019-05-03 06:58 - 000894464 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll 2019-05-15 12:55 - 2019-05-03 06:57 - 001549824 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll 2019-05-15 12:55 - 2019-05-03 06:57 - 000808448 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeManager.dll 2019-05-15 12:55 - 2019-05-03 06:56 - 001803776 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll 2019-05-15 12:55 - 2019-05-03 06:55 - 003090432 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll 2019-05-15 12:55 - 2019-05-03 06:55 - 002166784 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys 2019-05-15 12:55 - 2019-05-03 06:54 - 001628672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll 2019-05-15 12:55 - 2019-05-03 06:54 - 000961024 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorSvc.dll 2019-05-15 12:55 - 2019-05-03 06:54 - 000669184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll 2019-05-15 12:55 - 2019-05-03 06:54 - 000535552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll 2019-05-15 12:55 - 2019-04-19 11:54 - 000720200 _____ (Microsoft Corporation) C:\WINDOWS\system32\kernel32.dll 2019-05-15 12:55 - 2019-04-19 11:39 - 012754944 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2019-05-15 12:55 - 2019-04-19 10:44 - 001454648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll 2019-05-15 12:55 - 2019-04-19 10:28 - 011940864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2019-05-15 12:55 - 2019-04-19 06:07 - 000985400 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe 2019-05-15 12:55 - 2019-04-19 06:06 - 002571632 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll 2019-05-15 12:55 - 2019-04-19 06:06 - 000798520 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupEngine.dll 2019-05-15 12:55 - 2019-04-19 06:01 - 001982008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll 2019-05-15 12:55 - 2019-04-19 05:43 - 000150016 _____ (Microsoft Corporation) C:\WINDOWS\system32\fcon.dll 2019-05-15 12:55 - 2019-04-19 05:42 - 004384256 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeContent.dll 2019-05-15 12:55 - 2019-04-19 05:39 - 000567296 _____ (Microsoft Corporation) C:\WINDOWS\system32\daxexec.dll 2019-05-15 12:55 - 2019-04-19 05:38 - 002368512 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebRuntimeManager.dll 2019-05-15 12:55 - 2019-04-19 05:36 - 002909696 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll 2019-05-15 12:55 - 2019-04-19 05:36 - 000827392 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Management.dll 2019-05-15 12:55 - 2019-04-19 05:35 - 001458688 _____ (Microsoft Corporation) C:\WINDOWS\system32\dosvc.dll 2019-05-15 12:55 - 2019-04-19 05:35 - 001175552 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll 2019-05-15 12:55 - 2019-04-19 05:35 - 001156608 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll 2019-05-15 12:55 - 2019-04-19 05:35 - 000607232 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll 2019-05-15 12:55 - 2019-04-09 02:48 - 000353280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrd3x40.dll 2019-05-15 12:54 - 2019-05-03 13:14 - 000790208 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe 2019-05-15 12:54 - 2019-05-03 13:14 - 000304144 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mssecflt.sys 2019-05-15 12:54 - 2019-05-03 13:13 - 000396088 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll 2019-05-15 12:54 - 2019-05-03 12:55 - 000123392 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontsub.dll 2019-05-15 12:54 - 2019-05-03 12:54 - 000177664 _____ (Microsoft Corporation) C:\WINDOWS\system32\t2embed.dll 2019-05-15 12:54 - 2019-05-03 12:52 - 000119808 _____ (Microsoft Corporation) C:\WINDOWS\system32\wercplsupport.dll 2019-05-15 12:54 - 2019-05-03 12:50 - 004054528 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll 2019-05-15 12:54 - 2019-05-03 12:49 - 001288704 _____ (Microsoft Corporation) C:\WINDOWS\system32\werconcpl.dll 2019-05-15 12:54 - 2019-05-03 12:49 - 000488448 _____ (Microsoft Corporation) C:\WINDOWS\system32\werui.dll 2019-05-15 12:54 - 2019-05-03 12:49 - 000210944 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWWIN.EXE 2019-05-15 12:54 - 2019-05-03 12:43 - 001027008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll 2019-05-15 12:54 - 2019-05-03 12:43 - 000662328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe 2019-05-15 12:54 - 2019-05-03 12:30 - 000138752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\t2embed.dll 2019-05-15 12:54 - 2019-05-03 12:30 - 000098304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontsub.dll 2019-05-15 12:54 - 2019-05-03 12:28 - 000089600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll 2019-05-15 12:54 - 2019-05-03 12:27 - 000176640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWWIN.EXE 2019-05-15 12:54 - 2019-05-03 12:26 - 000425472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werui.dll 2019-05-15 12:54 - 2019-05-03 12:25 - 004055040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll 2019-05-15 12:54 - 2019-05-03 07:43 - 000177128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\intelpep.sys 2019-05-15 12:54 - 2019-05-03 07:34 - 000159864 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe 2019-05-15 12:54 - 2019-05-03 07:33 - 000709720 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys 2019-05-15 12:54 - 2019-05-03 07:33 - 000063072 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptdll.dll 2019-05-15 12:54 - 2019-05-03 07:32 - 000793640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys 2019-05-15 12:54 - 2019-05-03 07:32 - 000776784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll 2019-05-15 12:54 - 2019-05-03 07:32 - 000493880 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe 2019-05-15 12:54 - 2019-05-03 07:32 - 000438984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll 2019-05-15 12:54 - 2019-05-03 07:32 - 000209208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe 2019-05-15 12:54 - 2019-05-03 07:32 - 000170296 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys 2019-05-15 12:54 - 2019-05-03 07:32 - 000164664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wfplwfs.sys 2019-05-15 12:54 - 2019-05-03 07:31 - 000545808 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll 2019-05-15 12:54 - 2019-05-03 07:31 - 000412984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys 2019-05-15 12:54 - 2019-05-03 07:31 - 000115728 _____ (Microsoft Corporation) C:\WINDOWS\system32\kdnet.dll 2019-05-15 12:54 - 2019-05-03 07:20 - 000434704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe 2019-05-15 12:54 - 2019-05-03 07:20 - 000384976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll 2019-05-15 12:54 - 2019-05-03 07:20 - 000192016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe 2019-05-15 12:54 - 2019-05-03 07:20 - 000146920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe 2019-05-15 12:54 - 2019-05-03 07:19 - 000665224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll 2019-05-15 12:54 - 2019-05-03 07:19 - 000056288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptdll.dll 2019-05-15 12:54 - 2019-05-03 07:00 - 000120832 _____ (Microsoft Corporation) C:\WINDOWS\system32\microsoft-windows-kernel-processor-power-events.dll 2019-05-15 12:54 - 2019-05-03 07:00 - 000099328 _____ (Microsoft Corporation) C:\WINDOWS\system32\utcutil.dll 2019-05-15 12:54 - 2019-05-03 06:59 - 000514560 _____ (Microsoft Corporation) C:\WINDOWS\system32\nltest.exe 2019-05-15 12:54 - 2019-05-03 06:59 - 000204288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wersvc.dll 2019-05-15 12:54 - 2019-05-03 06:59 - 000154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll 2019-05-15 12:54 - 2019-05-03 06:58 - 000726528 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll 2019-05-15 12:54 - 2019-05-03 06:58 - 000462336 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcdedit.exe 2019-05-15 12:54 - 2019-05-03 06:58 - 000074240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dtdump.exe 2019-05-15 12:54 - 2019-05-03 06:57 - 000608768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EdgeManager.dll 2019-05-15 12:54 - 2019-05-03 06:57 - 000561152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll 2019-05-15 12:54 - 2019-05-03 06:56 - 000773632 _____ (Microsoft Corporation) C:\WINDOWS\system32\netlogon.dll 2019-05-15 12:54 - 2019-05-03 06:56 - 000578560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll 2019-05-15 12:54 - 2019-05-03 06:55 - 000659968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netlogon.dll 2019-05-15 12:54 - 2019-05-03 06:54 - 000845824 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll 2019-05-15 12:54 - 2019-05-03 06:54 - 000778752 _____ (Microsoft Corporation) C:\WINDOWS\system32\BFE.DLL 2019-05-15 12:54 - 2019-05-03 06:54 - 000776192 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll 2019-05-15 12:54 - 2019-05-03 06:54 - 000667136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fveapi.dll 2019-05-15 12:54 - 2019-05-03 06:54 - 000543744 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll 2019-05-15 12:54 - 2019-05-03 06:53 - 000204800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\intelppm.sys 2019-05-15 12:54 - 2019-05-03 06:53 - 000186880 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\amdk8.sys 2019-05-15 12:54 - 2019-05-03 06:53 - 000184320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\amdppm.sys 2019-05-15 12:54 - 2019-05-03 06:53 - 000181760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\processr.sys 2019-05-15 12:54 - 2019-04-19 11:55 - 001634920 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll 2019-05-15 12:54 - 2019-04-19 11:40 - 000064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\iemigplugin.dll 2019-05-15 12:54 - 2019-04-19 11:38 - 000058368 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDSPnf.exe 2019-05-15 12:54 - 2019-04-19 11:38 - 000040960 _____ (Microsoft Corporation) C:\WINDOWS\system32\perfproc.dll 2019-05-15 12:54 - 2019-04-19 11:36 - 000346112 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcGenral.dll 2019-05-15 12:54 - 2019-04-19 11:34 - 000522240 _____ (Microsoft Corporation) C:\WINDOWS\system32\winspool.drv 2019-05-15 12:54 - 2019-04-19 10:37 - 000607960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kernel32.dll 2019-05-15 12:54 - 2019-04-19 10:30 - 000036864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\perfproc.dll 2019-05-15 12:54 - 2019-04-19 10:26 - 002405888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcGenral.dll 2019-05-15 12:54 - 2019-04-19 10:25 - 000423936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winspool.drv 2019-05-15 12:54 - 2019-04-19 06:06 - 000713264 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVideoDSP.dll 2019-05-15 12:54 - 2019-04-19 06:06 - 000436024 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll 2019-05-15 12:54 - 2019-04-19 06:06 - 000274232 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll 2019-05-15 12:54 - 2019-04-19 06:02 - 000831800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe 2019-05-15 12:54 - 2019-04-19 06:01 - 000581592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVideoDSP.dll 2019-05-15 12:54 - 2019-04-19 06:01 - 000576016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupEngine.dll 2019-05-15 12:54 - 2019-04-19 06:01 - 000380728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll 2019-05-15 12:54 - 2019-04-19 05:41 - 000140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmmigrator.dll 2019-05-15 12:54 - 2019-04-19 05:41 - 000095232 _____ (Microsoft Corporation) C:\WINDOWS\system32\EduPrintProv.exe 2019-05-15 12:54 - 2019-04-19 05:40 - 000342528 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserexport.exe 2019-05-15 12:54 - 2019-04-19 05:40 - 000243712 _____ (Microsoft Corporation) C:\WINDOWS\system32\JpnServiceDS.dll 2019-05-15 12:54 - 2019-04-19 05:40 - 000172544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\enrollmentapi.dll 2019-05-15 12:54 - 2019-04-19 05:40 - 000167936 _____ (Microsoft Corporation) C:\WINDOWS\system32\FilterDS.dll 2019-05-15 12:54 - 2019-04-19 05:40 - 000081408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetDriverInstall.dll 2019-05-15 12:54 - 2019-04-19 05:39 - 000425472 _____ (Microsoft Corporation) C:\WINDOWS\system32\SDDS.dll 2019-05-15 12:54 - 2019-04-19 05:39 - 000374784 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingASDS.dll 2019-05-15 12:54 - 2019-04-19 05:39 - 000361472 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceEnroller.exe 2019-05-15 12:54 - 2019-04-19 05:39 - 000204288 _____ (Microsoft Corporation) C:\WINDOWS\system32\enrollmentapi.dll 2019-05-15 12:54 - 2019-04-19 05:38 - 000593408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.Management.dll 2019-05-15 12:54 - 2019-04-19 05:38 - 000391680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\daxexec.dll 2019-05-15 12:54 - 2019-04-19 05:38 - 000304128 _____ (Microsoft Corporation) C:\WINDOWS\system32\domgmt.dll 2019-05-15 12:54 - 2019-04-19 05:38 - 000300544 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmenterprisediagnostics.dll 2019-05-15 12:54 - 2019-04-19 05:38 - 000140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatepolicy.dll 2019-05-15 12:54 - 2019-04-19 05:37 - 000953856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll 2019-05-15 12:54 - 2019-04-19 05:37 - 000445952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dmenrollengine.dll 2019-05-15 12:54 - 2019-04-19 05:37 - 000397312 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll 2019-05-15 12:54 - 2019-04-19 05:37 - 000381952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FirewallAPI.dll 2019-05-15 12:54 - 2019-04-19 05:37 - 000366080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieproxy.dll 2019-05-15 12:54 - 2019-04-19 05:37 - 000221184 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmregistration.dll 2019-05-15 12:54 - 2019-04-19 05:37 - 000118272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\updatepolicy.dll 2019-05-15 12:54 - 2019-04-19 05:36 - 001300992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AzureSettingSyncProvider.dll 2019-05-15 12:54 - 2019-04-19 05:36 - 000814592 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieproxy.dll 2019-05-15 12:54 - 2019-04-19 05:36 - 000546816 _____ (Microsoft Corporation) C:\WINDOWS\system32\FirewallAPI.dll 2019-05-15 12:54 - 2019-04-19 05:36 - 000357888 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapibase.dll 2019-05-15 12:54 - 2019-04-19 05:36 - 000186368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mdmregistration.dll 2019-05-15 12:54 - 2019-04-19 05:35 - 001938944 _____ (Microsoft Corporation) C:\WINDOWS\system32\AzureSettingSyncProvider.dll 2019-05-15 12:54 - 2019-04-19 05:35 - 000784896 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngcsvc.dll 2019-05-15 12:54 - 2019-04-19 05:35 - 000535040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OneDriveSettingSyncProvider.dll 2019-05-15 12:54 - 2019-04-19 05:35 - 000523776 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmenrollengine.dll 2019-05-15 12:54 - 2019-04-19 05:35 - 000312320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fveapibase.dll 2019-05-15 12:54 - 2019-04-19 05:34 - 000935936 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasmans.dll 2019-05-15 12:54 - 2019-04-19 05:34 - 000899584 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll 2019-05-15 12:54 - 2019-04-19 05:34 - 000885760 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll 2019-05-15 12:54 - 2019-04-19 05:34 - 000778240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll 2019-05-15 12:54 - 2019-04-19 05:34 - 000653312 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneDriveSettingSyncProvider.dll 2019-05-15 12:54 - 2019-04-19 04:18 - 000806360 _____ C:\WINDOWS\SysWOW64\locale.nls 2019-05-15 12:54 - 2019-04-19 04:18 - 000806360 _____ C:\WINDOWS\system32\locale.nls 2019-05-15 12:54 - 2019-04-09 02:48 - 001311744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msjet40.dll 2019-05-15 12:54 - 2019-04-09 02:48 - 000376320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mspbde40.dll 2019-05-15 12:54 - 2019-04-09 02:48 - 000341504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msexcl40.dll 2019-05-15 12:54 - 2019-04-09 02:48 - 000240640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msltus40.dll 2019-05-12 21:42 - 2019-05-12 21:42 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Focusrite Audio Engineering Ltd 2019-05-12 21:42 - 2019-05-12 21:42 - 000000000 ____D C:\Program Files\FocusriteUSB 2019-05-12 21:42 - 2018-01-09 15:28 - 001805304 _____ (Microsoft Corporation) C:\WINDOWS\system32\WdfCoInstaller01011.dll 2019-05-12 21:42 - 2018-01-09 15:28 - 000097936 _____ (Focusrite Audio Engineering Ltd.) C:\WINDOWS\system32\Drivers\FocusriteUSBSwRoot.sys 2019-05-12 13:03 - 2019-05-12 13:03 - 000000000 ____D C:\Users\LeonM\AppData\Roaming\SoundSwitch 2019-05-12 13:03 - 2019-05-12 13:03 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SoundSwitch 2019-05-12 13:03 - 2019-05-12 13:03 - 000000000 ____D C:\Program Files\SoundSwitch 2019-05-11 06:48 - 2019-05-11 07:21 - 000000000 ____D C:\Users\LeonM\AppData\Roaming\Cycling '74 2019-05-11 06:48 - 2019-05-11 06:48 - 000000000 ____D C:\Users\LeonM\Documents\Max 8 2019-05-11 06:48 - 2019-05-11 06:48 - 000000000 ____D C:\ProgramData\Max 8 2019-05-11 06:47 - 2019-05-11 06:47 - 000000000 ____D C:\Users\LeonM\Documents\Ableton 2019-05-11 06:47 - 2019-05-11 06:47 - 000000000 ____D C:\Users\LeonM\AppData\Roaming\Ableton 2019-05-11 06:47 - 2019-05-11 06:47 - 000000000 ____D C:\Users\LeonM\AppData\Local\Ableton 2019-05-11 06:27 - 2019-05-11 07:22 - 000000000 ____D C:\ProgramData\Ableton 2019-05-11 06:26 - 2019-05-11 06:26 - 000000871 _____ C:\Users\LeonM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ableton Live 10 Suite.lnk 2019-05-11 06:17 - 2019-05-11 06:17 - 000000000 ____D C:\Users\LeonM\AppData\LocalLow\Apple Computer 2019-05-11 06:16 - 2019-05-11 06:16 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IK Multimedia 2019-05-11 06:16 - 2012-08-29 13:23 - 012708016 _____ (Intel Corporation) C:\WINDOWS\system32\mkl_def.dll 2019-05-11 06:16 - 2012-08-29 13:23 - 012474544 _____ (Intel Corporation) C:\WINDOWS\system32\mkl_core.dll 2019-05-11 06:16 - 2012-08-29 13:23 - 009917616 _____ (Intel Corporation) C:\WINDOWS\system32\mkl_intel_thread.dll 2019-05-11 06:16 - 2012-08-29 13:23 - 009410736 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\mkl_p4m.dll 2019-05-11 06:16 - 2012-08-29 13:23 - 009210032 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\mkl_p4.dll 2019-05-11 06:16 - 2012-08-29 13:23 - 009078960 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\mkl_p4p.dll 2019-05-11 06:16 - 2012-08-29 13:23 - 009033904 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\mkl_p4m3.dll 2019-05-11 06:16 - 2012-08-29 13:23 - 006944944 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\mkl_core.dll 2019-05-11 06:16 - 2012-08-29 13:23 - 003868848 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\mkl_intel_thread.dll 2019-05-11 06:16 - 2012-08-29 13:23 - 000530608 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\libiomp5md.dll 2019-05-11 06:16 - 2012-08-29 13:23 - 000529072 _____ (Intel Corporation) C:\WINDOWS\system32\libiomp5md.dll 2019-05-11 06:16 - 2012-08-29 13:23 - 000499712 _____ (Microsoft Corporation) C:\WINDOWS\msvcp71.dll 2019-05-11 06:16 - 2012-08-29 13:23 - 000354480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcr71.dll 2019-05-11 06:16 - 2012-08-29 13:23 - 000348160 _____ (Microsoft Corporation) C:\WINDOWS\msvcr71.dll 2019-05-11 06:15 - 2019-05-11 06:16 - 000000000 ____D C:\Program Files (x86)\IK Multimedia 2019-05-11 06:15 - 2019-05-11 06:15 - 000000000 ____D C:\Users\LeonM\Documents\IK Multimedia 2019-05-11 06:15 - 2019-05-11 06:15 - 000000000 ____D C:\Program Files\VstPlugIns 2019-05-11 06:13 - 2012-10-19 00:00 - 000596174 _____ C:\Users\LeonM\Documents\AmpliTube_3_Unlocker_101.exe 2019-05-11 06:09 - 2019-05-11 06:09 - 000000000 __HDC C:\ProgramData\{B7072B15-6E80-42FF-A9AE-4E62AF2B2418} 2019-05-11 06:07 - 2019-05-11 06:07 - 000000000 __HDC C:\ProgramData\{CB28D9D3-6B5D-4AFA-BA37-B4AFAAAF71B9} 2019-05-11 06:07 - 2019-05-11 06:07 - 000000000 __HDC C:\ProgramData\{B0CAD5CC-867E-473E-B55F-339F9635A45D} 2019-05-11 06:06 - 2019-05-11 06:06 - 000000000 __HDC C:\ProgramData\{5A23829C-A66E-47B0-AD50-21A3FFE6C325} 2019-05-11 06:06 - 2019-05-11 06:06 - 000000000 __HDC C:\ProgramData\{30FA7941-4170-4C83-A9A8-FDF01C431704} 2019-05-11 06:05 - 2019-05-11 06:05 - 000000000 __HDC C:\ProgramData\{95B4F0ED-951F-4D36-B068-5EC1C4C19C14} 2019-05-05 14:59 - 2019-05-05 14:59 - 000000000 ____D C:\ProgramData\BlueStacksSetup ==================== One month (modified) ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2019-06-03 19:06 - 2018-05-15 23:56 - 000000000 ____D C:\WINDOWS\system32\SleepStudy 2019-06-03 17:41 - 2019-04-09 15:47 - 000000000 ____D C:\Users\LeonM\AppData\Local\Pushbullet 2019-06-03 17:33 - 2018-03-25 19:15 - 000000000 ____D C:\Program Files (x86)\Steam 2019-06-03 17:30 - 2017-10-17 04:14 - 000000000 ____D C:\ProgramData\NVIDIA 2019-06-03 10:56 - 2017-10-04 21:49 - 000000000 ____D C:\Users\LeonM\AppData\Local\CrashDumps 2019-06-03 04:56 - 2018-04-12 00:38 - 000000000 ___HD C:\WINDOWS\ELAMBKUP 2019-06-03 04:26 - 2018-01-27 23:50 - 000000000 ____D C:\Users\LeonM\AppData\LocalLow\Mozilla 2019-06-03 02:11 - 2018-07-23 17:19 - 000000000 ____D C:\Users\LeonM\AppData\Local\TSVNCache 2019-06-03 02:11 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\AppReadiness 2019-06-03 02:09 - 2018-10-01 18:02 - 000003314 _____ C:\WINDOWS\System32\Tasks\IORRT 2019-06-03 02:07 - 2018-05-16 00:15 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT 2019-06-03 01:44 - 2018-04-11 22:04 - 000524288 _____ C:\WINDOWS\system32\config\BBI 2019-06-03 01:43 - 2017-10-12 12:23 - 000000000 ____D C:\Users\LeonM\AppData\Local\ElevatedDiagnostics 2019-06-03 01:41 - 2019-02-24 22:34 - 000000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job 2019-06-03 01:09 - 2018-05-16 00:00 - 000000000 ____D C:\Users\LeonM 2019-06-03 00:53 - 2017-10-05 11:01 - 000000000 ____D C:\Users\LeonM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR 2019-06-03 00:53 - 2017-10-05 11:01 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR 2019-06-03 00:53 - 2017-10-05 11:01 - 000000000 ____D C:\Program Files\WinRAR 2019-06-03 00:52 - 2017-10-08 12:27 - 000000000 ____D C:\Users\LeonM\AppData\Roaming\foobar2000 2019-06-03 00:44 - 2018-04-12 00:36 - 000000000 ____D C:\WINDOWS\INF 2019-06-03 00:14 - 2018-07-23 18:26 - 000000000 ____D C:\Users\LeonM\AppData\Roaming\TakeOwnershipEx 2019-06-02 23:24 - 2017-10-05 10:51 - 000000000 ____D C:\Users\LeonM\AppData\Roaming\deluge 2019-06-02 06:06 - 2018-04-12 00:30 - 000000000 ____D C:\WINDOWS\CbsTemp 2019-06-02 05:59 - 2018-10-30 12:35 - 000000000 ____D C:\Users\LeonM\AppData\Roaming\vlc 2019-06-01 13:55 - 2017-10-04 21:54 - 000000000 ____D C:\ProgramData\Package Cache 2019-06-01 13:52 - 2018-08-24 20:32 - 000001043 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LOOT.lnk 2019-06-01 13:52 - 2018-08-24 20:32 - 000000000 ____D C:\Program Files (x86)\LOOT 2019-06-01 13:51 - 2017-10-06 14:51 - 000000000 ____D C:\Users\LeonM\AppData\Local\LOOT 2019-06-01 11:01 - 2017-10-05 15:12 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oblivion Mod Manager 2019-05-31 21:05 - 2018-05-19 13:05 - 000000000 ____D C:\Users\LeonM\AppData\Roaming\audacity 2019-05-31 20:53 - 2019-01-17 17:35 - 000000000 ____D C:\Users\LeonM\Documents\GinsorD2AudioTool_v1.1_20181121 2019-05-30 14:06 - 2018-04-12 00:38 - 000000000 ___HD C:\Program Files\WindowsApps 2019-05-30 13:28 - 2018-09-22 08:45 - 000000000 ____D C:\Program Files (x86)\Battle.net 2019-05-30 13:25 - 2018-09-22 08:46 - 000000000 ____D C:\Users\LeonM\AppData\Local\Battle.net 2019-05-29 22:32 - 2017-11-28 21:56 - 000000000 ____D C:\Users\LeonM\AppData\Local\Blizzard Entertainment 2019-05-29 22:32 - 2017-11-28 21:55 - 000000000 ____D C:\Users\LeonM\AppData\Local\Blizzard 2019-05-29 15:15 - 2017-11-11 11:33 - 000000000 ____D C:\Users\LeonM\AppData\Local\The Witcher 2019-05-29 14:52 - 2017-12-02 12:58 - 000000000 ____D C:\Users\LeonM\AppData\Local\Packages 2019-05-27 17:41 - 2017-11-10 18:50 - 000000000 ____D C:\Users\LeonM\Documents\The Witcher 3 2019-05-26 23:33 - 2018-05-06 22:35 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2019-05-26 23:33 - 2018-05-06 22:35 - 000000000 ____D C:\Program Files (x86)\Java 2019-05-26 23:31 - 2018-05-06 22:35 - 000099192 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll 2019-05-24 23:15 - 2019-02-20 20:17 - 000001200 _____ C:\Users\Public\Desktop\Ace Combat 7 - Skies Unknown.lnk 2019-05-24 23:15 - 2019-02-04 10:25 - 000001212 _____ C:\Users\Public\Desktop\Mass Effect Andromeda.lnk 2019-05-24 23:15 - 2019-02-01 07:50 - 000000976 _____ C:\Users\Public\Desktop\Star Wars Battlefront II (2017).lnk 2019-05-24 23:14 - 2019-03-04 02:42 - 000001230 _____ C:\Users\Public\Desktop\The Witcher 3 - Wild Hunt.lnk 2019-05-24 23:14 - 2019-02-25 20:06 - 000001248 _____ C:\Users\Public\Desktop\Metal Gear Solid V - The Phantom Pain.lnk 2019-05-24 23:14 - 2019-02-17 13:00 - 000001222 _____ C:\Users\Public\Desktop\The Witcher 2 - Assassins of Kings.lnk 2019-05-24 01:10 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\TextInput 2019-05-24 01:10 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\bcastdvr 2019-05-23 20:47 - 2017-12-22 20:41 - 000000000 ____D C:\Users\LeonM\AppData\Roaming\discord 2019-05-23 09:41 - 2017-10-04 22:00 - 000002338 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk 2019-05-23 00:16 - 2018-05-16 00:15 - 000004210 _____ C:\WINDOWS\System32\Tasks\CCleaner Update 2019-05-22 13:06 - 2018-01-23 23:14 - 000000000 ____D C:\Users\LeonM\AppData\Roaming\steelseries-engine-3-client 2019-05-20 14:51 - 2017-11-23 17:56 - 000000000 ____D C:\Users\LeonM\AppData\Local\Microsoft Help 2019-05-17 13:36 - 2018-05-16 00:11 - 000838560 _____ C:\WINDOWS\system32\PerfStringBackup.INI 2019-05-17 03:07 - 2017-10-05 10:12 - 000000000 ____D C:\Program Files\rempl 2019-05-16 01:40 - 2018-05-15 23:56 - 000265688 _____ C:\WINDOWS\system32\FNTCACHE.DAT 2019-05-16 01:14 - 2018-04-12 00:38 - 000000000 ___SD C:\WINDOWS\system32\DiagSvcs 2019-05-16 01:14 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\ShellExperiences 2019-05-16 01:14 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\PolicyDefinitions 2019-05-15 12:54 - 2017-10-05 10:11 - 000000000 ____D C:\WINDOWS\system32\MRT 2019-05-15 12:50 - 2017-10-05 10:10 - 132445408 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2019-05-15 08:51 - 2018-07-25 10:41 - 000002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk 2019-05-15 00:25 - 2018-05-16 00:15 - 000003418 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA 2019-05-15 00:25 - 2018-05-16 00:15 - 000003294 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore 2019-05-14 08:37 - 2019-03-21 00:49 - 066620328 _____ C:\Users\LeonM\Documents\F2.rar 2019-05-12 20:24 - 2018-07-20 08:55 - 000000032 _____ C:\Users\LeonM\AppData\Roaming\msregsvv.dll 2019-05-12 20:24 - 2018-07-20 08:55 - 000000032 _____ C:\ProgramData\autobk.inc 2019-05-11 07:16 - 2019-02-18 19:43 - 000000000 ____D C:\Program Files (x86)\ASIO4ALL v2 2019-05-11 06:58 - 2018-09-09 15:17 - 000000000 ____D C:\Users\LeonM\Documents\Native Instruments 2019-05-11 06:44 - 2018-09-14 23:28 - 000000000 ____D C:\Program Files\Common Files\Propellerhead Software 2019-05-11 06:44 - 2018-02-17 21:43 - 000000862 __RSH C:\ProgramData\ntuser.pol 2019-05-11 06:15 - 2018-09-14 23:28 - 000000000 ____D C:\Program Files (x86)\VstPlugins 2019-05-11 06:07 - 2019-02-26 01:21 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Native Instruments 2019-05-11 06:07 - 2018-09-09 15:02 - 000000000 ____D C:\Program Files\Native Instruments 2019-05-11 06:07 - 2018-09-09 15:02 - 000000000 ____D C:\Program Files\Common Files\Native Instruments 2019-05-11 05:22 - 2017-11-23 17:57 - 000000000 ____D C:\Users\LeonM\Documents\CV 2019-05-04 00:53 - 2018-11-15 02:25 - 000835688 _____ (Adobe) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2019-05-04 00:53 - 2018-11-15 02:25 - 000179816 _____ (Adobe) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl ==================== Files in the root of some directories ======= 2019-06-02 23:25 - 2019-06-02 23:25 - 001799680 _____ (NTWind Software) C:\Users\Public\lcqk.exe 2018-07-20 08:55 - 2019-05-12 20:24 - 000000032 _____ () C:\Users\LeonM\AppData\Roaming\msregsvv.dll 2019-02-23 16:16 - 2019-02-23 19:50 - 001065984 _____ () C:\Users\LeonM\AppData\Local\file__0.localstorage 2019-06-03 04:27 - 2019-06-03 04:27 - 000000218 _____ () C:\Users\LeonM\AppData\Local\recently-used.xbel 2018-12-25 09:49 - 2019-02-23 16:34 - 000007600 _____ () C:\Users\LeonM\AppData\Local\resmon.resmoncfg 2018-11-02 03:34 - 2018-11-02 03:34 - 000000076 _____ () C:\Users\LeonM\AppData\Local\update_progress.txt ==================== SigCheck =============================== (There is no automatic fix for files that do not pass verification.) ==================== End of FRST.txt ============================ Addition.txt
  6. Will I need to worry about it grabbing the new passwords or would that only be possible if I set my browser to remember them?
  7. Can't see an edit button for my post but I forgot to mention that the folder in ProgramData doesn't actually show up, even with hidden files and folders enabled.
  8. Tried opening a video, only realising afterwards that it was a powershell shortcut. MalwareBytes isn't detecting anything but Task Manager shows a program called Hidden Start with C:\ProgramData\{07942618-BD98-47FA-BB01-A7DDC1FEC6B0} as its location. I deleted the shortcut but I do have this shortbit link that was in the file target. http://shortbit.xyz/psp
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.