Jump to content

Search the Community

Showing results for tags 'rundll32'.

  • Search By Tags

    Type tags separated by commas.
  • Search By Author

Content Type


Forums

  • Announcements
    • Malwarebytes News
    • Beta Testing Program
  • Malware Removal Help
    • Windows Malware Removal Help & Support
    • Mac Malware Removal Help & Support
    • Mobile Malware Removal Help & Support
    • Malware Removal Self-Help Guides
  • Malwarebytes for Home Support
    • Malwarebytes for Windows Support Forum
    • Malwarebytes for Mac Support Forum
    • Malwarebytes for Android Support Forum
    • Malwarebytes for iOS Support
    • Malwarebytes Privacy
    • Malwarebytes Browser Guard
    • False Positives
    • Comments and Suggestions
  • Malwarebytes for Business Support
    • Malwarebytes Endpoint Protection
    • Malwarebytes Incident Response (includes Breach Remediation)
    • Malwarebytes Endpoint Security
    • Malwarebytes Business Products Comments and Suggestions
  • Malwarebytes Tools and Other Products
    • Malwarebytes AdwCleaner
    • Malwarebytes Junkware Removal Tool Support
    • Malwarebytes Anti-Rootkit BETA Support
    • Malwarebytes Techbench USB (Legacy)
    • Malwarebytes Secure Backup discontinued
    • Other Tools
    • Malwarebytes Tools Comments and Suggestions
  • General Computer Help and Security Updates
    • BSOD, Crashes, Kernel Debugging
    • General Windows PC Help
  • Research Center
    • Newest Rogue-Ransomware Threats
    • Newest Malware Threats
    • Newest Mobile Threats
    • Newest IP or URL Threats
    • Newest Mac Threats
    • Report Scam Phone Numbers
  • General
    • General Chat
    • Forums Announcements & Feedback

Find results in...

Find results that contain...


Date Created

  • Start

    End


Last Updated

  • Start

    End


Filter by number of...

Joined

  • Start

    End


Group


AIM


MSN


Website URL


ICQ


Yahoo


Jabber


Location


Interests

Found 6 results

  1. Hi all, I've been in quite the pickle. Yesterday morning I got a mcAfee notification pop up that said "we've scanned your download and it's safe!" or similar, and this was "rundll32.exe" now, I know this is a system file and I had not downloaded anything while this occured, I wish I had taken a screenshot. To be safe I did a lot of different processes. First, I did a scannow on system32, all clear, nothing unusual there, I did a Mcafee full scan and it detected nothing, and Malwarebytes did not either. When I tried Windows Safety Scanner, this baffled me- it found 5 infected files on my entire PC, but the conclusion at the end was that it had found no malware. Here's what it looks like when I search for rundll32.exe below of this post, I am at such a loss and I'm worried and I don't know why mcafee suddenly gave me the popup it does when one would download in real time and it'd scan, so something or other downloaded, and I'm concerned. Please let me know what I need to do, what I can send back, I would be endlessly appreciative of the help. Here's the search results, those search ones are probably from me frantically searching yesterday.
  2. Been getting Tojan.downloader and website ad outbounds recently. Here is a sample: Protection, 5/26/2016 10:53 PM, SYSTEM, ROTITA-PC, Protection, Malicious Website Protection, Starting, Protection, 5/26/2016 10:53 PM, SYSTEM, ROTITA-PC, Protection, Malicious Website Protection, Started, Detection, 5/26/2016 10:56 PM, SYSTEM, ROTITA-PC, Protection, Malicious Website Protection, IP, 174.137.155.139, filter.adsparkmedia.net, 49596, Outbound, C:\Windows\System32\rundll32.exe, Detection, 5/26/2016 10:56 PM, SYSTEM, ROTITA-PC, Protection, Malicious Website Protection, IP, 174.137.155.139, filter.adsparkmedia.net, 49596, Outbound, C:\Windows\System32\rundll32.exe, Detection, 5/26/2016 10:56 PM, SYSTEM, ROTITA-PC, Protection, Malicious Website Protection, Domain, 104.154.36.143, www.adcash.com, 49606, Outbound, C:\Windows\System32\rundll32.exe, Detection, 5/26/2016 10:56 PM, SYSTEM, ROTITA-PC, Protection, Malicious Website Protection, Domain, 104.154.36.143, www.adcash.com, 49606, Outbound, C:\Windows\System32\rundll32.exe, Detection, 5/26/2016 10:56 PM, Rotita, ROTITA-PC, Protection, Malware Protection, File, Trojan.Downloader, C:\Users\Rotita\AppData\Local\Temp\g3D30.tmp.exe, Quarantine, [f3ea5b7ff3a6a294f374c28541c30af6] Detection, 5/26/2016 10:57 PM, SYSTEM, ROTITA-PC, Protection, Malicious Website Protection, Domain, 104.154.36.143, www.adcash.com, 49647, Outbound, C:\Windows\System32\rundll32.exe, Detection, 5/26/2016 10:57 PM, SYSTEM, ROTITA-PC, Protection, Malicious Website Protection, Domain, 174.137.155.139, xml.adfclick1.com, 49771, Outbound, C:\Windows\System32\rundll32.exe, Detection, 5/26/2016 10:57 PM, SYSTEM, ROTITA-PC, Protection, Malicious Website Protection, Domain, 174.137.155.139, xml.adfclick1.com, 49771, Outbound, C:\Windows\System32\rundll32.exe, Detection, 5/26/2016 10:57 PM, SYSTEM, ROTITA-PC, Protection, Malicious Website Protection, Domain, 174.137.155.139, xml.adfclick1.com, 49772, Outbound, C:\Windows\System32\rundll32.exe, Detection, 5/26/2016 11:07 PM, SYSTEM, ROTITA-PC, Protection, Malicious Website Protection, Domain, 104.154.36.143, www.adcash.com, 50260, Outbound, C:\Windows\System32\rundll32.exe, Detection, 5/26/2016 11:07 PM, SYSTEM, ROTITA-PC, Protection, Malicious Website Protection, Domain, 174.137.155.139, xml.adfclick1.com, 50297, Outbound, C:\Windows\System32\rundll32.exe, Detection, 5/26/2016 11:07 PM, SYSTEM, ROTITA-PC, Protection, Malicious Website Protection, Domain, 104.154.36.143, www.adcash.com, 50432, Outbound, C:\Windows\System32\rundll32.exe, Detection, 5/26/2016 11:07 PM, SYSTEM, ROTITA-PC, Protection, Malicious Website Protection, Domain, 174.137.155.139, xml.adfclick1.com, 50506, Outbound, C:\Windows\System32\rundll32.exe, Detection, 5/26/2016 11:07 PM, SYSTEM, ROTITA-PC, Protection, Malicious Website Protection, Domain, 174.137.155.139, xml.adfclick1.com, 50507, Outbound, C:\Windows\System32\rundll32.exe, (end) Malwarebytes Anti-Malware gives 0 threats. Even after the Trojan gets quarantined, it appears back after rebooting. ----------------------------------------------------------------------- Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:25-05-2016 01 Ran by Rotita (administrator) on ROTITA-PC (26-05-2016 23:20:57) Running from C:\Users\Rotita\Downloads\Programs Loaded Profiles: Rotita (Available Profiles: Rotita) Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States) Internet Explorer Version 11 (Default browser: Chrome) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvscpapisvr.exe (Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\WTabletServicePro.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe (Actual Tools) C:\Program Files (x86)\Actual Multiple Monitors\LogonScreenService.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 16.0.0\avp.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe (Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe (Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe (Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 16.0.0\avpui.exe (Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Actual Tools) C:\Program Files (x86)\Actual Multiple Monitors\ActualMultipleMonitorsCenter.exe (Mailbird) C:\Program Files (x86)\Mailbird\Mailbird.exe (OrdinarySoft) C:\Program Files\Start Menu X\StartMenuX.exe (Flux Software LLC) C:\Users\Rotita\AppData\Local\FluxSoftware\Flux\flux.exe (Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.exe (www.LoungeWare.net) C:\Program Files (x86)\Gong\GONG.exe (Actual Tools) C:\Program Files (x86)\Actual Multiple Monitors\ActualMultipleMonitorsCenter64.exe (Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe (Wacom Technology) C:\Program Files\Tablet\Wacom\WacomHost.exe (Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe (Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe (The CefSharp Authors) C:\Program Files (x86)\Mailbird\CefSharp.BrowserSubprocess.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe (Actual Tools) C:\Program Files (x86)\Actual Multiple Monitors\ActualMultipleMonitorsShellCenter64.exe (Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (The Pidgin developer community) C:\Program Files (x86)\Pidgin\pidgin.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (The CefSharp Authors) C:\Program Files (x86)\Mailbird\CefSharp.BrowserSubprocess.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (EJIE Technology) C:\Program Files (x86)\Clover\clover.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Whitelisted) =========================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8483032 2015-09-04] (Realtek Semiconductor) HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2398776 2016-05-02] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] => "C:\Windows\system32\rundll32.exe" C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508128 2016-03-22] (Adobe Systems Incorporated) HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [3113592 2015-08-25] (Logitech, Inc.) HKLM\...\Run: [rundll32] => C:\Windows\system32\rundll32.exe "C:\ProgramData\DeltaSearch\DeltaSearch.dll",_ HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe HKLM-x32\...\Run: [DelaypluginInstall] => C:\ProgramData\Wondershare\Video Converter Ultimate\DelayPluginI.exe Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.) HKU\S-1-5-21-2815074937-3251990301-1603328592-1000\...\Run: [Actual Multiple Monitors] => C:\Program Files (x86)\Actual Multiple Monitors\ActualMultipleMonitorsCenter.exe [866608 2015-10-04] (Actual Tools) HKU\S-1-5-21-2815074937-3251990301-1603328592-1000\...\Run: [Mailbird] => C:\Program Files (x86)\Mailbird\Mailbird.exe [7335608 2016-05-17] (Mailbird) HKU\S-1-5-21-2815074937-3251990301-1603328592-1000\...\Run: [AdobeBridge] => [X] HKU\S-1-5-21-2815074937-3251990301-1603328592-1000\...\Run: [StartMenuX] => C:\Program Files\Start Menu X\StartMenuX.exe [7908672 2015-07-30] (OrdinarySoft) HKU\S-1-5-21-2815074937-3251990301-1603328592-1000\...\Run: [f.lux] => C:\Users\Rotita\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2013-10-23] (Flux Software LLC) HKU\S-1-5-21-2815074937-3251990301-1603328592-1000\...\Run: [{82D4A752-346D-4CF6-883E-BA447A497503}] => "C:\ProgramData\Mailbird\Updates\Mailbird\MailbirdSetup.exe" /cmdloc "HKCU\Software\Mailbird AiTemp\{82D4A752-346D-4CF6-883E-BA447A497503}" HKU\S-1-5-21-2815074937-3251990301-1603328592-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8721624 2016-05-13] (Piriform Ltd) HKU\S-1-5-21-2815074937-3251990301-1603328592-1000\...\MountPoints2: {66352f70-5365-11e5-ab10-e1933114d698} - E:\LaunchU3.exe -a HKU\S-1-5-18\...\Run: [] => 0 Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\schtasks_gong.exe.lnk [2015-11-22] ShortcutTarget: schtasks_gong.exe.lnk -> C:\Windows\System32\schtasks.exe (Microsoft Corporation) CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 Tcpip\..\Interfaces\{0CEE3EBF-6B43-4014-8073-5BFA788B2C26}: [DhcpNameServer] 192.168.1.1 Internet Explorer: ================== SearchScopes: HKU\S-1-5-21-2815074937-3251990301-1603328592-1000 -> DefaultScope {53D81A3A-7A4D-4CCF-BE67-2BCA015B22AF} URL = hxxps://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?} SearchScopes: HKU\S-1-5-21-2815074937-3251990301-1603328592-1000 -> {53D81A3A-7A4D-4CCF-BE67-2BCA015B22AF} URL = hxxps://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?} BHO: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll [2015-08-25] (Logitech, Inc.) BHO: Kaspersky Protection plugin -> {C66D064F-82FE-4E1A-B06A-B2490BA48B18} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 16.0.0\x64\IEExt\ie_plugin.dll [2015-10-20] (AO Kaspersky Lab) BHO: ExplorerWatcher Class -> {F8A6CAA2-533D-4AED-9E05-8EB19A4021AB} -> C:\Program Files (x86)\Clover\TabHelper64.dll [2014-01-23] (EJIE Technology) BHO-x32: Wondershare Video Converter Ultimate 7.1.0 -> {451C804F-C205-4F03-B48E-537EC94937BF} -> C:\PROGRA~3\WONDER~1\VIDEOC~1\WSBROW~1.DLL => No File BHO-x32: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll [2015-08-25] (Logitech, Inc.) BHO-x32: Kaspersky Protection plugin -> {C66D064F-82FE-4E1A-B06A-B2490BA48B18} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 16.0.0\IEExt\ie_plugin.dll [2015-10-20] (AO Kaspersky Lab) Toolbar: HKLM - Kaspersky Protection toolbar - {3507FA00-ADA2-4A02-99B9-51AD26CA9120} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 16.0.0\x64\IEExt\ie_plugin.dll [2015-10-20] (AO Kaspersky Lab) Toolbar: HKLM-x32 - Kaspersky Protection toolbar - {3507FA00-ADA2-4A02-99B9-51AD26CA9120} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 16.0.0\IEExt\ie_plugin.dll [2015-10-20] (AO Kaspersky Lab) Handler: WSWSVCUchrome - {1CA93FF0-A218-44F1 - No File StartMenuInternet: IEXPLORE.EXE - iexplore.exe FireFox: ======== FF ProfilePath: C:\Users\Rotita\AppData\Roaming\Mozilla\Firefox\Profiles\f16k0gr1.default FF DefaultSearchEngine.US: Google FF Homepage: hxxp://e-try.com/black.htm FF Session Restore: -> is enabled. FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_21_0_0_242.dll [2016-05-12] () FF Plugin: @microsoft.com/GENUINE -> disabled [No File] FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-16] (VideoLAN) FF Plugin: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom) FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2015-08-06] (Adobe Systems) FF Plugin: adobe.com/AdobeExManDetect -> C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\Win64Plugin\npAdobeExManDetectX64.dll [2013-12-02] (Adobe Systems) FF Plugin: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_242.dll [2016-05-12] () FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File] FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2016-05-19] (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2016-05-19] (NVIDIA Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-10] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-10] (Google Inc.) FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom) FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2015-08-06] (Adobe Systems) FF Plugin-x32: adobe.com/AdobeExManDetect -> C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\npAdobeExManDetectX86.dll [2013-12-02] (Adobe Systems) FF Plugin-x32: wacom.com/WacomTabletPlugin -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom) FF Extension: Bulk Image Downloader - C:\Users\Rotita\AppData\Roaming\Mozilla\Firefox\Profiles\f16k0gr1.default\extensions\{524B8EF8-C312-11DB-8039-536F56D89593}.xpi [2016-04-12] FF Extension: Dimmer - C:\Users\Rotita\AppData\Roaming\Mozilla\Firefox\Profiles\f16k0gr1.default\Extensions\dimmer@tejohnso.github.com.xpi [2016-05-08] FF Extension: BetterTTV - C:\Users\Rotita\AppData\Roaming\Mozilla\Firefox\Profiles\f16k0gr1.default\Extensions\firefox@betterttv.net.xpi [2016-01-02] FF Extension: rarchive - C:\Users\Rotita\AppData\Roaming\Mozilla\Firefox\Profiles\f16k0gr1.default\Extensions\jid1-AusxzKACE9lLYQ@jetpack.xpi [2016-05-08] FF Extension: Dark Background and Light Text - C:\Users\Rotita\AppData\Roaming\Mozilla\Firefox\Profiles\f16k0gr1.default\Extensions\jid1-QoFqdK4qzUfGWQ@jetpack.xpi [2016-04-20] FF Extension: FrankerFaceZ - C:\Users\Rotita\AppData\Roaming\Mozilla\Firefox\Profiles\f16k0gr1.default\Extensions\jid1-snHdAu6px3p0jA@jetpack.xpi [2016-01-02] FF Extension: NASA Night Launch - C:\Users\Rotita\AppData\Roaming\Mozilla\Firefox\Profiles\f16k0gr1.default\Extensions\nasanightlaunch@example.com.xpi [2016-04-02] FF Extension: New Tab Homepage - C:\Users\Rotita\AppData\Roaming\Mozilla\Firefox\Profiles\f16k0gr1.default\Extensions\{66E978CD-981F-47DF-AC42-E3CF417C1467}.xpi [2016-02-13] FF Extension: FT DeepDark - C:\Users\Rotita\AppData\Roaming\Mozilla\Firefox\Profiles\f16k0gr1.default\Extensions\{77d2ed30-4cd2-11e0-b8af-0800200c9a66} [2016-02-13] FF Extension: Video DownloadHelper - C:\Users\Rotita\AppData\Roaming\Mozilla\Firefox\Profiles\f16k0gr1.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2016-05-08] FF Extension: Adblock Plus - C:\Users\Rotita\AppData\Roaming\Mozilla\Firefox\Profiles\f16k0gr1.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-05-08] FF HKLM-x32\...\Firefox\Extensions: [light_plugin_D772DC8D6FAF43A29B25C4EBAA5AD1DE@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 16.0.0\FFExt\light_plugin_firefox FF Extension: Kaspersky Protection - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 16.0.0\FFExt\light_plugin_firefox [2016-05-24] FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2015-10-06] [not signed] FF HKLM-x32\...\Firefox\Extensions: [WSVCU@Wondershare.com] - C:\ProgramData\Wondershare\Video Converter Ultimate\WSVCU@Wondershare.com => not found Chrome: ======= CHR HomePage: Default -> hxxp://www.google.com/ CHR StartupUrls: Default -> "hxxp://www.facebook.com/","hxxp://www.youtube.com/","hxxp://yaoi.y-gallery.net/user/pidgeot41/" CHR DefaultSearchURL: Default -> hxxps://www.facebook.com/suchorskia CHR DefaultSearchKeyword: Default -> t CHR Session Restore: Default -> is enabled. CHR Profile: C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Translate) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb [2015-11-16] CHR Extension: (Mini YouTube) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\acphfpihfjpgnihkgelafhmjeoodbehp [2016-05-25] CHR Extension: (BetterTTV) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajopnjidmegmdimjlfnijceegpefgped [2015-10-10] CHR Extension: (Turn Off the Lights) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfbmjmiodbnnpllbbbfblcplfjjepjdn [2016-05-15] CHR Extension: (SocialReviver) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfipfkeoidmndggnnpobeenlamiclald [2016-02-23] CHR Extension: (Let It Snow!) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\bklfpghejcbnjmbjghbnhmdbfpcgbbpb [2015-12-12] CHR Extension: (ImprovedTube - YouTube Extension) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\bnomihfieiccainjcjblhegjgglakjdd [2016-04-04] CHR Extension: (Nimbus Screenshot and Screencast) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\bpconcjcammlapcogcnnelfmaeghhagj [2016-05-01] CHR Extension: (YouTweak for YouTube™ - Subscription Manager) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfgpigllcihcpkbokdnmpkjobnebflgh [2016-05-10] CHR Extension: (Adblock Plus) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-03-08] CHR Extension: (Scroll To Top Button) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\chinfkfmaefdlchhempbfgbdagheknoj [2016-05-16] CHR Extension: (YouTube™ Scroll Player) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmceloemlfndkbklohojnlppaefclkma [2016-05-13] CHR Extension: (Super Stream Bros) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhbmiekfpeonammafmjlikbljmlobggb [2015-09-04] CHR Extension: (Tampermonkey) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdgffkkebhmkfjojejmpbldmpobfkfo [2016-04-11] CHR Extension: (Kaspersky Protection) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\eahebamiopdhefndnmappcihfajigkka [2015-09-25] CHR Extension: (Kami - PDF Sign, Edit, Review) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\ecnphlgnajanjnkcmbpancdjoidceilk [2016-05-26] CHR Extension: (Minimal Scrollbar) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekopmclclddpoipchmcbhifohhbmjafd [2015-09-13] CHR Extension: (SimpleUndoClose) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\emhohdghchmjepmigjojkehidlielknj [2016-03-08] CHR Extension: (No Name) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\facoldpeadablbngjnohbmgaehknhcaj [2016-05-26] CHR Extension: (FrankerFaceZ) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\fadndhdgpmmaapbmfcknlfgcflmmmieb [2015-09-04] CHR Extension: (Care your Eyes) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\fidmpnedniahpnkeomejhnepmbdamlhl [2016-05-26] CHR Extension: (Stylish) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjnbnpbmkenffdnngjfgmeleoegfcffe [2016-04-05] CHR Extension: (Secret Dungeon Emotes) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\fljimgaiflbdcihhihlmccpdfnlcedcm [2015-09-04] CHR Extension: (Thumbs-preview for Youtube™) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\fmgdbmahogeafeboejeaihgenfhncdia [2016-01-21] CHR Extension: (Google Docs Offline) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-15] CHR Extension: (Relaxing Sounds - Giovesoft) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpgbpbpobbgnaognooilkmncoonaedao [2015-12-09] CHR Extension: (SearchPreview) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcjdanpjacpeeppdjkppebobilhaglfo [2015-12-19] CHR Extension: (Hover Free) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcmnnggnaofmhflgomfjfbndngdoogkj [2015-09-04] CHR Extension: (Pretty Twitch) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\idgblkjhnkldclklibbghdemflhbkaip [2015-09-18] CHR Extension: (PIXIV Viewer) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\iennmgkhodlaphjanjeincjlolinlhng [2015-10-11] CHR Extension: (Weather) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihbiedpeaicgipncdnnkikeehnjiddck [2016-05-26] CHR Extension: (Extensions (new tab)) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\iimnlpkklbehlibkphacaolndffafifk [2015-09-04] CHR Extension: (FullStream) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\jkchcbdilffpbpkknniliidiflhbagkl [2015-12-14] CHR Extension: (Speed Dial 2) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpfpebmajhhopeonhlcgidhclcccjcik [2015-11-10] CHR Extension: (Noisli) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\klejemegaoblahjdpcajmpcnjjmkmkkf [2016-02-03] CHR Extension: (Hide unwanted streams on Twitch) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpgfplcjhleaadnmjmkjddcmekdhdiia [2016-05-09] CHR Extension: (Beautify FB) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\ldngjhkgckijklngngononnejmadojce [2015-09-04] CHR Extension: (YouTube HTML5 Video AdBlock) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmkjedkhnnhcohninidcejgollmggcjf [2015-09-14] CHR Extension: (F.B Purity-Clean Up Facebook) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\ncdlagniojmheiklojdcpdaeepochckl [2016-05-26] CHR Extension: (Twitch Now) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlmbdmpjmlijibeockamioakdpmhjnpk [2016-03-29] CHR Extension: (Chrome Web Store Payments) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-01] CHR Extension: (Proxy List Pro) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\oicamophdnojgacgbobolcnhbbgpiknb [2015-09-04] CHR Extension: (Google Quick Scroll) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\okanipcmceoeemlbjnmnbdibhgpbllgc [2016-05-26] CHR Extension: (Twitch Disable Unfollow) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\oldjkdacdpbnpcmciodogcmmadekenhi [2015-09-18] CHR Extension: (Youtube Scroll) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\olmpbeelanmlomolljbohfpfjlfodhoe [2016-05-13] CHR Extension: (Oddshot) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\olnoeeagkgpkplnhmnnlgodjnjgckhja [2016-05-09] CHR Extension: (Global Twitch Emotes) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgniedifoejifjkndekolimjeclnokkb [2016-05-04] CHR Extension: (Black Black Chrome Theme Neon Green Highlight) - C:\Users\Rotita\AppData\Local\Google\Chrome\User Data\Default\Extensions\phpbpckgofmlhfpbakbfbkiopngnpigh [2015-09-04] CHR HKLM\...\Chrome\Extension: [eahebamiopdhefndnmappcihfajigkka] - hxxps://chrome.google.com/webstore/detail/eahebamiopdhefndnmappcihfajigkka CHR HKLM-x32\...\Chrome\Extension: [eahebamiopdhefndnmappcihfajigkka] - hxxps://chrome.google.com/webstore/detail/eahebamiopdhefndnmappcihfajigkka Opera: ======= OPR Extension: (SimpleUndoClose) - C:\Users\Rotita\AppData\Roaming\Opera Software\Opera Stable\Extensions\aipamoaneebnhkfefefbfmhimclgafig [2015-12-11] OPR Extension: (AdBlock) - C:\Users\Rotita\AppData\Roaming\Opera Software\Opera Stable\Extensions\aobdicepooefnbaeokijohmhjlleamfj [2015-12-11] OPR Extension: (Nightingale View) - C:\Users\Rotita\AppData\Roaming\Opera Software\Opera Stable\Extensions\mmefgajjnmcffihnkihbiicnmdhppbjo [2015-12-11] ==================== Services (Whitelisted) ======================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2021592 2016-04-05] (Adobe Systems, Incorporated) R2 amm_LSService; C:\Program Files (x86)\Actual Multiple Monitors\LogonScreenService.exe [87344 2015-09-19] (Actual Tools) R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-10-07] (Apple Inc.) R2 AVP16.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 16.0.0\avp.exe [194000 2015-09-04] (Kaspersky Lab ZAO) R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1165368 2016-05-02] (NVIDIA Corporation) S3 MailbirdUpdater.exe; C:\Program Files (x86)\Mailbird\MailbirdUpdater.exe [390840 2016-05-17] (Mailbird) R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1513784 2015-10-05] (Malwarebytes) R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes) R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1881144 2016-05-02] (NVIDIA Corporation) R3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [3634232 2016-05-02] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [2522680 2016-05-02] (NVIDIA Corporation) S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed] S3 vssbrigde64; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 16.0.0\x64\vssbridge64.exe [144640 2015-07-09] (AO Kaspersky Lab) R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) R2 WTabletServicePro; C:\Program Files\Tablet\Wacom\WTabletServicePro.exe [730304 2015-10-02] (Wacom Technology, Corp.) ===================== Drivers (Whitelisted) ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2015-09-04] () R0 cm_km; C:\Windows\System32\DRIVERS\cm_km.sys [389816 2015-07-06] (Kaspersky Lab ZAO) S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation) R3 hcw10bda; C:\Windows\System32\drivers\hcw10bda.sys [650352 2013-04-12] (Hauppauge Computer Works, Inc.) R2 hcw10cir; C:\Windows\System32\drivers\hcw10cir.sys [46080 2013-04-12] (Hauppauge Computer Works, Inc.) R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [478392 2015-06-22] (Kaspersky Lab ZAO) R0 klbackupdisk; C:\Windows\System32\DRIVERS\klbackupdisk.sys [53432 2015-06-06] (Kaspersky Lab ZAO) R1 klbackupflt; C:\Windows\System32\DRIVERS\klbackupflt.sys [70000 2015-06-27] (Kaspersky Lab ZAO) R2 kldisk; C:\Windows\System32\DRIVERS\kldisk.sys [77728 2016-03-01] (AO Kaspersky Lab) R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [181640 2015-10-20] (AO Kaspersky Lab) R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [237480 2016-05-24] (AO Kaspersky Lab) R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [943536 2016-05-24] (AO Kaspersky Lab) R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [49240 2016-05-24] (AO Kaspersky Lab) R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [41144 2015-06-06] (Kaspersky Lab ZAO) R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [41648 2015-06-07] (Kaspersky Lab ZAO) R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [41352 2015-09-26] (AO Kaspersky Lab) R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [65208 2015-06-11] (Kaspersky Lab ZAO) R1 Klwtp; C:\Windows\System32\DRIVERS\klwtp.sys [103096 2015-06-16] (Kaspersky Lab ZAO) R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [187056 2015-06-23] (Kaspersky Lab ZAO) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2016-05-26] (Malwarebytes) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-10-05] (Malwarebytes Corporation) R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [28216 2016-05-02] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [56384 2016-04-14] (NVIDIA Corporation) ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2016-05-26 22:39 - 2016-05-26 22:39 - 06894120 _____ (Piriform Ltd) C:\Users\Rotita\Desktop\ccsetup518pro.exe 2016-05-26 22:39 - 2016-05-26 22:39 - 00002794 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC 2016-05-26 22:39 - 2016-05-26 22:39 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk 2016-05-26 22:39 - 2016-05-26 22:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner 2016-05-26 22:39 - 2016-05-26 22:39 - 00000000 ____D C:\Program Files\CCleaner 2016-05-26 22:31 - 2016-05-26 22:34 - 00000000 ____D C:\ProgramData\HitmanPro 2016-05-26 22:31 - 2016-05-26 22:31 - 00000000 ____D C:\Program Files\HitmanPro 2016-05-26 22:30 - 2016-05-26 22:31 - 11438608 _____ (SurfRight B.V.) C:\Users\Rotita\Desktop\HitmanPro_x64.exe 2016-05-26 22:02 - 2016-05-26 22:02 - 00000000 ____D C:\Windows\pss 2016-05-26 21:12 - 2016-05-26 21:12 - 00000873 _____ C:\Users\Rotita\AppData\Roaming\PureRef.ini 2016-05-26 20:34 - 2016-05-26 22:51 - 00003196 _____ C:\Users\Rotita\Desktop\JRT.txt 2016-05-26 20:14 - 2016-05-26 20:21 - 00000000 ____D C:\AdwCleaner 2016-05-26 19:44 - 2016-05-26 23:20 - 00000000 ____D C:\FRST 2016-05-26 19:03 - 2016-05-26 19:17 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\7E7E28A2.sys 2016-05-24 23:53 - 2016-05-19 20:45 - 00113208 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe 2016-05-24 23:52 - 2016-05-21 16:10 - 01581624 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco64.dll 2016-05-24 23:52 - 2016-05-21 16:10 - 00141256 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys 2016-05-24 23:52 - 2016-05-21 16:10 - 00046024 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll 2016-05-24 23:52 - 2016-05-20 02:01 - 39979576 _____ C:\Windows\system32\nvcompiler.dll 2016-05-24 23:52 - 2016-05-20 02:01 - 35117112 _____ C:\Windows\SysWOW64\nvcompiler.dll 2016-05-24 23:52 - 2016-05-20 02:01 - 31600696 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll 2016-05-24 23:52 - 2016-05-20 02:01 - 25372096 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll 2016-05-24 23:52 - 2016-05-20 02:01 - 21794064 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll 2016-05-24 23:52 - 2016-05-20 02:01 - 21336720 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll 2016-05-24 23:52 - 2016-05-20 02:01 - 19110968 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll 2016-05-24 23:52 - 2016-05-20 02:01 - 18138232 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll 2016-05-24 23:52 - 2016-05-20 02:01 - 17732936 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll 2016-05-24 23:52 - 2016-05-20 02:01 - 17236560 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll 2016-05-24 23:52 - 2016-05-20 02:01 - 16693208 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll 2016-05-24 23:52 - 2016-05-20 02:01 - 13412408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys 2016-05-24 23:52 - 2016-05-20 02:01 - 10642728 _____ C:\Windows\system32\nvptxJitCompiler.dll 2016-05-24 23:52 - 2016-05-20 02:01 - 08733096 _____ C:\Windows\SysWOW64\nvptxJitCompiler.dll 2016-05-24 23:52 - 2016-05-20 02:01 - 03447232 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll 2016-05-24 23:52 - 2016-05-20 02:01 - 03001792 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll 2016-05-24 23:52 - 2016-05-20 02:01 - 01922496 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6436822.dll 2016-05-24 23:52 - 2016-05-20 02:01 - 01573432 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6436822.dll 2016-05-24 23:52 - 2016-05-20 02:01 - 00984512 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll 2016-05-24 23:52 - 2016-05-20 02:01 - 00911416 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll 2016-05-24 23:52 - 2016-05-20 02:01 - 00770496 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll 2016-05-24 23:52 - 2016-05-20 02:01 - 00708032 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll 2016-05-24 23:52 - 2016-05-20 02:01 - 00669952 _____ C:\Windows\system32\nvfatbinaryLoader.dll 2016-05-24 23:52 - 2016-05-20 02:01 - 00565392 _____ C:\Windows\SysWOW64\nvfatbinaryLoader.dll 2016-05-24 23:52 - 2016-05-20 02:01 - 00501384 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll 2016-05-24 23:52 - 2016-05-20 02:01 - 00476848 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll 2016-05-24 23:52 - 2016-05-20 02:01 - 00423360 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll 2016-05-24 23:52 - 2016-05-20 02:01 - 00422240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll 2016-05-24 23:52 - 2016-05-20 02:01 - 00394912 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll 2016-05-24 23:52 - 2016-05-20 02:01 - 00379448 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll 2016-05-24 23:52 - 2016-05-20 02:01 - 00177952 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll 2016-05-24 23:52 - 2016-05-20 02:01 - 00155768 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll 2016-05-24 23:52 - 2016-05-20 02:01 - 00153232 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll 2016-05-24 23:52 - 2016-05-20 02:01 - 00131584 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll 2016-05-24 23:52 - 2016-05-20 02:01 - 00000594 _____ C:\Windows\SysWOW64\nv-vk32.json 2016-05-24 23:52 - 2016-05-20 02:01 - 00000594 _____ C:\Windows\system32\nv-vk64.json 2016-05-23 21:55 - 2016-05-23 21:55 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\744541C6.sys 2016-05-22 23:11 - 2016-05-22 23:11 - 00001121 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Clip Studio Paint.lnk 2016-05-22 23:11 - 2016-05-22 23:11 - 00000000 ____D C:\ProgramData\DeltaSearch 2016-05-22 23:11 - 2016-05-22 23:11 - 00000000 ____D C:\Program Files (x86)\Clip Studio Paint 2016-05-22 22:42 - 2016-05-22 22:42 - 00000000 ____D C:\Users\Rotita\AppData\Roaming\CELSYS 2016-05-22 22:41 - 2016-05-22 23:28 - 00000000 ____D C:\Users\Rotita\Documents\CELSYS_EN 2016-05-22 22:41 - 2016-05-22 22:41 - 00000000 ____D C:\Users\Rotita\AppData\Roaming\CELSYS_EN 2016-05-22 22:37 - 2016-05-22 22:37 - 00000000 ____D C:\ProgramData\CELSYS_EN 2016-05-22 21:41 - 2016-05-22 21:41 - 00000000 ____D C:\Users\Rotita\Documents\Toon Boom Harmony Premium Library 2016-05-22 21:36 - 2016-05-22 21:36 - 00000000 ____D C:\ProgramData\FNP 2016-05-22 21:26 - 2016-05-22 22:25 - 00000000 ____D C:\ProgramData\FLEXnet 2016-05-22 21:25 - 2016-05-22 22:19 - 00000000 ____D C:\Users\Rotita\AppData\Roaming\Toon Boom Animation 2016-05-22 21:25 - 2016-05-22 21:25 - 00000000 ____D C:\Program Files\Common Files\Macrovision Shared 2016-05-22 21:16 - 2016-05-22 21:35 - 00000000 ____D C:\Program Files (x86)\Toon Boom Animation 2016-05-22 21:16 - 2016-05-22 21:16 - 00000000 ____D C:\ProgramData\Toon Boom Animation 2016-05-22 21:14 - 2016-05-22 21:14 - 00000000 ____D C:\Windows\Downloaded Installations 2016-05-22 17:39 - 2016-05-22 17:39 - 00019576 _____ C:\Users\Rotita\Desktop\[kat.cr]the.lion.king.1994.1080p.dual.audio.español.latino.ingles.subs.torrent 2016-05-22 15:25 - 2016-05-22 15:25 - 00000000 ____D C:\Users\Public\Documents\Adobe 2016-05-22 15:19 - 2016-05-22 15:19 - 00001073 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Audition CC 2015.lnk 2016-05-21 01:17 - 2016-05-22 15:47 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2016-05-14 17:29 - 2016-05-14 17:29 - 00000000 ____D C:\Users\Rotita\AppData\Local\bunkus.org 2016-05-14 17:29 - 2016-05-14 17:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MKVToolNix 2016-05-14 17:29 - 2016-05-14 17:29 - 00000000 ____D C:\Program Files\MKVToolNix 2016-05-14 17:14 - 2016-05-14 17:14 - 00000000 ____D C:\Users\Rotita\AppData\Roaming\Wondershare 2016-05-14 17:12 - 2016-05-14 17:16 - 00000000 ____D C:\Users\Rotita\Documents\Wondershare Video Converter Ultimate 2016-05-14 17:12 - 2016-05-14 17:12 - 00000000 ____D C:\Users\Rotita\AppData\Roaming\{950EB46C-6AC7-4ACC-AB36-9A6A77C08B6A} 2016-05-14 17:11 - 2016-05-26 22:41 - 00000000 ____D C:\ProgramData\Wondershare Video Converter Ultimate 2016-05-14 17:11 - 2016-05-14 17:23 - 00000000 ____D C:\ProgramData\Wondershare 2016-05-14 17:11 - 2016-05-14 17:11 - 00000000 ____D C:\Users\Rotita\Documents\Wondershare MediaServer 2016-05-14 17:11 - 2016-05-14 17:11 - 00000000 ____D C:\Users\Rotita\AppData\Roaming\Wondershare Video Converter Ultimate 2016-05-14 17:11 - 2016-05-14 17:11 - 00000000 ____D C:\Users\Rotita\AppData\Local\Wondershare 2016-05-14 17:11 - 2015-02-27 14:38 - 00721263 _____ () C:\Windows\SysWOW64\WSCM64.dll 2016-05-14 17:11 - 2015-02-27 14:38 - 00214528 _____ () C:\Windows\SysWOW64\WSCM32.dll 2016-05-13 23:24 - 2016-05-09 23:07 - 01922496 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6436519.dll 2016-05-13 23:24 - 2016-05-09 23:07 - 01573432 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6436519.dll 2016-05-10 22:52 - 2016-04-23 12:08 - 00394960 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2016-05-10 22:52 - 2016-04-23 11:24 - 00346312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2016-05-10 22:52 - 2016-04-23 00:25 - 25816064 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2016-05-10 22:52 - 2016-04-23 00:16 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2016-05-10 22:52 - 2016-04-23 00:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2016-05-10 22:52 - 2016-04-23 00:01 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2016-05-10 22:52 - 2016-04-23 00:00 - 02893312 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2016-05-10 22:52 - 2016-04-23 00:00 - 00571904 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2016-05-10 22:52 - 2016-04-23 00:00 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2016-05-10 22:52 - 2016-04-23 00:00 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2016-05-10 22:52 - 2016-04-23 00:00 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2016-05-10 22:52 - 2016-04-22 23:52 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2016-05-10 22:52 - 2016-04-22 23:51 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2016-05-10 22:52 - 2016-04-22 23:48 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2016-05-10 22:52 - 2016-04-22 23:47 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2016-05-10 22:52 - 2016-04-22 23:47 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2016-05-10 22:52 - 2016-04-22 23:47 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2016-05-10 22:52 - 2016-04-22 23:47 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2016-05-10 22:52 - 2016-04-22 23:46 - 06052352 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2016-05-10 22:52 - 2016-04-22 23:40 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2016-05-10 22:52 - 2016-04-22 23:36 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2016-05-10 22:52 - 2016-04-22 23:29 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2016-05-10 22:52 - 2016-04-22 23:27 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll 2016-05-10 22:52 - 2016-04-22 23:25 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2016-05-10 22:52 - 2016-04-22 23:24 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2016-05-10 22:52 - 2016-04-22 23:21 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2016-05-10 22:52 - 2016-04-22 23:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2016-05-10 22:52 - 2016-04-22 23:20 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll 2016-05-10 22:52 - 2016-04-22 23:11 - 20350464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2016-05-10 22:52 - 2016-04-22 23:09 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2016-05-10 22:52 - 2016-04-22 23:08 - 00497152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2016-05-10 22:52 - 2016-04-22 23:08 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2016-05-10 22:52 - 2016-04-22 23:08 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2016-05-10 22:52 - 2016-04-22 23:07 - 00725504 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2016-05-10 22:52 - 2016-04-22 23:07 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec 2016-05-10 22:52 - 2016-04-22 23:07 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2016-05-10 22:52 - 2016-04-22 23:06 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2016-05-10 22:52 - 2016-04-22 23:06 - 00806400 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2016-05-10 22:52 - 2016-04-22 23:05 - 02131968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2016-05-10 22:52 - 2016-04-22 23:04 - 02285568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2016-05-10 22:52 - 2016-04-22 23:02 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2016-05-10 22:52 - 2016-04-22 23:01 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2016-05-10 22:52 - 2016-04-22 23:00 - 15415808 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2016-05-10 22:52 - 2016-04-22 22:59 - 00476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2016-05-10 22:52 - 2016-04-22 22:58 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2016-05-10 22:52 - 2016-04-22 22:58 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2016-05-10 22:52 - 2016-04-22 22:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2016-05-10 22:52 - 2016-04-22 22:51 - 02596864 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2016-05-10 22:52 - 2016-04-22 22:50 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2016-05-10 22:52 - 2016-04-22 22:45 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2016-05-10 22:52 - 2016-04-22 22:44 - 00091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll 2016-05-10 22:52 - 2016-04-22 22:43 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2016-05-10 22:52 - 2016-04-22 22:41 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2016-05-10 22:52 - 2016-04-22 22:40 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2016-05-10 22:52 - 2016-04-22 22:39 - 01547776 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2016-05-10 22:52 - 2016-04-22 22:39 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll 2016-05-10 22:52 - 2016-04-22 22:36 - 04611072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2016-05-10 22:52 - 2016-04-22 22:33 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll 2016-05-10 22:52 - 2016-04-22 22:31 - 00693248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2016-05-10 22:52 - 2016-04-22 22:30 - 02056192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2016-05-10 22:52 - 2016-04-22 22:30 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2016-05-10 22:52 - 2016-04-22 22:28 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2016-05-10 22:52 - 2016-04-22 22:26 - 13811200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2016-05-10 22:52 - 2016-04-22 22:12 - 02121216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2016-05-10 22:52 - 2016-04-22 22:09 - 01312256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2016-05-10 22:52 - 2016-04-22 22:07 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2016-05-10 22:52 - 2016-04-14 08:49 - 00603648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll 2016-05-10 22:52 - 2016-04-14 08:21 - 00647680 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll 2016-05-10 22:52 - 2016-04-09 02:02 - 00631176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi 2016-05-10 22:52 - 2016-04-09 02:01 - 05546216 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2016-05-10 22:52 - 2016-04-09 02:01 - 00986344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys 2016-05-10 22:52 - 2016-04-09 02:01 - 00706280 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi 2016-05-10 22:52 - 2016-04-09 02:01 - 00264936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys 2016-05-10 22:52 - 2016-04-09 02:01 - 00154344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2016-05-10 22:52 - 2016-04-09 02:01 - 00095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2016-05-10 22:52 - 2016-04-09 01:59 - 03998952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2016-05-10 22:52 - 2016-04-09 01:59 - 03943144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2016-05-10 22:52 - 2016-04-09 01:59 - 01732864 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2016-05-10 22:52 - 2016-04-09 01:58 - 01212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll 2016-05-10 22:52 - 2016-04-09 01:58 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll 2016-05-10 22:52 - 2016-04-09 01:58 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll 2016-05-10 22:52 - 2016-04-09 01:58 - 00344064 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2016-05-10 22:52 - 2016-04-09 01:58 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll 2016-05-10 22:52 - 2016-04-09 01:58 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll 2016-05-10 22:52 - 2016-04-09 01:58 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2016-05-10 22:52 - 2016-04-09 01:58 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll 2016-05-10 22:52 - 2016-04-09 01:58 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2016-05-10 22:52 - 2016-04-09 01:58 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2016-05-10 22:52 - 2016-04-09 01:58 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll 2016-05-10 22:52 - 2016-04-09 01:58 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll 2016-05-10 22:52 - 2016-04-09 01:58 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2016-05-10 22:52 - 2016-04-09 01:58 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2016-05-10 22:52 - 2016-04-09 01:58 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll 2016-05-10 22:52 - 2016-04-09 01:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 01464320 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 01314112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00730624 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00405504 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00316416 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00312832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00260608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00251392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 01:54 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2016-05-10 22:52 - 2016-04-09 00:52 - 00148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe 2016-05-10 22:52 - 2016-04-09 00:52 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys 2016-05-10 22:52 - 2016-04-09 00:52 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe 2016-05-10 22:52 - 2016-04-09 00:51 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe 2016-05-10 22:52 - 2016-04-09 00:49 - 03217408 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2016-05-10 22:52 - 2016-04-09 00:48 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe 2016-05-10 22:52 - 2016-04-09 00:47 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe 2016-05-10 22:52 - 2016-04-09 00:44 - 00291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys 2016-05-10 22:52 - 2016-04-09 00:44 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys 2016-05-10 22:52 - 2016-04-09 00:44 - 00129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys 2016-05-10 22:52 - 2016-04-09 00:43 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe 2016-05-10 22:52 - 2016-04-09 00:43 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2016-05-10 22:52 - 2016-04-09 00:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe 2016-05-10 22:52 - 2016-04-09 00:38 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe 2016-05-10 22:52 - 2016-04-09 00:38 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll 2016-05-10 22:52 - 2016-04-09 00:38 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe 2016-05-10 22:52 - 2016-04-09 00:38 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe 2016-05-10 22:52 - 2016-04-09 00:37 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll 2016-05-10 22:52 - 2016-04-09 00:37 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 00:37 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 00:37 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll 2016-05-10 22:52 - 2016-04-09 00:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll 2016-05-10 22:52 - 2016-04-08 23:20 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2016-05-10 22:52 - 2016-04-08 22:52 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2016-05-10 22:52 - 2016-04-06 10:27 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll 2016-05-10 21:33 - 2016-05-10 21:33 - 00053810 _____ C:\Users\Rotita\Desktop\[kat.cr]cars.workprint.2006.screener.avi.torrent 2016-05-10 21:31 - 2016-05-10 21:31 - 00052764 _____ C:\Users\Rotita\Desktop\[kat.cr]horton.hears.a.who.2008.workprint.french.xvid.ltt.torrent 2016-05-09 22:03 - 2016-05-11 19:20 - 00000000 ____D C:\Users\Rotita\AppData\Local\MinhaBox.br 2016-05-09 22:03 - 2016-05-11 18:46 - 00000000 ____D C:\Users\Rotita\.gstreamer-0.10 2016-05-08 20:53 - 2016-05-08 20:53 - 00000000 ____D C:\Users\Rotita\AppData\Roaming\cYo 2016-05-08 20:53 - 2016-05-08 20:53 - 00000000 ____D C:\Users\Rotita\AppData\Local\cYo 2016-05-08 20:53 - 2016-05-08 20:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ComicRack 2016-05-08 20:53 - 2016-05-08 20:53 - 00000000 ____D C:\Program Files\ComicRack 2016-05-06 19:38 - 2016-03-09 14:00 - 00444416 _____ (Microsoft Corporation) C:\Windows\system32\winhttp.dll 2016-05-06 19:38 - 2016-03-09 14:00 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\webio.dll 2016-05-06 19:38 - 2016-03-09 13:54 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll 2016-05-06 19:38 - 2016-03-09 13:40 - 00351744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winhttp.dll 2016-05-06 19:38 - 2016-03-09 13:40 - 00316416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webio.dll 2016-05-06 19:38 - 2016-03-09 13:34 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll 2016-05-06 19:23 - 2016-04-27 09:35 - 01924152 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6436510.dll 2016-05-06 19:23 - 2016-04-27 09:35 - 01571776 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6436510.dll 2016-05-06 19:20 - 2016-04-14 00:38 - 00113216 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll 2016-05-06 19:20 - 2016-04-14 00:38 - 00102976 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll 2016-05-06 19:20 - 2016-04-14 00:38 - 00056384 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2016-05-26 23:15 - 2015-09-26 22:56 - 00000000 ____D C:\Users\Rotita\AppData\Roaming\.purple 2016-05-26 23:01 - 2009-07-13 23:45 - 00022096 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2016-05-26 23:01 - 2009-07-13 23:45 - 00022096 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2016-05-26 22:59 - 2009-07-14 00:13 - 00781790 _____ C:\Windows\system32\PerfStringBackup.INI 2016-05-26 22:59 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\inf 2016-05-26 22:53 - 2015-09-04 21:58 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2016-05-26 22:53 - 2015-09-04 21:44 - 00000000 ____D C:\ProgramData\Kaspersky Lab 2016-05-26 22:53 - 2015-09-04 20:12 - 00000000 ____D C:\ProgramData\NVIDIA 2016-05-26 22:53 - 2015-09-04 19:53 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2016-05-26 22:53 - 2009-07-14 00:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2016-05-26 22:52 - 2015-10-09 22:23 - 00000000 ____D C:\Users\Rotita\AppData\Local\CrashDumps 2016-05-26 22:45 - 2015-10-26 20:13 - 00000000 ____D C:\ProgramData\Apple Computer 2016-05-26 22:41 - 2015-09-04 22:22 - 00000000 ____D C:\Users\Rotita\AppData\Roaming\uTorrent 2016-05-26 22:41 - 2015-09-04 21:24 - 00000000 ____D C:\Windows\Panther 2016-05-26 22:26 - 2015-11-13 19:25 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2016-05-26 22:23 - 2015-09-04 19:53 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2016-05-26 21:20 - 2015-09-05 18:45 - 00000000 ____D C:\Users\Rotita\AppData\Roaming\vlc 2016-05-26 21:09 - 2015-09-06 21:07 - 00000000 ____D C:\Program Files\PureRef 2016-05-26 21:00 - 2015-11-30 23:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MagicISO 2016-05-26 20:54 - 2015-09-04 18:30 - 00000000 ____D C:\Users\Rotita 2016-05-26 20:51 - 2015-10-13 22:44 - 00000000 ____D C:\Users\Rotita\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Hammer & Chisel, Inc 2016-05-26 20:47 - 2015-09-05 02:20 - 00000000 ____D C:\Program Files\Adobe 2016-05-26 19:17 - 2015-09-04 21:58 - 00140672 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys 2016-05-26 19:08 - 2015-09-06 16:59 - 02267136 _____ C:\Users\Rotita\AppData\Local\SageThumbs.db3 2016-05-26 18:36 - 2015-09-04 22:12 - 00000000 ____D C:\Users\Rotita\AppData\Local\Adobe 2016-05-26 18:29 - 2015-09-05 01:34 - 00000000 ___SD C:\Windows\SysWOW64\GWX 2016-05-26 18:29 - 2015-09-05 01:34 - 00000000 ___SD C:\Windows\system32\GWX 2016-05-24 23:53 - 2015-09-04 20:12 - 00000000 ____D C:\ProgramData\NVIDIA Corporation 2016-05-24 23:53 - 2015-09-04 20:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation 2016-05-24 23:53 - 2015-09-04 20:12 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation 2016-05-24 19:42 - 2015-09-04 21:44 - 00943536 _____ (AO Kaspersky Lab) C:\Windows\system32\Drivers\klif.sys 2016-05-24 19:42 - 2015-07-04 02:18 - 00237480 _____ (AO Kaspersky Lab) C:\Windows\system32\Drivers\klhk.sys 2016-05-24 19:42 - 2015-06-11 19:32 - 00049240 _____ (AO Kaspersky Lab) C:\Windows\system32\Drivers\klim6.sys 2016-05-24 19:25 - 2009-07-14 00:32 - 00000000 ____D C:\Windows\addins 2016-05-23 23:45 - 2015-09-04 21:39 - 00000000 ____D C:\ProgramData\Package Cache 2016-05-23 20:28 - 2015-09-05 01:55 - 00000000 ____D C:\Users\Rotita\AppData\Roaming\OBS 2016-05-22 23:10 - 2015-09-29 22:32 - 00000000 ____D C:\Users\Rotita\AppData\LocalLow\uTorrent 2016-05-22 23:09 - 2015-09-04 20:09 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information 2016-05-22 22:46 - 2015-09-04 20:57 - 00000000 ____D C:\Users\Rotita\AppData\Roaming\Skype 2016-05-22 22:25 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\registration 2016-05-22 15:47 - 2015-09-04 22:01 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2016-05-22 15:36 - 2015-10-23 19:41 - 00000000 ____D C:\Users\Rotita\Documents\Adobe 2016-05-22 15:19 - 2015-09-05 02:20 - 00000000 ____D C:\ProgramData\regid.1986-12.com.adobe 2016-05-22 15:19 - 2015-09-04 22:13 - 00000000 ____D C:\Users\Rotita\AppData\Roaming\Adobe 2016-05-22 14:29 - 2015-10-01 20:30 - 00000000 ____D C:\Users\Rotita\AppData\Roaming\dvdcss 2016-05-22 14:25 - 2016-04-24 17:45 - 00000000 ____D C:\Users\Rotita\AppData\Roaming\Audacity 2016-05-20 02:01 - 2015-11-13 19:32 - 03383448 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll 2016-05-20 02:01 - 2015-11-10 03:44 - 03825384 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll 2016-05-20 02:01 - 2015-09-04 20:11 - 14293592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll 2016-05-20 02:01 - 2015-09-04 20:11 - 00039124 _____ C:\Windows\system32\nvinfo.pb 2016-05-19 21:11 - 2015-12-23 01:20 - 00531904 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshext.dll 2016-05-19 21:11 - 2015-12-23 01:20 - 00083512 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshextr.dll 2016-05-19 21:11 - 2015-09-04 20:12 - 06346688 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll 2016-05-19 21:11 - 2015-09-04 20:12 - 02454976 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll 2016-05-19 21:11 - 2015-09-04 20:12 - 01762752 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll 2016-05-19 21:11 - 2015-09-04 20:12 - 01352760 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe 2016-05-19 21:11 - 2015-09-04 20:12 - 00393784 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll 2016-05-19 21:11 - 2015-09-04 20:12 - 00069568 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll 2016-05-18 18:25 - 2015-09-04 20:12 - 06448223 _____ C:\Windows\system32\nvcoproc.bin 2016-05-17 19:54 - 2015-11-03 20:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mailbird 2016-05-17 19:54 - 2015-11-03 20:32 - 00000000 ____D C:\Program Files (x86)\Mailbird 2016-05-17 19:54 - 2015-09-17 19:03 - 00000000 ____D C:\Users\Rotita\AppData\Roaming\Mailbird 2016-05-14 23:54 - 2015-09-25 23:20 - 00000132 _____ C:\Users\Rotita\AppData\Roaming\Adobe PNG Format CS6 Prefs 2016-05-14 20:21 - 2016-01-18 21:20 - 00000000 ____D C:\ProgramData\boost_interprocess 2016-05-14 13:11 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\rescache 2016-05-13 23:26 - 2016-03-11 02:12 - 00000000 ____D C:\Program Files (x86)\VulkanRT 2016-05-12 20:26 - 2015-11-13 19:25 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2016-05-12 20:26 - 2015-09-04 22:12 - 00797376 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2016-05-12 20:26 - 2015-09-04 22:12 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2016-05-12 19:25 - 2015-09-04 19:54 - 00002195 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk 2016-05-12 19:09 - 2015-12-11 22:49 - 00003848 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1449892155 2016-05-12 19:09 - 2015-12-11 22:49 - 00000000 ____D C:\Program Files (x86)\Opera 2016-05-11 23:58 - 2015-09-05 01:06 - 00000000 ____D C:\Windows\system32\appraiser 2016-05-11 23:57 - 2009-07-13 23:45 - 04987440 _____ C:\Windows\system32\FNTCACHE.DAT 2016-05-11 23:56 - 2011-04-12 03:28 - 00000000 ____D C:\Program Files\Windows Journal 2016-05-11 18:57 - 2015-09-04 23:27 - 00000000 ____D C:\Windows\system32\MRT 2016-05-11 18:49 - 2015-09-04 23:27 - 139319312 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2016-05-10 21:18 - 2015-09-04 19:53 - 00003894 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2016-05-10 21:18 - 2015-09-04 19:53 - 00003642 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2016-05-08 22:05 - 2016-04-23 21:23 - 00000000 ____D C:\Users\Rotita\Documents\Bulk Image Downloader 2016-05-06 19:20 - 2015-09-04 20:18 - 00000000 ____D C:\Users\Rotita\AppData\Local\NVIDIA 2016-05-02 00:39 - 2015-09-04 20:12 - 01377800 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll 2016-05-02 00:39 - 2015-09-04 20:12 - 01316184 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll 2016-05-02 00:38 - 2015-12-05 23:30 - 00112032 _____ C:\Windows\system32\NvRtmpStreamer64.dll 2016-05-02 00:38 - 2015-09-04 20:12 - 01767944 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll 2016-05-02 00:38 - 2015-09-04 20:12 - 01756608 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll 2016-05-01 19:50 - 2015-09-17 23:26 - 00000000 ___RD C:\Users\Rotita\OneDrive 2016-05-01 19:45 - 2015-09-17 23:26 - 00002125 _____ C:\Users\Rotita\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk ==================== Files in the root of some directories ======= 2015-09-11 22:06 - 2015-09-11 22:12 - 0000132 _____ () C:\Users\Rotita\AppData\Roaming\Adobe BMP Format CS6 Prefs 2015-09-25 23:20 - 2016-05-14 23:54 - 0000132 _____ () C:\Users\Rotita\AppData\Roaming\Adobe PNG Format CS6 Prefs 2016-05-26 21:12 - 2016-05-26 21:12 - 0000873 _____ () C:\Users\Rotita\AppData\Roaming\PureRef.ini 2016-04-12 21:01 - 2016-04-12 21:01 - 0001456 _____ () C:\Users\Rotita\AppData\Local\Adobe Save for Web 13.0 Prefs 2015-11-28 22:57 - 2015-11-28 22:57 - 0003584 _____ () C:\Users\Rotita\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2016-04-23 18:43 - 2016-04-23 18:43 - 0000817 _____ () C:\Users\Rotita\AppData\Local\recently-used.xbel 2015-09-06 16:59 - 2016-05-26 19:08 - 2267136 _____ () C:\Users\Rotita\AppData\Local\SageThumbs.db3 Some files in TEMP: ==================== C:\Users\Rotita\AppData\Local\Temp\ammemb.dll C:\Users\Rotita\AppData\Local\Temp\ammemb64.dll ==================== Bamital & volsnap ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\dnsapi.dll => File is digitally signed C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2016-05-21 03:00 ==================== End of FRST.txt ============================ Addition.txt
  3. starting yesterday, rundll32.exe has been running in the background and using between 10-25% of CPU I completed malwarebytes scan and nothing came up as a virus so I'm guessing its not from a virus I checked on Process Explorer and the command line for rundll32.exe running is "rundll32.exe msvcrt.dll,_sleep" From what I've read online, it seem that msvcrt.dll is corrupted I don't know how to fix it This is a win 2012 server (new) and has sql & IIS running on it. I had built one of these in a VM for testing and I do not have the same rundll32.exe msvcrt.dll,_sleep running in the VM- I think somehow an accidental click browsing infected something. Please help- I'd love to not have to re-install the OS
  4. Hello, I am a gamer and yesterday my ping was too high when i was playing online games. then i looked at the programs running behind and saw 2 rundll32 exes ( rundll32 *32 from directory C:\Windows\SysWOW64 and rundll32 from directory C:\Windows\System32) and they were using too much resource from ram. then i checked what is using my internet and saw rundll32 is trying to connect too many ip'es. i had only avira antivirus program and it didnt give me any reports about this problem. later i installed mbam and it began to block some of this ip'es but not all of them. here are some of this ip'es and frst.txt + addition.txt in attc. p 192.168.1.2:55218 54.77.207.254:80 rundll32.exe HTTP_C 976 1074 0 0 2m 29s high tcp 192.168.1.2:55227 54.77.207.254:443 rundll32.exe Unknown 1560 4875 0 0 2m 29s default tcp 192.168.1.2:55308 54.171.53.252:80 rundll32.exe HTTP_C 1100 1244 0 0 1m 11s high tcp 192.168.1.2:55250 185.29.133.242:9170 rundll32.exe HTTP_C 12324 3323 0 0 1m 28s high tcp 192.168.1.2:55248 173.193.255.240:80 rundll32.exe HTTP_C 4083 6104 0 0 1m 28s high tcp 192.168.1.2:55252 216.58.210.194:80 rundll32.exe HTTP_C 6851 4094 0 0 1m 28s high tcp 192.168.1.2:55284 216.58.210.194:80 rundll32.exe HTTP_C 680 769 0 0 1m 20s tcp 192.168.1.2:55198 216.58.210.193:443 chrome.exe Unknown 1229 4608 0 0 3m 34s default tcp 192.168.1.2:55278 54.76.84.191:80 rundll32.exe HTTP_C 724 929 0 0 1m 20s high tcp 192.168.1.2:55288 54.76.84.191:443 rundll32.exe Unknown 1400 4779 0 0 1m 19s default tcp 192.168.1.2:52548 64.233.167.188:5228 chrome.exe Unknown 3093 8156 0 0 32m 51s default tcp 192.168.1.2:55310 184.72.38.185:80 rundll32.exe HTTP_C 1490 1053 0 0 1m 8s high tcp 192.168.1.2:55271 23.50.148.174:80 rundll32.exe HTTP_C_BU 6353 50942 0 0 1m 21s low tcp 192.168.1.2:55273 23.50.148.174:80 rundll32.exe HTTP_C 3346 26263 0 0 1m 21s high tcp 192.168.1.2:55286 23.50.148.174:80 rundll32.exe HTTP_C 2983 296 0 0 1m 20s high tcp 192.168.1.2:55326 23.50.148.174:80 rundll32.exe HTTP_C_BU 25373 152K 0 0 29.031s low tcp 192.168.1.2:55327 23.50.148.174:80 rundll32.exe HTTP_C 16835 117K 0 0 28.704s high tcp 192.168.1.2:55329 23.50.148.174:80 rundll32.exe HTTP_C 10126 744 0 0 27.565s high tcp 192.168.1.2:55337 23.221.199.168:80 chrome.exe HTTP_C 620 396 0 0 20.982s tcp 192.168.1.2:55188 195.22.200.163:80 rundll32.exe HTTP_C 54826 108K 1789 571 4m 28s high tcp 192.168.1.2:55321 195.22.200.163:80 rundll32.exe HTTP_C 54852 46458 0 0 57.548s high tcp 192.168.1.2:55266 195.22.200.155:80 rundll32.exe HTTP_C_BU 14280 125K 0 0 1m 24s low tcp 192.168.1.2:55267 195.22.200.155:80 rundll32.exe HTTP_C_BU 19107 242K 0 0 1m 24s low tcp 192.168.1.2:55282 195.22.200.155:80 rundll32.exe HTTP_C 1557 1689 0 0 1m 20s high tcp 192.168.1.2:55249 23.21.75.138:80 rundll32.exe HTTP_C 28356 3852 0 0 1m 28s high tcp 192.168.1.2:55192 216.58.219.131:443 chrome.exe Unknown 1261 4970 0 0 3m 54s default tcp 192.168.1.2:55285 54.174.193.128:80 rundll32.exe HTTP_C 1165 1346 0 0 1m 20s high tcp 192.168.1.2:55233 23.50.146.116:80 rundll32.exe HTTP_C 786 703 0 0 2m 26s tcp 192.168.1.2:55235 23.50.146.116:80 rundll32.exe HTTP_C 581 775 0 0 2m 26s tcp 192.168.1.2:55357 37.252.170.113:80 rundll32.exe HTTP_C_BU 6321 6361 3954 3979 0.858s low tcp 192.168.1.2:55325 37.252.170.110:80 rundll32.exe HTTP_C_BU 5245 3896 0 0 29.531s low tcp 192.168.1.2:55220 23.50.149.109:80 rundll32.exe HTTP_C 5151 6738 0 0 2m 29s high tcp 192.168.1.2:55234 23.50.149.109:80 rundll32.exe HTTP_C 1192 1035 0 0 2m 26s tcp 192.168.1.2:55279 23.50.149.109:80 rundll32.exe HTTP_C 3768 5888 0 0 1m 20s high tcp 192.168.1.2:55295 23.50.149.109:80 rundll32.exe HTTP_C 2882 2488 0 0 1m 17s high tcp 192.168.1.2:55221 23.50.148.101:443 rundll32.exe Unknown 2202 32011 0 0 2m 29s default tcp 192.168.1.2:55280 23.50.148.101:443 rundll32.exe Unknown 2250 33923 0 0 1m 20s default tcp 192.168.1.2:55294 159.8.32.101:80 rundll32.exe HTTP_C 783 913 0 0 1m 17s high tcp 192.168.1.2:55251 159.8.37.100:80 rundll32.exe HTTP_C 1264 670 0 0 1m 28s high tcp 192.168.1.2:55247 162.13.61.90:80 rundll32.exe HTTP_C 5962 21884 0 0 1m 28s high tcp 192.168.1.2:55296 185.29.134.87:80 rundll32.exe HTTP_C 830 667 0 0 1m 17s tcp 192.168.1.2:55330 144.76.59.84:80 chrome.exe HTTP_C 864 1312 0 0 21.013s tcp 192.168.1.2:55246 54.76.70.81:80 rundll32.exe HTTP_C 5145 13250 0 0 1m 28s high Addition.txt FRST.txt
  5. So i'm 14, sure i have alot of crap on my computer, but i use my 2008 HP Elitebook 6930p to game, and normally dont have a problem! But whenever I open a game (Counter-Strike, CoD4, Path of Exile, Ect) A process named rundll32.exe (Located in C:\Windows\SysWOW64) Opens. I have patched my computer so therefor i have more "access" to it, therefor i can even change my theme to a custom theme, but i never had this problem. I also installed COMODO and Deleted Mcafee, thats when this problem started. Before all of this, i had a problem that would open PING.EXE and start causing ping issues, especially in games. after doing a rootkit scan and ect with no problems returned, the process just was gone like a snap of the finger! Now i have this problem, I use Windows 7, And things i always have open are: *Windows Media Player *A video game *TeamSpeak or Skype(NEVER Both) *and sometimes Chrome or Waterfox Ofcourse i may know decent about computers (Father is an IBM Architect, And has taught me many, aswell as let me learn Perl and Java, which i plan to use when me and my friend begin coding our 8-bit rpg ) But this hurts my head! I was thinking about uninstalling COMODO but i dont have any other anti-virus and my dad says i should use Mcafee (Which i know is a not-so-good anti-virus, because it didn't catch on what even i could notice >.< ) So if i could have some help (I dont really like it when an expert takes over my computer, i just feel unsafe about it, so i mean it can happen but other wise you can tell me what to do, I may know what to do if you can help ) That would be awesome! Thank you! -Penguin
  6. Hello, recently i've noticed that as time goes by rundll32.exe starts to gradually taking up a lot of my memory, it even took up 800k of my memory at one point. Usually just restarting fixes the problem but it starts to gradually get larger again. I also noticed that their were 2 of rundll32.exe in my task manager, one stays low while the other takes a lot of my memory. I've scanned with malwarebytes and avast yet nothing comes up as a virus or malware. I've looked around and havn't found a solution, if anyone could help it'd be greatly appreciated.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.