Robosaver 6.1 and other addons/extensions.

Eosomo · January 15, 2014

Unable to remove a few ads/extensions with chrome. Obviously it is probably going to infect more than just the browser. Have run malwarebytes software and it still remains.

Attaching dds logs . Thank you.

dds.txt

attach.txt

MrCharlie · January 15, 2014

Welcome to the forum.

Please download and run RogueKiller 32 Bit to your desktop.

RogueKiller 64 Bit <---use this one for 64 bit systems

Which system am I using?

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

(please don't put logs in code or quotes and use the default font)

General P2P/Piracy Warning:

1. If you're using Peer 2 Peer software such uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
2. If you have illegal/cracked software, cracks, keygens, custom (Adobe) host file, etc. on the system, please remove or uninstall them now and read the policy on Piracy.
Failure to remove such software will result in your topic being closed and no further assistance being provided.

MrC

Note:

Please read all of my instructions completely including these.

Make sure system restore is turned on and running, please create a new restore point

Make sure you're subscribed to this topic: Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly

Removing malware can be unpredictable...unlikely but things can go very wrong! Backup any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive

<+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

<+>The removal of malware isn't instantaneous, please be patient.

<+>When we are done, I'll give to instructions on how to cleanup all the tools and logs

<+>Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that.

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 24 hours, please send me a PM)

Eosomo · January 15, 2014

RogueKiller V8.8.1 _x64_ [Jan 14 2014] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.adlice.com/forum/

Website : http://www.adlice.com/softwares/roguekiller/

Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : Joseph [Admin rights]

Mode : Scan -- Date : 01/14/2014 19:25:12

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 4 ¤¤¤

[HJ DESK][PUM] HKCU\[...]\ClassicStartMenu : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK][PUM] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

[HJ DESK][PUM] HKCU\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK][PUM] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Browser Addons : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> %SystemRoot%\System32\drivers\etc\hosts

ÿþ1

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) ST9750422AS +++++

--- User ---

[MBR] 5f721613b0692286a334127041edf2b5

[bSP] 786dd205d656b53cee9ac6a08e0e84e0 : Windows 7/8 MBR Code

Partition table:

0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 715402 Mo

User = LL1 ... OK!

User = LL2 ... OK!

+++++ PhysicalDrive1: (\\.\PHYSICALDRIVE1 @ IDE) INTEL SSDSC2CW240A3 +++++

--- User ---

[MBR] 8063e882528ef69c64747b0225a44264

[bSP] b164f63e5d43c7fa8061e0adc9f07613 : Windows 7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 200 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 411648 | Size: 228734 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[0]_S_01142014_192512.txt >>

RKreport[0]_S_01142014_173740.txt

MrCharlie · January 15, 2014

Lets start with this:

Lets clean out any adware/spyware now: (this will require a reboot so save all your work)

Please download AdwCleaner by Xplode and save to your Desktop.

Make sure you click on download buttons that look similar to this, not "sponsored ad links":

Double click on AdwCleaner.exe to run the tool.
Vista/Windows 7/8 users right-click and select Run As Administrator
Click on the Scan button.
AdwCleaner will begin...be patient as the scan may take some time to complete.
When it's done you'll see: Pending: Please uncheck elements you don't want removed.
Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
Look over the log especially under Files/Folders for any program you want to save.
If there's a program you may want to save, just uncheck it from AdwCleaner.
If you're not sure, post the log for review. (all items found are adware/spyware/foistware)
If you're ready to clean it all up.....click the Clean button.
After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
Copy and paste the contents of that logfile in your next reply.
A copy of that logfile will also be saved in the C:\AdwCleaner folder.
Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
To restore an item that has been deleted:
Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.

Then..................

Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a FULL Scan with Malwarebytes Anti-Malware, post the report.

Make sure that everything is checked, and click Remove Selected.

Please let me know how computer is running now, MrC

Eosomo · January 15, 2014

# AdwCleaner v3.017 - Report created 15/01/2014 at 13:12:06

# Updated 12/01/2014 by Xplode

# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

# Username : Joseph - GOONIE

# Running from : C:\Users\Joseph\Downloads\AdwCleaner.exe

# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.16428

-\\ Google Chrome v31.0.1650.63

[ File : C:\Users\Joseph\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************

AdwCleaner[R0].txt - [4366 octets] - [14/01/2014 15:17:36]

AdwCleaner[R1].txt - [887 octets] - [14/01/2014 16:49:18]

AdwCleaner[R2].txt - [1001 octets] - [14/01/2014 16:51:18]

AdwCleaner[R3].txt - [1122 octets] - [15/01/2014 13:08:00]

AdwCleaner[R4].txt - [1182 octets] - [15/01/2014 13:09:01]

AdwCleaner[R5].txt - [1242 octets] - [15/01/2014 13:11:49]

AdwCleaner[s0].txt - [3793 octets] - [14/01/2014 15:19:12]

AdwCleaner[s1].txt - [947 octets] - [14/01/2014 16:50:06]

AdwCleaner[s2].txt - [1062 octets] - [14/01/2014 16:52:15]

AdwCleaner[s3].txt - [1164 octets] - [15/01/2014 13:12:06]

########## EOF - C:\AdwCleaner\AdwCleaner[s3].txt - [1224 octets] ##########

MrCharlie · January 15, 2014

Why didn't you say you already ran this, want else have you run?

MrC

Eosomo · January 15, 2014

I ran these programs prior to posting on the forum so some of the logs may be lacking in showing their progress. Current status shows Robosaver still in the extensions list of Chrome. Though malwarebytes will fight the advertisement bar at the bottom of the screen and say it's blocking a certain IP address simultaneously, it's still infected.

MrCharlie · January 15, 2014

Please download Farbar Recovery Scan Tool and save it to a folder. (use correct version for your system.....Which system am I using?)

Please make sure you click download buttons that look similar to this, not "sponsored ad links":

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

If the logs are large, you can attach them:

To attach a log:

Bottom right corner of this page.

New window that comes up.

MrC

Eosomo · January 15, 2014

I've ran JRT, OTL, TDSSKiller, RogueKiller, FRST64, DDS

Eosomo · January 15, 2014

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-01-2014 01

Ran by Joseph (administrator) on GOONIE on 15-01-2014 13:26:35

Running from C:\Users\Joseph\Downloads

Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)

Internet Explorer Version 11

Boot Mode: Normal

The only official download link for FRST:

Download link for 32-Bit version:

Download link for 64-Bit Version:

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe

(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

() C:\Windows\SysWOW64\PnkBstrA.exe

() C:\Program Files (x86)\Hotkey\PowerBiosServer.exe

(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe

(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Bison Inc.) C:\Program Files (x86)\BisonCam\PID_0361\DeLay.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe

(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe

(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

() C:\Program Files (x86)\Hotkey\Hotkey.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

(Creative Technology Ltd) C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe

(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe

(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe

(cyberlink) C:\Program Files (x86)\CyberLink\Shared files\brs.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe

(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe

(Intel® Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MpCmdRun.exe

(Farbar) C:\Users\Joseph\Downloads\FRST64 (1).exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13374568 2011-12-13] (Realtek Semiconductor)

HKLM\...\Run: [synTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2328360 2010-09-16] (Synaptics Incorporated)

HKLM\...\Run: [THXCfg64] - C:\Windows\system32\THXCfg64.dll [25600 2010-09-14] (Creative Technology Ltd.)

HKLM\...\Run: [DeLay] - C:\Program Files (x86)\BisonCam\PID_0361\DeLay.exe [53248 2008-12-05] (Bison Inc.)

HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1266912 2013-10-23] (Microsoft Corporation)

HKLM\...\Run: [intelliType Pro] - C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [1464944 2012-11-02] (Microsoft Corporation)

HKLM\...\Run: [intelliPoint] - C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2076272 2012-11-02] (Microsoft Corporation)

HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-08] (NVIDIA Corporation)

HKLM\...\Run: [shadowPlay] - C:\Windows\system32\nvspcap64.dll [1100248 2013-12-09] (NVIDIA Corporation)

HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-09] (NVIDIA Corporation)

HKLM-x32\...\Run: [iAStorIcon] - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)

HKLM-x32\...\Run: [THX Audio Control Panel] - C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe [1374720 2010-11-01] (Creative Technology Ltd)

HKLM-x32\...\Run: [updReg] - C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)

HKLM-x32\...\Run: [uSB3MON] - C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-01-26] (Intel Corporation)

HKLM-x32\...\Run: [CLMLServer] - c:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [107816 2010-08-20] (CyberLink)

HKLM-x32\...\Run: [RemoteControl10] - c:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [87336 2010-02-02] (CyberLink Corp.)

HKLM-x32\...\Run: [bDRegion] - c:\Program Files (x86)\Cyberlink\Shared files\brs.exe [75048 2010-11-11] (cyberlink)

HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe

HKCU\...\Run: [] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

MountPoints2: {d8c405f9-719f-11e2-8e72-0090f5ccfbc0} - F:\Install.exe

AppInit_DLLs: C:\Windows\system32\nvinitx.dll [168616 2013-12-19] (NVIDIA Corporation)

AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [141336 2013-12-19] (NVIDIA Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xE7B0BA2FD3FDCE01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/

SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://searchab.com/?aff=7&uid=024a3010-719f-11e2-8454-0090f5ccfbc0&q={searchTerms}

BHO: No Name - {5511208F-050E-D564-498E-1ECA6BD5E128} - No File

BHO-x32: No Name - {5511208F-050E-D564-498E-1ECA6BD5E128} - No File

BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)

Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 205.171.2.65

Chrome:

=======

CHR Extension: (Google Wallet) - C:\Users\Joseph\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0 [2013-12-18]

CHR HKCU\...\Chrome\Extension: [lipgolpfajiadodbcbljdpmbmbdmfcil] - C:\Users\Joseph\AppData\Local\CRE\lipgolpfajiadodbcbljdpmbmbdmfcil.crx [2013-12-18]

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

S2 CLKMSVC10_38F51D56; c:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [241648 2010-11-12] (CyberLink)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [161560 2012-01-20] (Intel Corporation)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-10-23] (Microsoft Corporation)

S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-02-08] ()

R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [348376 2013-10-23] (Microsoft Corporation)

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-09] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-09] (NVIDIA Corporation)

R2 nvsvc; C:\Windows\SysWOW64\nvvsvc.exe [0 2014-01-02] ()

R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2012-04-24] ()

R2 PowerBiosServer; c:\Program Files (x86)\Hotkey\PowerBiosServer.exe [35328 2011-02-18] ()

R2 Spooler; C:\Windows\SysWOW64\spoolsv.exe [0 2014-01-02] ()

R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3386608 2013-02-08] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [248240 2013-09-27] (Microsoft Corporation)

R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [134944 2013-09-27] (Microsoft Corporation)

R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)

S3 SaiU0CFA; C:\Windows\System32\DRIVERS\SaiU0CFA.sys [41352 2010-07-21] (Saitek)

S3 smserial; C:\Windows\System32\DRIVERS\SmSerl64.sys [1227776 2009-06-10] (Motorola Inc.)

S3 GPU-Z; \??\C:\Users\Joseph\AppData\Local\Temp\GPU-Z.sys [x]

S3 WinRing0_1_2_0; \??\C:\Users\Joseph\Downloads\RealTemp_370\WinRing0x64.sys [x]

S3 X6va015; \??\C:\Windows\SysWOW64\Drivers\X6va015 [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-01-15 13:25 - 2014-01-15 13:25 - 02076160 _____ (Farbar) C:\Users\Joseph\Downloads\FRST64 (1).exe

2014-01-15 02:19 - 2014-01-15 02:19 - 00000000 ____D C:\Windows\SysWOW64\NV

2014-01-15 02:19 - 2014-01-15 02:19 - 00000000 ____D C:\Windows\system32\NV

2014-01-15 02:18 - 2013-12-19 12:33 - 30372640 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll

2014-01-15 02:18 - 2013-12-19 12:33 - 25257248 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll

2014-01-15 02:18 - 2013-12-19 12:33 - 22960416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll

2014-01-15 02:18 - 2013-12-19 12:33 - 18310112 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll

2014-01-15 02:18 - 2013-12-19 12:33 - 18222008 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll

2014-01-15 02:18 - 2013-12-19 12:33 - 17560352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll

2014-01-15 02:18 - 2013-12-19 12:33 - 15877216 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll

2014-01-15 02:18 - 2013-12-19 12:33 - 15230352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll

2014-01-15 02:18 - 2013-12-19 12:33 - 12645664 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys

2014-01-15 02:18 - 2013-12-19 12:33 - 11605752 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll

2014-01-15 02:18 - 2013-12-19 12:33 - 11554264 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll

2014-01-15 02:18 - 2013-12-19 12:33 - 09700224 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll

2014-01-15 02:18 - 2013-12-19 12:33 - 09657464 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll

2014-01-15 02:18 - 2013-12-19 12:33 - 03132704 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll

2014-01-15 02:18 - 2013-12-19 12:33 - 03125024 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll

2014-01-15 02:18 - 2013-12-19 12:33 - 02947872 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll

2014-01-15 02:18 - 2013-12-19 12:33 - 02747680 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll

2014-01-15 02:18 - 2013-12-19 12:33 - 01884448 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433221.dll

2014-01-15 02:18 - 2013-12-19 12:33 - 01511712 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433221.dll

2014-01-15 02:18 - 2013-12-19 12:33 - 01242400 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll

2014-01-15 02:18 - 2013-12-19 12:33 - 00882464 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll

2014-01-15 02:18 - 2013-12-19 12:33 - 00879392 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll

2014-01-15 02:18 - 2013-12-19 12:33 - 00852768 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll

2014-01-15 02:18 - 2013-12-19 12:33 - 00847648 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll

2014-01-15 02:18 - 2013-12-19 12:33 - 00317472 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll

2014-01-15 02:18 - 2013-12-19 12:33 - 00266984 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll

2014-01-15 02:18 - 2013-12-19 12:33 - 00168616 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll

2014-01-15 02:18 - 2013-12-19 12:33 - 00141336 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll

2014-01-15 02:18 - 2013-12-19 12:33 - 00032544 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvpciflt.sys

2014-01-14 19:25 - 2014-01-14 19:25 - 00002098 _____ C:\Users\Joseph\Desktop\RKreport[0]_S_01142014_192512.txt

2014-01-14 19:23 - 2014-01-14 19:23 - 04406272 _____ C:\Users\Joseph\Downloads\RogueKillerX64 (4).exe

2014-01-14 18:14 - 2014-01-14 18:14 - 00020545 _____ C:\Users\Joseph\Downloads\dds.txt

2014-01-14 18:13 - 2014-01-14 18:13 - 00007436 _____ C:\Users\Joseph\Downloads\attach.txt

2014-01-14 18:13 - 2014-01-14 18:13 - 00007436 _____ C:\Users\Joseph\Downloads\attach (1).txt

2014-01-14 18:06 - 2014-01-14 18:06 - 00688992 ____R (Swearware) C:\Users\Joseph\Downloads\dds.scr

2014-01-14 18:06 - 2014-01-14 18:06 - 00020545 _____ C:\Users\Joseph\Desktop\dds.txt

2014-01-14 18:06 - 2014-01-14 18:06 - 00007436 _____ C:\Users\Joseph\Desktop\attach.txt

2014-01-14 17:39 - 2014-01-14 17:40 - 04121952 _____ (Kaspersky Lab ZAO) C:\Users\Joseph\Downloads\tdsskiller.exe

2014-01-14 17:37 - 2014-01-14 17:37 - 00002416 _____ C:\Users\Joseph\Desktop\RKreport[0]_S_01142014_173740.txt

2014-01-14 17:32 - 2014-01-14 17:38 - 00000000 ____D C:\Users\Joseph\Desktop\RK_Quarantine

2014-01-14 16:48 - 2014-01-14 16:48 - 01236282 _____ C:\Users\Joseph\Downloads\AdwCleaner (1).exe

2014-01-14 16:30 - 2014-01-14 16:30 - 00000000 ____D C:\_OTL

2014-01-14 16:24 - 2014-01-14 16:29 - 00112996 _____ C:\Users\Joseph\Downloads\OTL.Txt

2014-01-14 16:24 - 2014-01-14 16:24 - 00104140 _____ C:\Users\Joseph\Downloads\Extras.Txt

2014-01-14 16:21 - 2014-01-14 16:21 - 00602112 _____ (OldTimer Tools) C:\Users\Joseph\Downloads\OTL.exe

2014-01-14 16:20 - 2014-01-14 16:20 - 00000781 _____ C:\Users\Joseph\Desktop\JRT.txt

2014-01-14 16:15 - 2014-01-14 16:15 - 01037068 _____ (Thisisu) C:\Users\Joseph\Downloads\JRT (1).exe

2014-01-14 16:14 - 2014-01-15 13:26 - 00012812 _____ C:\Users\Joseph\Downloads\FRST.txt

2014-01-14 16:14 - 2014-01-14 16:15 - 00024687 _____ C:\Users\Joseph\Downloads\Addition.txt

2014-01-14 16:14 - 2014-01-14 16:14 - 02076160 _____ (Farbar) C:\Users\Joseph\Downloads\FRST64.exe

2014-01-14 16:14 - 2014-01-14 16:14 - 00000000 ____D C:\FRST

2014-01-14 15:23 - 2014-01-14 15:23 - 00000000 ____D C:\Users\Joseph\AppData\Roaming\Malwarebytes

2014-01-14 15:22 - 2014-01-14 15:22 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Joseph\Downloads\mbam-setup-1.75.0.1300.exe

2014-01-14 15:22 - 2014-01-14 15:22 - 00001120 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-01-14 15:22 - 2014-01-14 15:22 - 00000000 ____D C:\ProgramData\Malwarebytes

2014-01-14 15:22 - 2014-01-14 15:22 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-01-14 15:22 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-01-14 15:17 - 2014-01-15 13:12 - 00000000 ____D C:\AdwCleaner

2014-01-14 15:17 - 2014-01-14 15:17 - 00000000 ____D C:\Windows\ERUNT

2014-01-14 15:16 - 2014-01-14 15:16 - 01236282 _____ C:\Users\Joseph\Downloads\AdwCleaner.exe

2014-01-14 15:16 - 2014-01-14 15:16 - 01037068 _____ (Thisisu) C:\Users\Joseph\Downloads\JRT.exe

2014-01-14 13:06 - 2014-01-14 13:06 - 00001175 _____ C:\Users\Public\Desktop\Camtasia Studio 8.lnk

2014-01-12 22:22 - 2013-12-20 14:49 - 00098304 _____ C:\Windows\Lavish.dll

2014-01-09 11:24 - 2014-01-14 16:09 - 00000000 ____D C:\Program Files (x86)\VideoPlayerV3

2014-01-05 10:09 - 2014-01-05 10:09 - 00062927 _____ C:\Users\Joseph\Downloads\Loot Settings.ini

2014-01-04 12:21 - 2014-01-04 12:21 - 00000000 ____D C:\Users\Joseph\AppData\Roaming\Oracle

2014-01-04 12:18 - 2014-01-04 12:18 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-01-04 12:18 - 2014-01-04 12:18 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-01-04 12:18 - 2014-01-04 12:18 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-01-04 12:18 - 2014-01-04 12:18 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-01-04 12:18 - 2014-01-04 12:18 - 00000000 ____D C:\Program Files (x86)\Java

2014-01-04 12:16 - 2014-01-04 12:16 - 00915368 _____ (Oracle Corporation) C:\Users\Joseph\Downloads\chromeinstall-7u45 (3).exe

2014-01-04 12:15 - 2014-01-04 12:15 - 00915368 _____ (Oracle Corporation) C:\Users\Joseph\Downloads\chromeinstall-7u45 (2).exe

2014-01-04 12:12 - 2014-01-04 12:12 - 00000000 ____D C:\Program Files (x86)\SaveraExTensioun

2014-01-04 06:26 - 2014-01-04 06:26 - 00000015 _____ C:\Users\Joseph\Desktop\Graphics reset.txt

2014-01-04 04:43 - 2014-01-04 04:43 - 00000000 ____D C:\ProgramData\regid.1995-08.com.techsmith

2014-01-04 04:43 - 2014-01-04 04:43 - 00000000 ____D C:\Program Files (x86)\TechSmith

2014-01-04 04:43 - 2014-01-04 04:43 - 00000000 ____D C:\Program Files (x86)\QuickTime

2014-01-04 04:41 - 2014-01-04 04:41 - 255479656 _____ C:\Users\Joseph\Downloads\camtasia.exe

2014-01-02 20:54 - 2014-01-02 20:54 - 00737017 _____ C:\Users\Joseph\AppData\Local\census.cache

2014-01-02 20:54 - 2014-01-02 20:54 - 00082115 _____ C:\Users\Joseph\AppData\Local\ars.cache

2014-01-02 20:43 - 2014-01-02 20:43 - 00000000 _____ C:\Windows\SysWOW64\WUDFHost.exe

2014-01-02 20:43 - 2014-01-02 20:43 - 00000000 _____ C:\Windows\SysWOW64\winlogon.exe

2014-01-02 20:43 - 2014-01-02 20:43 - 00000000 _____ C:\Windows\SysWOW64\taskhost.exe

2014-01-02 20:43 - 2014-01-02 20:43 - 00000000 _____ C:\Windows\SysWOW64\spoolsv.exe

2014-01-02 20:43 - 2014-01-02 20:43 - 00000000 _____ C:\Windows\SysWOW64\smss.exe

2014-01-02 20:43 - 2014-01-02 20:43 - 00000000 _____ C:\Windows\SysWOW64\services.exe

2014-01-02 20:43 - 2014-01-02 20:43 - 00000000 _____ C:\Windows\SysWOW64\nvvsvc.exe

2014-01-02 20:43 - 2014-01-02 20:43 - 00000000 _____ C:\Windows\SysWOW64\lsm.exe

2014-01-02 20:43 - 2014-01-02 20:43 - 00000000 _____ C:\Windows\SysWOW64\lsass.exe

2014-01-02 20:43 - 2014-01-02 20:43 - 00000000 _____ C:\Windows\SysWOW64\igfxpers.exe

2014-01-02 20:43 - 2014-01-02 20:43 - 00000000 _____ C:\Windows\SysWOW64\hkcmd.exe

2014-01-02 20:43 - 2014-01-02 20:43 - 00000000 _____ C:\Windows\SysWOW64\dwm.exe

2014-01-02 20:43 - 2014-01-02 20:43 - 00000000 _____ C:\Windows\SysWOW64\csrss.exe

2014-01-02 20:43 - 2014-01-02 20:43 - 00000000 _____ C:\Windows\SysWOW64\conhost.exe

2014-01-02 20:35 - 2014-01-02 20:35 - 02049128 _____ (Trend Micro Inc.) C:\Users\Joseph\Downloads\HousecallLauncher.exe

2014-01-02 20:35 - 2014-01-02 20:35 - 00000036 _____ C:\Users\Joseph\AppData\Local\housecall.guid.cache

2013-12-30 15:00 - 2014-01-14 16:09 - 00000000 ____D C:\ProgramData\RoboSaver

2013-12-30 15:00 - 2014-01-05 02:26 - 00000000 ____D C:\ProgramData\SaveraExTensioun

2013-12-30 15:00 - 2014-01-04 12:12 - 00000000 ____D C:\ProgramData\97876a884d7d3416

2013-12-30 15:00 - 2013-12-30 15:00 - 00000000 ____D C:\ProgramData\nhkdjgiongcgfhedhbglbbhjbajkkkoo

2013-12-30 06:23 - 2014-01-01 04:56 - 00000000 ____D C:\ProgramData\Content Accelerator

2013-12-29 08:40 - 2013-12-29 08:40 - 00297280 _____ C:\Windows\Minidump\122913-19546-01.dmp

2013-12-25 21:40 - 2013-12-25 21:40 - 00000930 _____ C:\Users\Joseph\Desktop\EverQuest - Neenjapoke.lnk

2013-12-25 21:40 - 2013-12-25 21:40 - 00000922 _____ C:\Users\Joseph\Desktop\EverQuest - Bonkaroo.lnk

2013-12-25 21:40 - 2013-12-25 21:40 - 00000918 _____ C:\Users\Joseph\Desktop\EverQuest - Stubble.lnk

2013-12-25 21:40 - 2013-12-25 21:40 - 00000914 _____ C:\Users\Joseph\Desktop\EverQuest - Portly.lnk

2013-12-25 21:40 - 2013-12-25 21:40 - 00000910 _____ C:\Users\Joseph\Desktop\EverQuest - Pudgy.lnk

2013-12-25 21:40 - 2013-12-25 21:40 - 00000910 _____ C:\Users\Joseph\Desktop\EverQuest - Bonks.lnk

2013-12-25 21:39 - 2013-12-25 21:39 - 00000914 _____ C:\Users\Joseph\Desktop\EverQuest - Upshot.lnk

2013-12-20 16:48 - 2013-12-20 16:48 - 00001091 _____ C:\Users\Joseph\Downloads\PEQTGC-Stryd (1).ini

2013-12-20 16:38 - 2013-12-20 16:48 - 00000000 ____D C:\Users\Joseph\Desktop\EQINIS

2013-12-20 16:38 - 2013-12-20 16:38 - 00001821 _____ C:\Users\Joseph\Downloads\PEQTGC-Maddix.ini

2013-12-20 16:38 - 2013-12-20 16:38 - 00001513 _____ C:\Users\Joseph\Downloads\PEQTGC-Jazzem.ini

2013-12-20 16:38 - 2013-12-20 16:38 - 00001328 _____ C:\Users\Joseph\Downloads\PEQTGC-Khazad.ini

2013-12-20 16:38 - 2013-12-20 16:38 - 00000715 _____ C:\Users\Joseph\Downloads\PEQTGC-Rucus.ini

2013-12-20 16:38 - 2013-12-20 16:38 - 00000696 _____ C:\Users\Joseph\Downloads\PEQTGC-Striking.ini

2013-12-20 13:53 - 2013-12-20 13:53 - 00000000 ____D C:\Users\Joseph\AppData\Local\cache

2013-12-20 13:53 - 2013-12-20 13:53 - 00000000 ____D C:\Users\Joseph\.android

2013-12-20 13:53 - 2013-12-20 13:53 - 00000000 _____ C:\Users\Joseph\daemonprocess.txt

2013-12-20 13:52 - 2013-12-20 15:10 - 00000000 ____D C:\Program Files (x86)\WinEQ2

2013-12-20 13:52 - 2013-12-20 13:52 - 00000990 _____ C:\Users\Joseph\Desktop\WinEQ 2.0.lnk

2013-12-20 13:51 - 2013-12-20 13:51 - 00923784 _____ (CNET Download.com) C:\Users\Joseph\Downloads\cbsidlm-cbsi145-WinEQ-SEO-10526904.exe

2013-12-20 13:06 - 2013-12-20 13:06 - 00000000 ____D C:\Users\Joseph\AppData\Roaming\Mozilla

2013-12-20 11:59 - 2013-12-20 11:59 - 78936289 _____ C:\Users\Joseph\Downloads\UF_missing_files.rar

2013-12-20 11:58 - 2013-12-20 12:17 - 2161365751 _____ C:\Users\Joseph\Downloads\UF.zip

2013-12-19 16:48 - 2013-12-19 16:48 - 00153216 _____ (Amônétízé Ltd) C:\Users\Joseph\Downloads\everquest underfoot client__3515_i201775776_il11981137.exe

2013-12-19 16:47 - 2013-12-19 16:47 - 00327232 _____ C:\Users\Joseph\Downloads\EverQuest_Underfoot_Client.exe

2013-12-19 16:42 - 2013-12-19 16:42 - 00153216 _____ (Amônétízé Ltd) C:\Users\Joseph\Downloads\everquest underfoot client__3516_i201770421_il11980222.exe

2013-12-19 14:39 - 2013-12-19 14:39 - 00000663 _____ C:\Users\Joseph\Desktop\eqbcs - Shortcut.lnk

2013-12-19 14:37 - 2013-12-19 14:37 - 00001128 _____ C:\Users\Joseph\Desktop\MacroQuest2 - Shortcut.lnk

2013-12-19 14:29 - 2013-12-19 14:29 - 00154357 _____ C:\Users\Joseph\Downloads\e3 v5.1.4.zip

2013-12-19 14:29 - 2013-12-19 14:29 - 00010078 _____ C:\Users\Joseph\Downloads\Hot Fixes (r4).zip

2013-12-19 14:28 - 2013-12-19 14:29 - 10430528 _____ C:\Users\Joseph\Downloads\Killians' MacroQuest2.zip

2013-12-18 00:29 - 2013-12-18 00:29 - 00000000 ____D C:\Windows\SysWOW64\modules

2013-12-18 00:29 - 2013-12-18 00:29 - 00000000 ____D C:\Windows\SysWOW64\js

2013-12-18 00:29 - 2013-12-18 00:29 - 00000000 ____D C:\Windows\SysWOW64\images

2013-12-18 00:29 - 2013-12-18 00:29 - 00000000 ____D C:\Windows\SysWOW64\html

2013-12-18 00:29 - 2013-12-18 00:29 - 00000000 ____D C:\Windows\SysWOW64\css

2013-12-17 22:12 - 2013-12-05 00:42 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys

2013-12-17 22:12 - 2013-12-05 00:42 - 00032544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll

==================== One Month Modified Files and Folders =======

2014-01-15 13:26 - 2014-01-14 16:14 - 00012812 _____ C:\Users\Joseph\Downloads\FRST.txt

2014-01-15 13:25 - 2014-01-15 13:25 - 02076160 _____ (Farbar) C:\Users\Joseph\Downloads\FRST64 (1).exe

2014-01-15 13:24 - 2012-04-17 11:53 - 01344647 _____ C:\Windows\WindowsUpdate.log

2014-01-15 13:19 - 2009-07-13 20:45 - 00015152 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-01-15 13:19 - 2009-07-13 20:45 - 00015152 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-01-15 13:17 - 2009-07-13 21:13 - 00006450 _____ C:\Windows\system32\PerfStringBackup.INI

2014-01-15 13:12 - 2014-01-14 15:17 - 00000000 ____D C:\AdwCleaner

2014-01-15 13:12 - 2013-06-30 20:53 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-01-15 13:12 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2014-01-15 13:12 - 2009-07-13 20:51 - 00098582 _____ C:\Windows\setupact.log

2014-01-15 12:57 - 2013-06-30 20:53 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-01-15 12:48 - 2012-09-04 16:50 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-01-15 02:19 - 2014-01-15 02:19 - 00000000 ____D C:\Windows\SysWOW64\NV

2014-01-15 02:19 - 2014-01-15 02:19 - 00000000 ____D C:\Windows\system32\NV

2014-01-15 02:19 - 2012-04-17 11:50 - 00000000 ____D C:\ProgramData\NVIDIA