Jump to content

Help! Virus trouble


Recommended Posts

I have made two previous topics, but this is the final one considering I believe I' have done everything correctly for my FRST logs to be as accurate as possible. I guess I also could've ran them in safe mode, but I will let you be the judge. I had a popup this morning, and now my disk space is ramped up to 60-99% while I cannot find my usual browser which is opera. Don't know, I'm using an admin account right now but whenever I search 'opera' in explorer nothing pops up for the application.

Addition.txt

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 14-05-2017
Ran by Neeko (16-05-2017 20:31:15)
Running from C:\Users\Neeko\Desktop
Windows 10 Home Version 1703 (X64) (2017-04-21 23:17:14)
Boot Mode: Normal
==========================================================

==================== Accounts: =============================
Administrator (S-1-5-21-166261395-844033189-1565394352-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-166261395-844033189-1565394352-503 - Limited - Disabled)
Guest (S-1-5-21-166261395-844033189-1565394352-501 - Limited - Disabled)
Neeko (S-1-5-21-166261395-844033189-1565394352-1001 - Administrator - Enabled) => C:\Users\Neeko
Rick 0 (S-1-5-21-166261395-844033189-1565394352-1002 - Limited - Enabled) => C:\Users\Rick 0
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 16.04 (x64) (HKLM\...\7-Zip) (Version: 16.04 - Igor Pavlov)
Adobe Flash Player 11 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 11.1.102.55 - Adobe Systems Incorporated)
Adobe Flash Player 25 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 25.0.0.171 - Adobe Systems Incorporated)
Ansel (Version: 377.19 - NVIDIA Corporation) Hidden
Apple Application Support (32-bit) (HKLM-x32\...\{05E07D23-91E9-4E70-A4CC-EF505088F967}) (Version: 5.4.1 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{741291DA-2B34-4D44-8FB6-58EDE21261D8}) (Version: 5.4.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{DB18F1C0-846F-46F5-A074-5B97C8AF5C8E}) (Version: 10.3.1.2 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{52D87F32-70E4-4348-8148-C0B9F35B1314}) (Version: 2.3.0.177 - Apple Inc.)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Chivalry: Medieval Warfare (HKLM\...\Steam App 219640) (Version:  - Torn Banner Studios)
Counter-Strike: Source (HKLM\...\Steam App 240) (Version:  - Valve)
Intel(R) Chipset Device Software (x32 Version: 10.1.1.42 - Intel(R) Corporation) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.4549 - Intel Corporation)
iTunes (HKLM\...\{6C01A0A7-7440-4D48-93C6-2927A1E93FE6}) (Version: 12.6.0.100 - Apple Inc.)
Killing Floor (HKLM\...\Steam App 1250) (Version:  - Tripwire Interactive)
League of Legends (HKLM-x32\...\League of Legends 4.1.2) (Version: 4.1.2 - Riot Games)
League of Legends (x32 Version: 4.1.2 - Riot Games) Hidden
Mass Effect 2 (HKLM-x32\...\{75D84EF7-0D8C-4e70-B3FA-7B42A5D4E0EB}) (Version: 1.00 - Electronic Arts, Inc.)
MCShield ::Anti-Malware Tool:: (HKLM-x32\...\MCShield) (Version: 3.0.5.28 - MyCity)
Microsoft OneDrive (HKU\S-1-5-21-166261395-844033189-1565394352-1001\...\OneDriveSetup.exe) (Version: 17.3.6816.0313 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Nexus Mod Manager (HKLM\...\6af12c54-643b-4752-87d0-8335503010de_is1) (Version: 0.63.14 - Black Tree Gaming)
No More Room in Hell (HKLM\...\Steam App 224260) (Version:  - No More Room in Hell Team)
NVIDIA Graphics Driver 377.19 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 377.19 - NVIDIA Corporation)
NVIDIA PhysX (HKLM-x32\...\{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}) (Version: 9.09.0814 - NVIDIA Corporation)
Origin (HKLM-x32\...\Origin) (Version: 10.4.9.38188 - Electronic Arts, Inc.)
POSTAL 2 (HKLM\...\Steam App 223470) (Version:  - Running With Scissors)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7730 - Realtek Semiconductor Corp.)
RogueKiller version 12.10.5.0 (HKLM\...\8B3D7924-ED89-486B-8322-E8594065D5CB_is1) (Version: 12.10.5.0 - Adlice Software)
Saints Row: The Third (HKLM\...\Steam App 55230) (Version:  - Volition)
Sophos Virus Removal Tool (HKLM-x32\...\{B829E117-D072-41EA-9606-9826A38D34C1}) (Version: 2.5.6 - Sophos Limited)
STAR WARS™ Jedi Knight: Jedi Academy™ (HKLM\...\Steam App 6020) (Version:  - Raven Software)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Synaptics ClickPad Driver (HKLM\...\SynTPDeinstKey) (Version: 19.2.4.10 - Synaptics Incorporated)
The Elder Scrolls V: Skyrim (HKLM\...\Steam App 72850) (Version:  - Bethesda Game Studios)
Total War: SHOGUN 2 (HKLM\...\Steam App 34330) (Version:  - The Creative Assembly)
Unchecky v1.0.2 (HKLM-x32\...\Unchecky) (Version: 1.0.2 - RaMMicHaeL)
Vulkan Run Time Libraries 1.0.26.0 (HKLM\...\VulkanRT1.0.26.0) (Version: 1.0.26.0 - LunarG, Inc.)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {0FCC449D-7FB4-4395-AF03-5A06FBBD088F} - System32\Tasks\Opera scheduled Autoupdate 1492938726 => C:\Users\Rick 0\AppData\Local\Programs\Opera\launcher.exe [2017-04-11] (Opera Software)
Task: {C2A36005-B47E-45D3-8EB5-B167E47CC5AE} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_25_0_0_171_pepper.exe [2017-05-09] (Adobe Systems Incorporated)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
==================== Loaded Modules (Whitelisted) ==============
2017-03-16 16:08 - 2017-03-16 16:08 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2017-03-16 16:08 - 2017-03-16 16:08 - 01354040 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2017-04-22 11:09 - 2017-03-29 12:20 - 00133056 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2017-03-18 13:58 - 2017-03-18 13:58 - 00138000 _____ () C:\Windows\SYSTEM32\inputhost.dll
2017-03-18 13:59 - 2017-03-18 19:31 - 01731072 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-03-27 12:20 - 2017-03-27 12:20 - 00092472 _____ () C:\Program Files\iTunes\zlib1.dll
2017-03-27 12:20 - 2017-03-27 12:20 - 01354040 _____ () C:\Program Files\iTunes\libxml2.dll
2017-05-02 18:53 - 2017-05-02 18:52 - 02493440 _____ () C:\Program Files (x86)\Origin\libGLESv2.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2017-03-18 14:03 - 2017-05-10 00:17 - 00002024 _____ C:\Windows\system32\Drivers\etc\hosts
0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomaly
0.0.0.0 tracking.opencandy.com.s3.amazonaws.com
0.0.0.0 media.opencandy.com
0.0.0.0 cdn.opencandy.com
0.0.0.0 tracking.opencandy.com
0.0.0.0 api.opencandy.com
0.0.0.0 api.recommendedsw.com
0.0.0.0 installer.betterinstaller.com
0.0.0.0 installer.filebulldog.com
0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net
0.0.0.0 inno.bisrv.com
0.0.0.0 nsis.bisrv.com
0.0.0.0 cdn.file2desktop.com
0.0.0.0 cdn.goateastcach.us
0.0.0.0 cdn.guttastatdk.us
0.0.0.0 cdn.inskinmedia.com
0.0.0.0 cdn.insta.oibundles2.com
0.0.0.0 cdn.insta.playbryte.com
0.0.0.0 cdn.llogetfastcach.us
0.0.0.0 cdn.montiera.com
0.0.0.0 cdn.msdwnld.com
0.0.0.0 cdn.mypcbackup.com
0.0.0.0 cdn.ppdownload.com
0.0.0.0 cdn.riceateastcach.us
0.0.0.0 cdn.shyapotato.us
0.0.0.0 cdn.solimba.com
0.0.0.0 cdn.tuto4pc.com
0.0.0.0 cdn.appround.biz
0.0.0.0 cdn.bigspeedpro.com
0.0.0.0 cdn.bispd.com
There are 4 more lines.

==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-166261395-844033189-1565394352-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\Windows\img0.jpg
DNS Servers: 66.253.214.16 - 50.30.184.16
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==

==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{3C00E47E-854D-4D8B-A007-3A70ECF35823}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{7A9CE419-C4A6-428F-AE60-AC45929012AE}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{FE3F1B7F-7047-4430-A5CB-71E4493B86FB}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{8E239960-A4CC-4421-A5BD-09A255400A4F}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{635F5ECE-2183-4967-B139-97EBBF83F47E}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{BFD5C38A-6823-4F25-BA40-238731852BE4}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{35FEEAC4-46A2-4410-9BE9-F005CEEA97CE}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{B057F416-53A6-4C6F-8C21-C88420942318}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{90D614FB-523B-4851-AFEA-6FC18F06EC25}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{5D238DCD-CFF8-45DD-AE88-21C33C3CD67F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{7FE60437-9651-4408-94F8-EA18ADB97E29}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{68229938-B1CF-4D61-9C9E-FFD538720F47}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Total War SHOGUN 2\Shogun2.exe
FirewallRules: [{6C669914-FFF6-4E4B-99A2-73A6B84F95D9}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Total War SHOGUN 2\Shogun2.exe
FirewallRules: [{BFBEAF80-45D6-44A8-9F20-58268BE312EE}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\KillingFloor\System\KillingFloor.exe
FirewallRules: [{E56D00C1-E7F4-45DF-8AB9-59A927F2A88E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\KillingFloor\System\KillingFloor.exe
FirewallRules: [{3742DBA0-3DE4-4B63-B472-D1F5ED252790}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\chivalrymedievalwarfare\Binaries\Win64\CMW.exe
FirewallRules: [{FDA96598-BE4F-4926-A337-C41D33F2766C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\chivalrymedievalwarfare\Binaries\Win64\CMW.exe
FirewallRules: [{9C86BCE6-DB0F-413A-B41D-246A5D14621B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\chivalrymedievalwarfare\Binaries\Win32\CMW.exe
FirewallRules: [{41518BCE-A1D1-483E-8E98-7CEA964E26CF}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\chivalrymedievalwarfare\Binaries\Win32\CMW.exe
FirewallRules: [{49F84B8A-C598-4767-8BCE-E0ACF0B1C2F8}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\chivalrymedievalwarfare\ChivLauncher.exe
FirewallRules: [{DDE1C744-CFF9-4179-A653-F5CF4CC5143A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\chivalrymedievalwarfare\ChivLauncher.exe
FirewallRules: [{7743C2DE-6170-4469-89EF-8201582C6306}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Source\hl2.exe
FirewallRules: [{7F2DF85E-F47D-4A42-A8D6-3BE1631798CE}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Source\hl2.exe
FirewallRules: [{EDC6298A-6F43-4C82-873E-0F23B26F7C16}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\nmrih\sdk\hl2.exe
FirewallRules: [{C057B7F8-667E-4084-A1DB-FB302CB33836}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\nmrih\sdk\hl2.exe
FirewallRules: [{66D0F362-AB4C-42C4-9301-C4F34A2A590A}] => (Allow) C:\Program Files (x86)\Mass Effect 2\Binaries\MassEffect2.exe
FirewallRules: [{B2A87300-6B0D-4A3A-8428-179FA0194906}] => (Allow) C:\Program Files (x86)\Mass Effect 2\Binaries\MassEffect2.exe
FirewallRules: [{989952DC-B4D2-4276-AAB7-FE2FF3B6566C}] => (Allow) C:\Program Files (x86)\Mass Effect 2\MassEffect2Launcher.exe
FirewallRules: [{986BCF36-29D9-4324-A3E8-2DF1055B5739}] => (Allow) C:\Program Files (x86)\Mass Effect 2\MassEffect2Launcher.exe
FirewallRules: [{1A832F3A-4119-427A-96EF-39E60058CF5C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Saints Row the Third\game_launcher.exe
FirewallRules: [{B3617500-8D69-4439-9DD9-881D849E985C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Saints Row the Third\game_launcher.exe
FirewallRules: [{6F39D994-F999-443B-8F91-A82A0B20C2D8}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Saints Row the Third\SaintsRowTheThird.exe
FirewallRules: [{45DD0183-B4E4-481E-A986-70C301EFA98B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Saints Row the Third\SaintsRowTheThird.exe
FirewallRules: [{C70BDE2F-DFB8-426D-A99A-2B3D28D9DDAF}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Saints Row the Third\SaintsRowTheThird_DX11.exe
FirewallRules: [{D6ACBCE9-BA01-461B-A9D6-4B1E7A9AC37C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Saints Row the Third\SaintsRowTheThird_DX11.exe
FirewallRules: [{5BC1DAEA-7F31-4CDB-8828-3D8EC64504AF}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\POSTAL2Complete\System\Postal2.exe
FirewallRules: [{59C73002-71DE-446D-9CFB-E4B108374686}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\POSTAL2Complete\System\Postal2.exe
FirewallRules: [{8F694C0F-273B-484C-9A38-BB0FE4C73CC1}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\POSTAL2Complete\ShareThePain\System\Postal2MP.exe
FirewallRules: [{32C57E0E-5F4D-43DC-9B71-42D45C2B51B2}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\POSTAL2Complete\ShareThePain\System\Postal2MP.exe
FirewallRules: [{DE36195A-5144-4221-A79B-7715DFBEA64F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Jedi Academy\GameData\jasp.exe
FirewallRules: [{51C7DDE8-F514-43A3-86DB-21282164F264}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Jedi Academy\GameData\jasp.exe
FirewallRules: [{4D47512C-C415-40E1-A8C5-835D03A9D044}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Jedi Academy\GameData\jamp.exe
FirewallRules: [{4A10CDCB-29B0-49A1-B1A6-CA3ABEBEB6D6}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Jedi Academy\GameData\jamp.exe
==================== Restore Points =========================

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================
Application errors:
==================
Error: (05/16/2017 11:27:30 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: opera_autoupdate.exe, version: 44.0.2510.1218, time stamp: 0x58ed11a0
Faulting module name: opera_autoupdate.exe, version: 44.0.2510.1218, time stamp: 0x58ed11a0
Exception code: 0xc0000005
Fault offset: 0x000000000034be04
Faulting process id: 0x1e38
Faulting application start time: 0x01d2ce7210c725b8
Faulting application path: C:\Users\Rick 0\AppData\Local\Programs\Opera\44.0.2510.1218\opera_autoupdate.exe
Faulting module path: C:\Users\Rick 0\AppData\Local\Programs\Opera\44.0.2510.1218\opera_autoupdate.exe
Report Id: e91b724a-46d4-4888-b0d7-67a66ed01f04
Faulting package full name:
Faulting package-relative application ID:
Error: (05/16/2017 10:32:25 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1203
Error: (05/16/2017 10:32:25 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1203
Error: (05/16/2017 10:32:25 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (05/15/2017 06:45:52 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-M7IRLC6)
Description: Activation of app Microsoft.Windows.Photos_8wekyb3d8bbwe!App failed with error: -2147023170 See the Microsoft-Windows-TWinUI/Operational log for additional information.
Error: (05/15/2017 04:54:58 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: opera_autoupdate.exe, version: 44.0.2510.1218, time stamp: 0x58ed11a0
Faulting module name: ntdll.dll, version: 10.0.15063.0, time stamp: 0xb79b6ddb
Exception code: 0xc0000374
Fault offset: 0x00000000000f775f
Faulting process id: 0x970
Faulting application start time: 0x01d2cdd6a46aba8d
Faulting application path: C:\Users\Rick 0\AppData\Local\Programs\Opera\44.0.2510.1218\opera_autoupdate.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 425a16ad-664e-42c4-ad79-c3d87a93c7ce
Faulting package full name:
Faulting package-relative application ID:
Error: (05/14/2017 03:56:34 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: Shogun2.exe, version: 1.1.0.0, time stamp: 0x507716b8
Faulting module name: ntdll.dll, version: 10.0.15063.0, time stamp: 0xa82cc161
Exception code: 0xc0000374
Fault offset: 0x000d9a8a
Faulting process id: 0x874
Faulting application start time: 0x01d2cc689b890a35
Faulting application path: C:\Program Files (x86)\Steam\steamapps\common\Total War SHOGUN 2\Shogun2.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: c8bf7418-e3d7-4aea-b53c-0b25880dc8f1
Faulting package full name:
Faulting package-relative application ID:
Error: (05/14/2017 12:50:56 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 636953
Error: (05/14/2017 12:50:56 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 636953
Error: (05/14/2017 12:50:56 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

System errors:
=============
Error: (05/16/2017 08:28:52 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (05/16/2017 08:28:22 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (05/16/2017 08:27:39 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (05/16/2017 08:27:39 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (05/16/2017 08:25:36 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (05/16/2017 08:25:15 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (05/16/2017 08:25:15 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (05/16/2017 04:12:15 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (05/16/2017 01:44:51 PM) (Source: volsnap) (EventID: 36) (User: )
Description: The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.
Error: (05/16/2017 11:29:08 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

CodeIntegrity:
===================================
  Date: 2017-05-16 20:31:08.202
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
  Date: 2017-05-16 20:31:08.195
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
  Date: 2017-05-16 12:40:48.841
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
  Date: 2017-05-16 12:40:48.835
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
  Date: 2017-05-16 11:54:09.663
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
  Date: 2017-05-16 11:54:09.657
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
  Date: 2017-05-16 11:29:26.060
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
  Date: 2017-05-16 11:29:26.057
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
  Date: 2017-05-16 11:29:26.055
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
  Date: 2017-05-16 11:29:26.052
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-5500U CPU @ 2.40GHz
Percentage of memory in use: 23%
Total physical RAM: 8107.39 MB
Available physical RAM: 6238.9 MB
Total Virtual: 9387.39 MB
Available Virtual: 7456.61 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:930.96 GB) (Free:541.23 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 06A3DEBE)
Partition: GPT.
==================== End of Addition.txt ============================
 
FRST.txt
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 14-05-2017
Ran by Neeko (administrator) on DESKTOP-M7IRLC6 (16-05-2017 20:29:19)
Running from C:\Users\Neeko\Desktop
Loaded Profiles: Neeko (Available Profiles: Neeko & Rick 0)
Platform: Windows 10 Home Version 1703 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Edge)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(HP) C:\Windows\System32\hpservice.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
(Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel Corporation) C:\Windows\System32\Intel\DPTF\esif_uf.exe
(Synaptics Incorporated) C:\Windows\System32\valWBFPolicyService.exe
(RaMMicHaeL) C:\Program Files (x86)\Unchecky\bin\unchecky_svc.exe
(Electronic Arts) C:\Program Files (x86)\Origin\OriginWebHelperService.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(Intel Corporation) C:\Windows\Temp\DPTF\esif_assist_64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(RaMMicHaeL) C:\Program Files (x86)\Unchecky\bin\unchecky_bg.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(MyCity) C:\Program Files (x86)\MCShield\MCShieldRTM.exe
(Microsoft Corporation) C:\Windows\System32\Taskmgr.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.15063.0_none_1a733a82001933cc\TiWorker.exe
==================== Registry (Whitelisted) ====================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [629152 2017-03-18] (Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8843520 2016-01-28] (Realtek Semiconductor)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [303928 2017-03-22] (Apple Inc.)
HKU\S-1-5-21-166261395-844033189-1565394352-1001\...\Run: [MCShield Monitor] => C:\Program Files (x86)\MCShield\MCShieldRTM.exe [650816 2014-04-11] (MyCity)
HKU\S-1-5-21-166261395-844033189-1565394352-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3019552 2017-04-25] (Valve Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 66.253.214.16 50.30.184.16
Tcpip\..\Interfaces\{4b71d5e5-183c-42bf-abcf-210136008644}: [DhcpNameServer] 66.253.214.16 50.30.184.16
Tcpip\..\Interfaces\{9a33da33-3bcb-4a80-b5e2-687e90d240a5}: [DhcpNameServer] 66.253.214.16 50.30.184.16
Internet Explorer:
==================
FireFox:
========
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll [2017-04-28] ()
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2017-03-17] (Apple Inc.)
R2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2286848 2015-10-01] (Broadcom Corporation.)
R2 esifsvc; C:\Windows\system32\Intel\DPTF\esif_uf.exe [2219072 2016-10-25] (Intel Corporation)
R2 hpsrv; C:\Windows\system32\Hpservice.exe [38728 2016-10-12] (HP)
R2 igfxCUIService2.0.0.0; C:\Windows\system32\igfxCUIService.exe [373720 2017-01-13] (Intel Corporation)
R2 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [458176 2017-03-29] (NVIDIA Corporation)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2147216 2017-05-02] (Electronic Arts)
R2 Origin Web Helper Service; C:\Program Files (x86)\Origin\OriginWebHelperService.exe [3116440 2017-05-02] (Electronic Arts)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [310016 2016-01-28] (Realtek Semiconductor)
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [269400 2016-10-05] (Synaptics Incorporated)
R2 Unchecky; C:\Program Files (x86)\Unchecky\bin\unchecky_svc.exe [304408 2017-04-22] (RaMMicHaeL)
R2 valWBFPolicyService; C:\Windows\system32\valWBFPolicyService.exe [100384 2016-03-09] (Synaptics Incorporated)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [342264 2017-03-18] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [102816 2017-03-18] (Microsoft Corporation)
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 Accelerometer; C:\Windows\system32\DRIVERS\Accelerometer.sys [56128 2016-10-12] (HP)
R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [177440 2016-01-27] (Broadcom Corporation.)
R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [7585280 2017-03-18] (Broadcom Corporation)
R3 dptf_acpi; C:\Windows\System32\drivers\dptf_acpi.sys [72592 2016-10-25] (Intel Corporation)
R3 dptf_cpu; C:\Windows\System32\drivers\dptf_cpu.sys [67984 2016-10-25] (Intel Corporation)
R3 esif_lf; C:\Windows\system32\DRIVERS\esif_lf.sys [355216 2016-10-25] (Intel Corporation)
R0 hpdskflt; C:\Windows\System32\DRIVERS\hpdskflt.sys [42312 2016-10-12] (HP)
R3 nvlddmkm; C:\Windows\System32\DriverStore\FileRepository\nvhm.inf_amd64_0460fff687def1f0\nvlddmkm.sys [14378544 2017-04-11] (NVIDIA Corporation)
R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [604160 2017-03-18] (Realtek                                            )
S3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [760968 2017-02-23] (Realsil Semiconductor Corporation)
S3 SDFRd; C:\Windows\System32\drivers\SDFRd.sys [31128 2017-03-18] ()
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [79960 2016-10-05] (Synaptics Incorporated)
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44632 2017-03-18] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [294816 2017-03-18] (Microsoft Corporation)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [121248 2017-03-18] (Microsoft Corporation)
R3 WirelessButtonDriver64; C:\Windows\system32\DRIVERS\WirelessButtonDriver64.sys [31656 2016-04-13] (HP)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-05-16 20:29 - 2017-05-16 20:30 - 00008310 _____ C:\Users\Neeko\Desktop\FRST.txt
2017-05-16 16:01 - 2017-05-16 16:01 - 00000000 ____D C:\Users\Neeko\Desktop\FRST-OlderVersion
2017-05-16 11:30 - 2017-05-16 11:30 - 00000000 ____D C:\Users\Neeko\AppData\Local\Steam
2017-05-16 11:30 - 2017-05-16 11:30 - 00000000 ____D C:\Users\Neeko\AppData\Local\CEF
2017-05-15 16:57 - 2017-05-15 16:57 - 00634989 _____ C:\Users\Rick 0\Downloads\pathe and other film industry history the decline of euro film.pdf
2017-05-14 17:20 - 2017-05-14 17:20 - 03068415 _____ C:\Users\Rick 0\Downloads\Stam, The Structuring Absences of Silent Cinema.pdf
2017-05-14 17:20 - 2017-05-14 17:20 - 02090697 _____ C:\Users\Rick 0\Downloads\Stewart, We Were Never Immigrants.pdf
2017-05-14 17:18 - 2017-05-14 17:18 - 06436284 _____ C:\Users\Rick 0\Downloads\Abel French Film Industry.pdf
2017-05-14 17:18 - 2017-05-14 17:18 - 05206731 _____ C:\Users\Rick 0\Downloads\Abel, The French Rooster Rules the Roost.pdf
2017-05-14 17:12 - 2017-05-14 17:12 - 00593102 _____ C:\Users\Rick 0\Downloads\Film History I FSP 17 (1).pdf
2017-05-14 17:04 - 2017-05-14 17:04 - 00593102 _____ C:\Users\Rick 0\Downloads\Film History I FSP 17.pdf
2017-05-14 17:03 - 2017-05-14 17:03 - 04341528 _____ C:\Users\Rick 0\Downloads\Pathé.pptx
2017-05-13 14:13 - 2017-05-13 14:13 - 00646089 _____ C:\Users\Rick 0\Downloads\Abelson_Night and Day.pdf
2017-05-11 20:31 - 2017-05-11 20:33 - 00000000 ____D C:\Users\Rick 0\Downloads\ps 205
2017-05-11 12:57 - 2017-05-11 20:33 - 00000000 ____D C:\Users\Rick 0\Downloads\film 381
2017-05-10 12:08 - 2017-05-15 18:07 - 00000000 ____D C:\Users\Rick 0\Documents\Sound recordings
2017-05-09 22:52 - 2017-04-27 18:38 - 01411128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32full.dll
2017-05-09 22:52 - 2017-04-27 18:12 - 01604312 _____ (Microsoft Corporation) C:\Windows\system32\gdi32full.dll
2017-05-09 22:52 - 2017-04-27 18:12 - 00543640 _____ (Microsoft Corporation) C:\Windows\system32\securekernel.exe
2017-05-09 22:52 - 2017-04-27 18:11 - 02158544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2017-05-09 22:52 - 2017-04-27 18:08 - 08320920 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2017-05-09 22:52 - 2017-04-27 18:07 - 06759512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Media.Protection.PlayReady.dll
2017-05-09 22:52 - 2017-04-27 18:03 - 00667040 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2017-05-09 22:52 - 2017-04-27 18:00 - 02444192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2017-05-09 22:52 - 2017-04-27 17:59 - 02635336 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2017-05-09 22:52 - 2017-04-27 17:59 - 00388000 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBXHCI.SYS
2017-05-09 22:52 - 2017-04-27 17:56 - 07904784 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.Protection.PlayReady.dll
2017-05-09 22:52 - 2017-04-27 17:52 - 02957824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32kfull.sys
2017-05-09 22:52 - 2017-04-27 17:51 - 20505600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\edgehtml.dll
2017-05-09 22:52 - 2017-04-27 17:46 - 19335168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2017-05-09 22:52 - 2017-04-27 17:46 - 00329728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webplatstorageserver.dll
2017-05-09 22:52 - 2017-04-27 17:44 - 00338432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2017-05-09 22:52 - 2017-04-27 17:44 - 00266240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2017-05-09 22:52 - 2017-04-27 17:42 - 00806400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\StoreAgent.dll
2017-05-09 22:52 - 2017-04-27 17:42 - 00663040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2017-05-09 22:52 - 2017-04-27 17:42 - 00636416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WpcWebFilter.dll
2017-05-09 22:52 - 2017-04-27 17:42 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InstallAgentUserBroker.exe
2017-05-09 22:52 - 2017-04-27 17:40 - 11870208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2017-05-09 22:52 - 2017-04-27 17:40 - 06292992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Chakra.dll
2017-05-09 22:52 - 2017-04-27 17:40 - 02008576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2017-05-09 22:52 - 2017-04-27 17:40 - 00328704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InstallAgent.exe
2017-05-09 22:52 - 2017-04-27 17:39 - 05225984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2017-05-09 22:52 - 2017-04-27 17:39 - 02859520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2017-05-09 22:52 - 2017-04-27 17:38 - 03667456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_47.dll
2017-05-09 22:52 - 2017-04-27 17:38 - 01019904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aadtb.dll
2017-05-09 22:52 - 2017-04-27 17:37 - 04559360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbgeng.dll
2017-05-09 22:52 - 2017-04-27 17:37 - 01626624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2017-05-09 22:52 - 2017-04-27 17:26 - 23677440 _____ (Microsoft Corporation) C:\Windows\system32\edgehtml.dll
2017-05-09 22:52 - 2017-04-27 17:15 - 03672064 _____ (Microsoft Corporation) C:\Windows\system32\win32kfull.sys
2017-05-09 22:52 - 2017-04-27 17:11 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\BasicRender.sys
2017-05-09 22:52 - 2017-04-27 17:08 - 00457728 _____ (Microsoft Corporation) C:\Windows\system32\webplatstorageserver.dll
2017-05-09 22:52 - 2017-04-27 17:08 - 00096256 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2017-05-09 22:52 - 2017-04-27 17:06 - 00386560 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2017-05-09 22:52 - 2017-04-27 17:06 - 00274944 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2017-05-09 22:52 - 2017-04-27 17:05 - 01075712 _____ (Microsoft Corporation) C:\Windows\system32\StoreAgent.dll
2017-05-09 22:52 - 2017-04-27 17:05 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2017-05-09 22:52 - 2017-04-27 17:04 - 23681024 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2017-05-09 22:52 - 2017-04-27 17:04 - 00422400 _____ (Microsoft Corporation) C:\Windows\system32\WpAXHolder.dll
2017-05-09 22:52 - 2017-04-27 17:04 - 00416256 _____ (Microsoft Corporation) C:\Windows\system32\InstallAgentUserBroker.exe
2017-05-09 22:52 - 2017-04-27 17:03 - 00925696 _____ (Microsoft Corporation) C:\Windows\system32\WpcWebFilter.dll
2017-05-09 22:52 - 2017-04-27 17:03 - 00751104 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2017-05-09 22:52 - 2017-04-27 17:01 - 02077184 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2017-05-09 22:52 - 2017-04-27 17:00 - 08244736 _____ (Microsoft Corporation) C:\Windows\system32\Chakra.dll
2017-05-09 22:52 - 2017-04-27 16:59 - 04396032 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_47.dll
2017-05-09 22:52 - 2017-04-27 16:59 - 03307008 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2017-05-09 22:52 - 2017-04-27 16:59 - 02056192 _____ (Microsoft Corporation) C:\Windows\system32\win32kbase.sys
2017-05-09 22:52 - 2017-04-27 16:59 - 01293824 _____ (Microsoft Corporation) C:\Windows\system32\aadtb.dll
2017-05-09 22:52 - 2017-04-27 16:59 - 00373760 _____ (Microsoft Corporation) C:\Windows\system32\InstallAgent.exe
2017-05-09 22:52 - 2017-04-27 16:58 - 12787200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2017-05-09 22:52 - 2017-04-27 16:57 - 05557760 _____ (Microsoft Corporation) C:\Windows\system32\dbgeng.dll
2017-05-09 22:52 - 2017-04-27 16:57 - 01803264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2017-05-09 22:51 - 2017-04-27 18:19 - 01839872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2017-05-09 22:51 - 2017-04-27 18:19 - 00605936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2017-05-09 22:51 - 2017-04-27 18:18 - 02259760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CoreUIComponents.dll
2017-05-09 22:51 - 2017-04-27 18:16 - 00599576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2017-05-09 22:51 - 2017-04-27 18:09 - 01557288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2017-05-09 22:51 - 2017-04-27 18:08 - 02399728 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2017-05-09 22:51 - 2017-04-27 18:08 - 02330520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\combase.dll
2017-05-09 22:51 - 2017-04-27 18:08 - 00775824 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2017-05-09 22:51 - 2017-04-27 18:07 - 00988168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2017-05-09 22:51 - 2017-04-27 18:06 - 02969880 _____ (Microsoft Corporation) C:\Windows\system32\CoreUIComponents.dll
2017-05-09 22:51 - 2017-04-27 18:06 - 00708712 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2017-05-09 22:51 - 2017-04-27 18:05 - 00923040 _____ (Microsoft Corporation) C:\Windows\system32\CoreMessaging.dll
2017-05-09 22:51 - 2017-04-27 18:04 - 00583160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CoreMessaging.dll
2017-05-09 22:51 - 2017-04-27 17:59 - 05477088 _____ (Microsoft Corporation) C:\Windows\system32\OneCoreUAPCommonProxyStub.dll
2017-05-09 22:51 - 2017-04-27 17:59 - 00207264 _____ (Microsoft Corporation) C:\Windows\system32\browserbroker.dll
2017-05-09 22:51 - 2017-04-27 17:59 - 00027040 _____ (Microsoft Corporation) C:\Windows\system32\browser_broker.exe
2017-05-09 22:51 - 2017-04-27 17:58 - 01852776 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2017-05-09 22:51 - 2017-04-27 17:58 - 00872472 _____ (Microsoft Corporation) C:\Windows\system32\ClipSVC.dll
2017-05-09 22:51 - 2017-04-27 17:57 - 03116184 _____ (Microsoft Corporation) C:\Windows\system32\combase.dll
2017-05-09 22:51 - 2017-04-27 17:55 - 21353200 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2017-05-09 22:51 - 2017-04-27 17:55 - 01325456 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2017-05-09 22:51 - 2017-04-27 17:53 - 00387928 _____ (Microsoft Corporation) C:\Windows\system32\wmpps.dll
2017-05-09 22:51 - 2017-04-27 17:52 - 00790528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.dll
2017-05-09 22:51 - 2017-04-27 17:52 - 00584192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIRibbonRes.dll
2017-05-09 22:51 - 2017-04-27 17:49 - 00072192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2017-05-09 22:51 - 2017-04-27 17:49 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\odbcconf.dll
2017-05-09 22:51 - 2017-04-27 17:46 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2017-05-09 22:51 - 2017-04-27 17:45 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2017-05-09 22:51 - 2017-04-27 17:41 - 01248768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AzureSettingSyncProvider.dll
2017-05-09 22:51 - 2017-04-27 17:40 - 00799232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TokenBroker.dll
2017-05-09 22:51 - 2017-04-27 17:40 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cldapi.dll
2017-05-09 22:51 - 2017-04-27 17:39 - 03655680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2017-05-09 22:51 - 2017-04-27 17:34 - 00891904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\autochk.exe
2017-05-09 22:51 - 2017-04-27 17:33 - 00089088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\olepro32.dll
2017-05-09 22:51 - 2017-04-27 17:15 - 01051648 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.dll
2017-05-09 22:51 - 2017-04-27 17:14 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\UIRibbonRes.dll
2017-05-09 22:51 - 2017-04-27 17:11 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2017-05-09 22:51 - 2017-04-27 17:11 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\odbcconf.dll
2017-05-09 22:51 - 2017-04-27 17:09 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2017-05-09 22:51 - 2017-04-27 17:09 - 00064512 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2017-05-09 22:51 - 2017-04-27 17:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\SettingsEnvironment.Desktop.dll
2017-05-09 22:51 - 2017-04-27 17:07 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2017-05-09 22:51 - 2017-04-27 17:06 - 01302528 _____ (Microsoft Corporation) C:\Windows\system32\MSVPXENC.dll
2017-05-09 22:51 - 2017-04-27 17:06 - 00527360 _____ (Microsoft Corporation) C:\Windows\system32\aadcloudap.dll
2017-05-09 22:51 - 2017-04-27 17:04 - 01878016 _____ (Microsoft Corporation) C:\Windows\system32\AzureSettingSyncProvider.dll
2017-05-09 22:51 - 2017-04-27 17:03 - 01085440 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2017-05-09 22:51 - 2017-04-27 17:03 - 01027584 _____ (Microsoft Corporation) C:\Windows\system32\modernexecserver.dll
2017-05-09 22:51 - 2017-04-27 17:03 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\cldapi.dll
2017-05-09 22:51 - 2017-04-27 17:02 - 01260544 _____ (Microsoft Corporation) C:\Windows\system32\GamePanel.exe
2017-05-09 22:51 - 2017-04-27 17:01 - 01886208 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentExtensions.onecore.dll
2017-05-09 22:51 - 2017-04-27 16:58 - 01054208 _____ (Microsoft Corporation) C:\Windows\system32\TokenBroker.dll
2017-05-09 22:51 - 2017-04-27 16:57 - 04730368 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2017-05-09 22:51 - 2017-04-27 16:57 - 02800128 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentServer.dll
2017-05-09 22:51 - 2017-04-27 16:54 - 00985600 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2017-05-09 22:51 - 2017-04-27 16:54 - 00970240 _____ (Microsoft Corporation) C:\Windows\system32\autochk.exe
2017-05-09 22:51 - 2017-04-27 16:54 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2017-05-09 22:51 - 2017-04-27 16:54 - 00414208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2017-05-09 22:51 - 2017-04-27 16:52 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.Streaming.ps.dll
2017-05-09 17:01 - 2017-05-09 17:01 - 00000759 _____ C:\Users\Rick 0\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\flashplayer_25_sa.lnk
2017-05-09 17:00 - 2017-05-09 17:00 - 14966264 _____ (Adobe Systems, Inc.) C:\Users\Rick 0\Documents\flashplayer_25_sa.exe
2017-05-09 16:53 - 2017-05-09 16:59 - 00004646 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier
2017-05-09 16:45 - 2017-05-09 16:59 - 00000000 ____D C:\Users\Neeko\AppData\Local\Adobe
2017-05-09 16:44 - 2017-05-09 16:59 - 00000000 ____D C:\Users\Rick 0\AppData\Local\Adobe
2017-05-09 16:35 - 2017-05-09 16:35 - 00000000 ____D C:\Users\Rick 0\Documents\sd thro
2017-05-08 22:26 - 2017-05-08 22:26 - 00000000 ____D C:\Users\Rick 0\AppData\LocalLow\Temp
2017-05-08 02:11 - 2017-05-08 02:11 - 00000000 ____D C:\Users\Rick 0\AppData\Local\Chromium
2017-05-08 02:08 - 2017-05-08 02:08 - 00000000 ____D C:\Users\Rick 0\AppData\Roaming\The Creative Assembly
2017-05-04 11:38 - 2017-05-04 11:38 - 00120000 _____ C:\Users\Rick 0\Documents\2016TurboTaxReturn.pdf
2017-05-04 00:32 - 2017-05-13 02:45 - 00000000 ____D C:\Users\Rick 0\AppData\Roaming\NVIDIA
2017-05-04 00:32 - 2017-05-04 00:32 - 00000000 ____D C:\Users\Rick 0\Documents\BioWare
2017-05-03 13:45 - 2017-05-03 13:45 - 00001166 _____ C:\Users\Public\Desktop\Mass Effect 2.lnk
2017-05-03 13:45 - 2017-05-03 13:45 - 00000000 ____D C:\Windows\SysWOW64\AGEIA
2017-05-03 13:45 - 2017-05-03 13:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2017-05-03 13:45 - 2017-05-03 13:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mass Effect 2
2017-05-03 13:45 - 2017-05-03 13:45 - 00000000 ____D C:\Program Files (x86)\AGEIA Technologies
2017-05-03 13:15 - 2017-05-03 13:32 - 00000000 ____D C:\Program Files (x86)\Mass Effect 2
2017-05-02 18:56 - 2017-05-02 18:56 - 00000000 ____D C:\Program Files (x86)\Origin Games
2017-05-02 18:55 - 2017-05-02 18:57 - 00000000 ____D C:\Users\Rick 0\AppData\Roaming\Origin
2017-05-02 18:53 - 2017-05-02 18:53 - 00001062 _____ C:\Users\Public\Desktop\Origin.lnk
2017-05-02 18:53 - 2017-05-02 18:53 - 00000000 ____D C:\Users\Neeko\AppData\Local\Origin
2017-05-02 18:53 - 2017-05-02 18:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin
2017-05-02 18:53 - 2017-05-02 18:53 - 00000000 ____D C:\Program Files (x86)\Origin
2017-05-02 18:52 - 2017-05-02 18:57 - 00000000 ____D C:\ProgramData\Origin
2017-05-02 18:52 - 2017-05-02 18:56 - 00000000 ____D C:\Users\Rick 0\AppData\Local\Origin
2017-05-02 18:52 - 2017-05-02 18:52 - 00000000 ____D C:\Users\Rick 0\.QtWebEngineProcess
2017-05-02 18:52 - 2017-05-02 18:52 - 00000000 ____D C:\Users\Rick 0\.Origin
2017-05-02 14:14 - 2017-05-02 14:59 - 1279333529 _____ C:\Users\Rick 0\Downloads\knowing is half the battle..muthacensoreders.mp4
2017-04-29 23:07 - 2017-04-18 23:18 - 00118784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netvsc.sys
2017-04-29 23:07 - 2017-04-18 23:13 - 00980992 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bthport.sys
2017-04-29 23:07 - 2017-04-18 22:58 - 20374424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2017-04-29 23:07 - 2017-04-18 22:36 - 01291776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSVPXENC.dll
2017-04-29 23:07 - 2017-04-18 22:34 - 00507392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2017-04-29 23:07 - 2017-04-18 22:30 - 00909312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSyncCore.dll
2017-04-29 23:07 - 2017-04-18 22:29 - 02298880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2017-04-29 23:07 - 2017-04-13 16:43 - 04469832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2017-04-29 23:07 - 2017-04-13 16:31 - 01611776 _____ (Microsoft Corporation) C:\Windows\system32\SpeechPal.dll
2017-04-29 23:07 - 2017-04-13 16:21 - 06728192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2017-04-29 23:07 - 2017-04-13 16:18 - 00731136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmgaserver.exe
2017-04-29 23:07 - 2017-04-13 16:18 - 00362496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\daxexec.dll
2017-04-29 23:07 - 2017-04-13 16:13 - 00354304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InputSwitch.dll
2017-04-29 23:06 - 2017-04-19 00:06 - 00651680 _____ (Microsoft Corporation) C:\Windows\system32\SettingSyncHost.exe
2017-04-29 23:06 - 2017-04-19 00:04 - 00142240 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wcifs.sys
2017-04-29 23:06 - 2017-04-19 00:02 - 00716440 _____ (Microsoft Corporation) C:\Windows\system32\MSVideoDSP.dll
2017-04-29 23:06 - 2017-04-18 23:19 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\musdialoghandlers.dll
2017-04-29 23:06 - 2017-04-18 23:13 - 00585728 _____ (Microsoft Corporation) C:\Windows\system32\OneDriveSettingSyncProvider.dll
2017-04-29 23:06 - 2017-04-18 23:12 - 00805888 _____ (Microsoft Corporation) C:\Windows\system32\ieproxy.dll
2017-04-29 23:06 - 2017-04-18 23:12 - 00590848 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2017-04-29 23:06 - 2017-04-18 23:12 - 00203776 _____ (Microsoft Corporation) C:\Windows\system32\PackageStateRoaming.dll
2017-04-29 23:06 - 2017-04-18 23:11 - 04446208 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers_nt.dll
2017-04-29 23:06 - 2017-04-18 23:10 - 04175872 _____ (Microsoft Corporation) C:\Windows\system32\StartTileData.dll
2017-04-29 23:06 - 2017-04-18 23:10 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Shell.UnifiedTile.CuratedTileCollections.dll
2017-04-29 23:06 - 2017-04-18 23:10 - 01600512 _____ (Microsoft Corporation) C:\Windows\system32\dbghelp.dll
2017-04-29 23:06 - 2017-04-18 23:08 - 01103872 _____ (Microsoft Corporation) C:\Windows\system32\SettingSyncCore.dll
2017-04-29 23:06 - 2017-04-18 23:07 - 01242624 _____ (Microsoft Corporation) C:\Windows\system32\SharedStartModel.dll
2017-04-29 23:06 - 2017-04-18 23:07 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2017-04-29 23:06 - 2017-04-18 23:06 - 02651648 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2017-04-29 23:06 - 2017-04-18 23:04 - 01356800 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2017-04-29 23:06 - 2017-04-18 23:04 - 00624640 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll
2017-04-29 23:06 - 2017-04-18 23:02 - 00559000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSyncHost.exe
2017-04-29 23:06 - 2017-04-18 23:01 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\catsrvps.dll
2017-04-29 23:06 - 2017-04-18 22:59 - 02435584 _____ (Microsoft Corporation) C:\Windows\system32\ResetEngine.dll
2017-04-29 23:06 - 2017-04-18 22:37 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WiFiDisplay.dll
2017-04-29 23:06 - 2017-04-18 22:35 - 00476672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\OneDriveSettingSyncProvider.dll
2017-04-29 23:06 - 2017-04-18 22:34 - 00358400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieproxy.dll
2017-04-29 23:06 - 2017-04-18 22:34 - 00175616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PackageStateRoaming.dll
2017-04-29 23:06 - 2017-04-18 22:32 - 01285120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbghelp.dll
2017-04-29 23:06 - 2017-04-13 17:35 - 04848440 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2017-04-29 23:06 - 2017-04-13 17:33 - 02085280 _____ (Microsoft Corporation) C:\Windows\system32\UpdateAgent.dll
2017-04-29 23:06 - 2017-04-13 17:30 - 00105456 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2017-04-29 23:06 - 2017-04-13 16:43 - 00523296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppResolver.dll
2017-04-29 23:06 - 2017-04-13 16:41 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\mssprxy.dll
2017-04-29 23:06 - 2017-04-13 16:40 - 00095584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2017-04-29 23:06 - 2017-04-13 16:39 - 07931392 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2017-04-29 23:06 - 2017-04-13 16:39 - 00974848 _____ (Microsoft Corporation) C:\Windows\system32\mmgaserver.exe
2017-04-29 23:06 - 2017-04-13 16:39 - 00334336 _____ (Microsoft Corporation) C:\Windows\system32\wc_storage.dll
2017-04-29 23:06 - 2017-04-13 16:39 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\VEStoreEventHandlers.dll
2017-04-29 23:06 - 2017-04-13 16:38 - 00251904 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Gaming.Preview.dll
2017-04-29 23:06 - 2017-04-13 16:37 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\NotificationObjFactory.dll
2017-04-29 23:06 - 2017-04-13 16:35 - 01433600 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettings.Handlers.dll
2017-04-29 23:06 - 2017-04-13 16:35 - 00510976 _____ (Microsoft Corporation) C:\Windows\system32\TDLMigration.dll
2017-04-29 23:06 - 2017-04-13 16:35 - 00257024 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2017-04-29 23:06 - 2017-04-13 16:34 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\InputSwitch.dll
2017-04-29 23:06 - 2017-04-13 16:33 - 01269760 _____ (Microsoft Corporation) C:\Windows\system32\enterprisecsps.dll
2017-04-29 23:06 - 2017-04-13 16:31 - 00673280 _____ (Microsoft Corporation) C:\Windows\system32\LockAppBroker.dll
2017-04-29 23:06 - 2017-04-13 16:29 - 01583616 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2017-04-29 23:06 - 2017-04-13 16:29 - 01295872 _____ (Microsoft Corporation) C:\Windows\system32\dosvc.dll
2017-04-29 23:06 - 2017-04-13 16:26 - 01257472 _____ (Microsoft Corporation) C:\Windows\system32\wpnapps.dll
2017-04-29 23:06 - 2017-04-13 16:25 - 00750080 _____ (Microsoft Corporation) C:\Windows\system32\StorSvc.dll
2017-04-29 23:06 - 2017-04-13 16:24 - 01628160 _____ (Microsoft Corporation) C:\Windows\system32\comsvcs.dll
2017-04-29 23:06 - 2017-04-13 16:21 - 00078848 _____ (Microsoft Corporation) C:\Windows\system32\offreg.dll
2017-04-29 23:06 - 2017-04-13 16:15 - 00282112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VEEventDispatcher.dll
2017-04-29 23:06 - 2017-04-13 16:15 - 00232448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CloudBackupSettings.dll
2017-04-29 23:06 - 2017-04-13 16:13 - 00232960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2017-04-29 23:06 - 2017-04-13 16:08 - 01463296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2017-04-29 23:06 - 2017-04-13 16:06 - 00987648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpnapps.dll
2017-04-29 23:06 - 2017-04-13 16:04 - 00392704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PlayToManager.dll
2017-04-29 23:06 - 2017-04-13 16:01 - 00057856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\offreg.dll
2017-04-29 23:05 - 2017-04-19 00:07 - 00712600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms2.sys
2017-04-29 23:05 - 2017-04-18 23:16 - 00280064 _____ (Microsoft Corporation) C:\Windows\system32\WiFiDisplay.dll
2017-04-29 23:05 - 2017-04-18 23:15 - 00232960 _____ (Microsoft Corporation) C:\Windows\system32\wcmcsp.dll
2017-04-29 23:05 - 2017-04-18 23:14 - 00646656 _____ (Microsoft Corporation) C:\Windows\system32\LockHostingFramework.dll
2017-04-29 23:05 - 2017-04-18 23:13 - 00409600 _____ (Microsoft Corporation) C:\Windows\system32\updatehandlers.dll
2017-04-29 23:05 - 2017-04-18 23:11 - 00687104 _____ (Microsoft Corporation) C:\Windows\system32\LogonController.dll
2017-04-29 23:05 - 2017-04-18 23:08 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\usocore.dll
2017-04-29 23:05 - 2017-04-18 22:59 - 01087488 _____ (Microsoft Corporation) C:\Windows\system32\reseteng.dll
2017-04-29 23:05 - 2017-04-13 17:35 - 00741784 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Internal.Shell.Broker.dll
2017-04-29 23:05 - 2017-04-13 17:35 - 00673112 _____ (Microsoft Corporation) C:\Windows\system32\AppResolver.dll
2017-04-29 23:05 - 2017-04-13 17:32 - 01320352 _____ (Microsoft Corporation) C:\Windows\system32\wpx.dll
2017-04-29 23:05 - 2017-04-13 16:41 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\EnterpriseModernAppMgmtCSP.dll
2017-04-29 23:05 - 2017-04-13 16:39 - 00517632 _____ (Microsoft Corporation) C:\Windows\system32\daxexec.dll
2017-04-29 23:05 - 2017-04-13 16:38 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.AppDefaults.dll
2017-04-29 23:05 - 2017-04-13 16:37 - 00450048 _____ (Microsoft Corporation) C:\Windows\system32\bcdedit.exe
2017-04-29 23:05 - 2017-04-13 16:37 - 00301056 _____ (Microsoft Corporation) C:\Windows\system32\EnterpriseAppMgmtSvc.dll
2017-04-29 23:05 - 2017-04-13 16:37 - 00246272 _____ (Microsoft Corporation) C:\Windows\system32\domgmt.dll
2017-04-29 23:05 - 2017-04-13 16:36 - 00524800 _____ (Microsoft Corporation) C:\Windows\system32\TileDataRepository.dll
2017-04-29 23:05 - 2017-04-13 16:36 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\CloudBackupSettings.dll
2017-04-29 23:05 - 2017-04-13 16:34 - 01468416 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentExtensions.desktop.dll
2017-04-29 23:05 - 2017-04-13 16:33 - 00864256 _____ (Microsoft Corporation) C:\Windows\system32\NotificationController.dll
2017-04-29 23:05 - 2017-04-13 16:29 - 02499584 _____ (Microsoft Corporation) C:\Windows\system32\twinui.pcshell.dll
2017-04-29 23:05 - 2017-04-13 16:29 - 00840192 _____ (Microsoft Corporation) C:\Windows\system32\fveapi.dll
2017-04-29 23:05 - 2017-04-13 16:29 - 00647168 _____ (Microsoft Corporation) C:\Windows\system32\RDXService.dll
2017-04-29 23:05 - 2017-04-13 16:28 - 02443776 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2017-04-28 19:07 - 2017-04-28 19:07 - 00000000 ____D C:\Users\Neeko\AppData\Roaming\Macromedia
2017-04-28 18:38 - 2017-04-28 18:38 - 00000000 ____D C:\Users\Rick 0\Documents\League of Legends
2017-04-28 18:32 - 2017-04-28 18:32 - 00067728 _____ C:\Users\Rick 0\Downloads\ListeningPortfolioSPAN202.pdf
2017-04-28 16:39 - 2017-04-28 16:39 - 00098256 _____ C:\Users\Rick 0\Downloads\ListeningPortfolio_Sugerencias_Spring2017.pdf
2017-04-28 16:30 - 2017-05-16 11:27 - 00000000 ____D C:\Users\Rick 0\AppData\Local\CrashDumps
2017-04-28 16:21 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2017-04-28 16:21 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2017-04-28 16:21 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll
2017-04-28 16:21 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll
2017-04-28 16:21 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2017-04-28 16:21 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2017-04-28 16:21 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2017-04-28 16:21 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll
2017-04-28 16:21 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll
2017-04-28 16:21 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_43.dll
2017-04-28 16:21 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll
2017-04-28 16:21 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll
2017-04-28 16:21 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll
2017-04-28 16:21 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll
2017-04-28 16:21 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2017-04-28 16:21 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2017-04-27 16:06 - 2017-04-27 16:06 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_esif_umdf2_02_00_00.Wdf
2017-04-27 16:06 - 2017-04-27 16:06 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_esif_lf_01011.Wdf
2017-04-27 16:05 - 2017-05-16 11:26 - 00000613 _____ C:\Users\Rick 0\Documents\New Text Document.txt
2017-04-27 16:05 - 2017-04-27 16:05 - 00000000 ____D C:\Windows\system32\Intel
2017-04-26 20:03 - 2017-04-26 20:03 - 00266367 _____ C:\Users\Rick 0\Downloads\EClare.pdf
2017-04-25 12:04 - 2017-04-25 12:04 - 00000000 ____D C:\Users\Rick 0\Documents\DAMN_
2017-04-24 13:52 - 2017-04-24 13:52 - 00002710 _____ C:\Users\Rick 0\Desktop\thuglife.txt
2017-04-24 12:29 - 2017-04-24 13:34 - 00002632 _____ C:\Users\Rick 0\Desktop\GenerateFNISforUsers - Shortcut.lnk
2017-04-24 12:29 - 2017-04-24 12:29 - 00002991 _____ C:\Users\Neeko\Desktop\GenerateFNISforUsers.lnk
2017-04-23 23:43 - 2017-04-23 23:43 - 00000000 ____D C:\Users\Rick 0\AppData\Roaming\Macromedia
2017-04-23 23:42 - 2017-04-23 23:42 - 00000000 ____D C:\Users\Rick 0\AppData\Roaming\LolClient
2017-04-23 22:15 - 2017-04-23 22:15 - 00000000 ____D C:\Users\Rick 0\AppData\Local\DBG
2017-04-23 21:46 - 2017-04-23 21:46 - 00001969 _____ C:\Users\Rick 0\Desktop\skse_loader.lnk
2017-04-23 21:26 - 2017-04-23 21:26 - 00000221 _____ C:\Users\Rick 0\Desktop\The Elder Scrolls V Skyrim.url
2017-04-23 17:22 - 2017-04-23 17:22 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2017-04-23 17:22 - 2017-04-23 17:22 - 00000000 ____D C:\Users\Rick 0\AppData\Local\Apple Computer
2017-04-23 16:02 - 2017-05-11 13:39 - 00000000 ____D C:\Users\Rick 0\Desktop\Nexus Mod Manager
2017-04-23 16:02 - 2017-04-23 16:02 - 00001303 _____ C:\Users\Public\Desktop\Nexus Mod Manager.lnk
2017-04-23 16:02 - 2017-04-23 16:02 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nexus Mod Manager
2017-04-23 16:00 - 2017-04-23 16:01 - 00000000 ____D C:\Users\Neeko\AppData\Local\Black_Tree_Gaming
2017-04-23 16:00 - 2017-04-23 16:00 - 00000000 ____D C:\Users\Neeko\Documents\Nexus Mod Manager
2017-04-23 15:55 - 2017-04-23 16:03 - 00000000 ____D C:\Users\Rick 0\AppData\Local\Black_Tree_Gaming
2017-04-23 15:55 - 2017-04-23 16:01 - 00000000 ____D C:\Program Files\Nexus Mod Manager
2017-04-23 15:55 - 2017-04-23 15:56 - 00000000 ____D C:\Users\Rick 0\Documents\Nexus Mod Manager
2017-04-23 14:16 - 2017-04-23 14:16 - 00000000 ____D C:\Users\Neeko\AppData\Roaming\Synaptics
2017-04-23 13:59 - 2017-04-23 13:59 - 00490108 _____ C:\Users\Rick 0\Downloads\LRupp History.pdf
2017-04-23 12:30 - 2017-03-26 17:52 - 15701641 _____ C:\Users\Rick 0\Documents\sdthroa and lol mod of it.7z
2017-04-23 12:00 - 2016-11-20 02:57 - 97963309 _____ (JohnnyLump ) C:\Users\Rick 0\Downloads\Long War EW 1.0 for PC-88-1-0.exe
2017-04-23 11:57 - 2016-05-26 13:44 - 1587902929 _____ C:\Users\Rick 0\Documents\AvPRedux2.0part1.7z
2017-04-23 11:57 - 2016-05-26 13:44 - 1244707449 _____ C:\Users\Rick 0\Documents\AvPRedux2.0part2.7z
2017-04-23 11:53 - 2017-05-14 18:50 - 00000000 ____D C:\Users\Rick 0\Documents\PSU
2017-04-23 11:52 - 2017-04-23 11:52 - 00000000 ____D C:\Users\Rick 0\Documents\NullDC
2017-04-23 11:44 - 2017-04-23 11:52 - 00000000 ____D C:\Users\Rick 0\Documents\my mind
2017-04-23 11:43 - 2017-04-23 11:44 - 00000000 ____D C:\Users\Rick 0\Documents\Moduntandblade mods
2017-04-23 11:40 - 2017-04-23 11:43 - 00000000 ____D C:\Users\Rick 0\Documents\Lstudio9
2017-04-23 11:25 - 2017-04-23 11:25 - 00000000 ____D C:\Users\Rick 0\Documents\Hardcore_Modestarwarsjedioutcast
2017-04-23 11:25 - 2017-04-23 11:25 - 00000000 ____D C:\Users\Rick 0\Documents\FK2jedioutcast
2017-04-23 11:21 - 2017-04-23 11:21 - 00000000 ____D C:\ProgramData\Riot Games
2017-04-23 11:20 - 2017-04-28 18:38 - 00001749 _____ C:\Users\Public\Desktop\League of Legends.lnk
2017-04-23 11:20 - 2017-04-23 11:20 - 00000000 ____D C:\Riot Games
2017-04-23 11:20 - 2008-07-12 08:18 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2017-04-23 11:20 - 2008-07-12 08:18 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll
2017-04-23 11:20 - 2008-07-12 08:18 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll
2017-04-23 11:19 - 2017-04-23 11:21 - 00000000 ____D C:\Users\Rick 0\AppData\Roaming\Riot Games
2017-04-23 11:13 - 2017-05-02 18:54 - 00000000 ____D C:\ProgramData\Package Cache
2017-04-23 11:12 - 2017-04-23 11:12 - 03176930 _____ C:\Users\Rick 0\Downloads\Chipset_10.1.1.42_Public.zip
2017-04-23 11:08 - 2017-04-23 11:08 - 00000000 ____D C:\Users\Rick 0\AppData\Roaming\Synaptics
2017-04-23 11:00 - 2017-04-23 11:00 - 00000000 ____D C:\Users\Neeko\AppData\Local\ElevatedDiagnostics
2017-04-23 10:59 - 2017-05-09 22:55 - 00000000 ____D C:\Windows\system32\MRT
2017-04-23 10:58 - 2017-05-09 22:53 - 156335152 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-04-23 10:58 - 2017-03-31 17:29 - 01518088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2017-04-23 10:58 - 2017-03-31 17:09 - 00094720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UserDataTimeUtil.dll
2017-04-23 10:58 - 2017-03-31 17:04 - 00364032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msIso.dll
2017-04-23 10:58 - 2017-03-31 17:02 - 00252928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsDocumentTargetPrint.dll
2017-04-23 10:58 - 2017-03-31 17:01 - 00429568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winspool.drv
2017-04-23 10:58 - 2017-03-31 16:56 - 01060352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsPrint.dll
2017-04-23 10:58 - 2017-03-31 16:52 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmjpegdec.dll
2017-04-23 10:58 - 2017-03-31 16:52 - 00078336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\asycfilt.dll
2017-04-23 10:57 - 2017-04-23 10:57 - 00000571 _____ C:\Users\Rick 0\Downloads\DeviceDiagnostic.diagcab
2017-04-23 10:57 - 2017-03-31 17:57 - 00626520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontdrvhost.exe
2017-04-23 10:57 - 2017-03-31 17:57 - 00311192 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2017-04-23 10:57 - 2017-03-31 17:51 - 01760264 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2017-04-23 10:57 - 2017-03-31 17:28 - 00354360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcryptprimitives.dll
2017-04-23 10:57 - 2017-03-31 17:11 - 00038912 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2017-04-23 10:57 - 2017-03-31 17:04 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\UserDataTimeUtil.dll
2017-04-23 10:57 - 2017-03-31 16:58 - 01506816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2017-04-23 10:57 - 2017-03-31 14:00 - 00032004 _____ C:\Windows\system32\edgehtmlpluginpolicy.bin
2017-04-23 10:56 - 2017-03-31 18:05 - 00750560 _____ (Microsoft Corporation) C:\Windows\system32\fontdrvhost.exe
2017-04-23 10:56 - 2017-03-31 18:04 - 01147296 _____ (Microsoft Corporation) C:\Windows\system32\hvix64.exe
2017-04-23 10:56 - 2017-03-31 18:04 - 01024416 _____ (Microsoft Corporation) C:\Windows\system32\hvax64.exe
2017-04-23 10:56 - 2017-03-31 18:04 - 00382368 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2017-04-23 10:56 - 2017-03-31 17:52 - 00409504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2017-04-23 10:56 - 2017-03-31 17:05 - 00047104 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2017-04-23 10:56 - 2017-03-31 16:58 - 00433664 _____ (Microsoft Corporation) C:\Windows\system32\msIso.dll
2017-04-23 10:56 - 2017-03-31 16:55 - 00545792 _____ (Microsoft Corporation) C:\Windows\system32\winspool.drv
2017-04-23 10:56 - 2017-03-31 16:55 - 00347136 _____ (Microsoft Corporation) C:\Windows\system32\XpsDocumentTargetPrint.dll
2017-04-23 10:56 - 2017-03-31 16:50 - 01657344 _____ (Microsoft Corporation) C:\Windows\system32\XpsPrint.dll
2017-04-23 10:56 - 2017-03-31 16:50 - 01605632 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2017-04-23 10:56 - 2017-03-31 16:45 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\mfmjpegdec.dll
2017-04-23 10:56 - 2017-03-31 16:44 - 00087552 _____ (Microsoft Corporation) C:\Windows\system32\asycfilt.dll
2017-04-23 10:48 - 2017-04-23 21:34 - 00000000 ____D C:\Users\Rick 0\AppData\Local\Skyrim
2017-04-23 03:13 - 2017-04-23 03:13 - 00000000 ____D C:\Program Files\Reference Assemblies
2017-04-23 03:13 - 2017-04-23 03:13 - 00000000 ____D C:\Program Files\MSBuild
2017-04-23 03:13 - 2017-04-23 03:13 - 00000000 ____D C:\Program Files (x86)\Reference Assemblies
2017-04-23 03:13 - 2017-04-23 03:13 - 00000000 ____D C:\Program Files (x86)\MSBuild
2017-04-23 03:12 - 2017-02-10 11:26 - 01166520 _____ (Microsoft Corporation) C:\Windows\system32\PresentationNative_v0300.dll
2017-04-23 03:12 - 2017-02-10 11:26 - 00124624 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2017-04-23 03:12 - 2017-02-10 11:26 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2017-04-23 03:12 - 2017-02-10 11:21 - 00778936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationNative_v0300.dll
2017-04-23 03:12 - 2017-02-10 11:21 - 00103120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2017-04-23 03:12 - 2017-02-10 11:21 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2017-04-23 03:12 - 2010-02-04 10:01 - 00530776 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_6.dll
2017-04-23 03:12 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_6.dll
2017-04-23 03:12 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_6.dll
2017-04-23 03:12 - 2010-02-04 10:01 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_6.dll
2017-04-23 03:12 - 2010-02-04 10:01 - 00078680 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_4.dll
2017-04-23 03:12 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_4.dll
2017-04-23 03:12 - 2010-02-04 10:01 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_7.dll
2017-04-23 03:12 - 2010-02-04 10:01 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_7.dll
2017-04-23 03:12 - 2009-09-04 17:44 - 00517960 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_5.dll
2017-04-23 03:12 - 2009-09-04 17:44 - 00515416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_5.dll
2017-04-23 03:12 - 2009-09-04 17:44 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_5.dll
2017-04-23 03:12 - 2009-09-04 17:44 - 00176968 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_5.dll
2017-04-23 03:12 - 2009-09-04 17:44 - 00073544 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_3.dll
2017-04-23 03:12 - 2009-09-04 17:44 - 00069464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_3.dll
2017-04-23 03:12 - 2009-09-04 17:29 - 05554512 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_42.dll
2017-04-23 03:12 - 2009-09-04 17:29 - 05501792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_42.dll
2017-04-23 03:12 - 2009-09-04 17:29 - 02582888 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_42.dll
2017-04-23 03:12 - 2009-09-04 17:29 - 02475352 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_42.dll
2017-04-23 03:12 - 2009-09-04 17:29 - 01974616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_42.dll
2017-04-23 03:12 - 2009-09-04 17:29 - 01892184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_42.dll
2017-04-23 03:12 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll
2017-04-23 03:12 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll
2017-04-23 03:12 - 2009-09-04 17:29 - 00285024 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_42.dll
2017-04-23 03:12 - 2009-09-04 17:29 - 00235344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_42.dll
2017-04-23 03:12 - 2009-03-16 14:18 - 00521560 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_4.dll
2017-04-23 03:12 - 2009-03-16 14:18 - 00517448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_4.dll
2017-04-23 03:12 - 2009-03-16 14:18 - 00235352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_4.dll
2017-04-23 03:12 - 2009-03-16 14:18 - 00174936 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_4.dll
2017-04-23 03:12 - 2009-03-16 14:18 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_6.dll
2017-04-23 03:12 - 2009-03-16 14:18 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_6.dll
2017-04-23 03:12 - 2009-03-09 15:27 - 05425496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_41.dll
2017-04-23 03:12 - 2009-03-09 15:27 - 04178264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_41.dll
2017-04-23 03:12 - 2009-03-09 15:27 - 02430312 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_41.dll
2017-04-23 03:12 - 2009-03-09 15:27 - 01846632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_41.dll
2017-04-23 03:12 - 2009-03-09 15:27 - 00520544 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_41.dll
2017-04-23 03:12 - 2009-03-09 15:27 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_41.dll
2017-04-23 03:12 - 2008-10-27 10:04 - 00518480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_3.dll
2017-04-23 03:12 - 2008-10-27 10:04 - 00514384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_3.dll
2017-04-23 03:12 - 2008-10-27 10:04 - 00235856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_3.dll
2017-04-23 03:12 - 2008-10-27 10:04 - 00175440 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_3.dll
2017-04-23 03:12 - 2008-10-27 10:04 - 00074576 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_2.dll
2017-04-23 03:12 - 2008-10-27 10:04 - 00070992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_2.dll
2017-04-23 03:12 - 2008-10-27 10:04 - 00025936 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_5.dll
2017-04-23 03:12 - 2008-10-27 10:04 - 00023376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_5.dll
2017-04-23 03:12 - 2008-10-15 06:22 - 05631312 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_40.dll
2017-04-23 03:12 - 2008-10-15 06:22 - 04379984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_40.dll
2017-04-23 03:12 - 2008-10-15 06:22 - 02605920 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_40.dll
2017-04-23 03:12 - 2008-10-15 06:22 - 02036576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_40.dll
2017-04-23 03:12 - 2008-10-15 06:22 - 00519000 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_40.dll
2017-04-23 03:12 - 2008-10-15 06:22 - 00452440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_40.dll
2017-04-23 03:12 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_2.dll
2017-04-23 03:12 - 2008-07-31 10:41 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_2.dll
2017-04-23 03:12 - 2008-07-31 10:41 - 00072200 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_1.dll
2017-04-23 03:12 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll
2017-04-23 03:12 - 2008-07-31 10:40 - 00513544 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_2.dll
2017-04-23 03:12 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll
2017-04-23 03:12 - 2008-07-10 11:00 - 04992520 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_39.dll
2017-04-23 03:12 - 2008-07-10 11:00 - 01942552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_39.dll
2017-04-23 03:12 - 2008-07-10 11:00 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_39.dll
2017-04-23 03:12 - 2008-05-30 14:19 - 00511496 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_1.dll
2017-04-23 03:12 - 2008-05-30 14:19 - 00507400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_1.dll
2017-04-23 03:12 - 2008-05-30 14:18 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_1.dll
2017-04-23 03:12 - 2008-05-30 14:18 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_1.dll
2017-04-23 03:12 - 2008-05-30 14:17 - 00068104 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_0.dll
2017-04-23 03:12 - 2008-05-30 14:17 - 00065032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_0.dll
2017-04-23 03:12 - 2008-05-30 14:17 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_4.dll
2017-04-23 03:12 - 2008-05-30 14:16 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_4.dll
2017-04-23 03:12 - 2008-05-30 14:11 - 04991496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_38.dll
2017-04-23 03:12 - 2008-05-30 14:11 - 03850760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_38.dll
2017-04-23 03:12 - 2008-05-30 14:11 - 01941528 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_38.dll
2017-04-23 03:12 - 2008-05-30 14:11 - 01491992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_38.dll
2017-04-23 03:12 - 2008-05-30 14:11 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_38.dll
2017-04-23 03:12 - 2008-05-30 14:11 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_38.dll
2017-04-23 03:12 - 2008-03-05 16:04 - 00489480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_0.dll
2017-04-23 03:12 - 2008-03-05 16:03 - 00479752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_0.dll
2017-04-23 03:12 - 2008-03-05 16:03 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_0.dll
2017-04-23 03:12 - 2008-03-05 16:03 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_0.dll
2017-04-23 03:12 - 2008-03-05 16:00 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_3.dll
2017-04-23 03:12 - 2008-03-05 16:00 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_3.dll
2017-04-23 03:12 - 2008-03-05 15:56 - 01860120 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_37.dll
2017-04-23 03:12 - 2008-03-05 15:56 - 01420824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_37.dll
2017-04-23 03:12 - 2008-02-05 23:07 - 00529424 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_37.dll
2017-04-23 03:12 - 2008-02-05 23:07 - 00462864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_37.dll
2017-04-23 03:11 - 2008-03-05 15:56 - 04910088 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_37.dll
2017-04-23 03:11 - 2008-03-05 15:56 - 03786760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_37.dll
2017-04-23 03:11 - 2007-10-22 03:40 - 00411656 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_10.dll
2017-04-23 03:11 - 2007-10-22 03:39 - 00267272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_10.dll
2017-04-23 03:11 - 2007-10-22 03:37 - 00021000 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_2.dll
2017-04-23 03:11 - 2007-10-22 03:37 - 00017928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_2.dll
2017-04-23 03:11 - 2007-10-12 15:14 - 05081608 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_36.dll
2017-04-23 03:11 - 2007-10-12 15:14 - 03734536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_36.dll
2017-04-23 03:11 - 2007-10-12 15:14 - 02006552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_36.dll
2017-04-23 03:11 - 2007-10-12 15:14 - 01374232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_36.dll
2017-04-23 03:11 - 2007-10-02 09:56 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_36.dll
2017-04-23 03:11 - 2007-10-02 09:56 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_36.dll
2017-04-23 03:11 - 2007-07-20 00:57 - 00411496 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_9.dll
2017-04-23 03:11 - 2007-07-20 00:57 - 00267112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_9.dll
2017-04-23 03:11 - 2007-07-19 18:14 - 05073256 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_35.dll
2017-04-23 03:11 - 2007-07-19 18:14 - 03727720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_35.dll
2017-04-23 03:11 - 2007-07-19 18:14 - 01985904 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_35.dll
2017-04-23 03:11 - 2007-07-19 18:14 - 01358192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_35.dll
2017-04-23 03:11 - 2007-07-19 18:14 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_35.dll
2017-04-23 03:11 - 2007-07-19 18:14 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_35.dll
2017-04-23 03:11 - 2007-06-20 20:49 - 00409960 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_8.dll
2017-04-23 03:11 - 2007-06-20 20:46 - 00266088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_8.dll
2017-04-23 03:11 - 2007-05-16 16:45 - 04496232 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_34.dll
2017-04-23 03:11 - 2007-05-16 16:45 - 03497832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_34.dll
2017-04-23 03:11 - 2007-05-16 16:45 - 01401200 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_34.dll
2017-04-23 03:11 - 2007-05-16 16:45 - 01124720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_34.dll
2017-04-23 03:11 - 2007-05-16 16:45 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_34.dll
2017-04-23 03:11 - 2007-05-16 16:45 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_34.dll
2017-04-23 03:11 - 2007-04-04 18:55 - 00403304 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_7.dll
2017-04-23 03:11 - 2007-04-04 18:55 - 00261480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_7.dll
2017-04-23 03:11 - 2007-04-04 18:54 - 00107368 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_3.dll
2017-04-23 03:11 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_3.dll
2017-04-23 03:11 - 2007-03-15 16:57 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_33.dll
2017-04-23 03:11 - 2007-03-15 16:57 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_33.dll
2017-04-23 03:11 - 2007-03-12 16:42 - 04494184 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_33.dll
2017-04-23 03:11 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_33.dll
2017-04-23 03:11 - 2007-03-12 16:42 - 01400176 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_33.dll
2017-04-23 03:11 - 2007-03-12 16:42 - 01123696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_33.dll
2017-04-23 03:11 - 2007-03-05 12:42 - 00017688 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_1.dll
2017-04-23 03:11 - 2007-03-05 12:42 - 00015128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_1.dll
2017-04-23 03:11 - 2007-01-24 15:27 - 00393576 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_6.dll
2017-04-23 03:11 - 2007-01-24 15:27 - 00255848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_6.dll
2017-04-23 03:11 - 2006-12-08 12:02 - 00251672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_5.dll
2017-04-23 03:11 - 2006-12-08 12:00 - 00390424 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_5.dll
2017-04-23 03:11 - 2006-11-29 13:06 - 04398360 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll
2017-04-23 03:11 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_32.dll
2017-04-23 03:11 - 2006-11-29 13:06 - 00469264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10.dll
2017-04-23 03:11 - 2006-11-29 13:06 - 00440080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10.dll
2017-04-23 03:11 - 2006-09-28 16:05 - 03977496 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_31.dll
2017-04-23 03:11 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll
2017-04-23 03:11 - 2006-09-28 16:05 - 00237848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_4.dll
2017-04-23 03:11 - 2006-09-28 16:04 - 00364824 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_4.dll
2017-04-23 03:11 - 2006-07-28 09:31 - 00083736 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_2.dll
2017-04-23 03:11 - 2006-07-28 09:30 - 00363288 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_3.dll
2017-04-23 03:11 - 2006-07-28 09:30 - 00236824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_3.dll
2017-04-23 03:11 - 2006-07-28 09:30 - 00062744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_2.dll
2017-04-23 03:11 - 2006-05-31 07:24 - 00230168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_2.dll
2017-04-23 03:11 - 2006-05-31 07:22 - 00354072 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_2.dll
2017-04-23 03:11 - 2006-03-31 12:41 - 03927248 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_30.dll
2017-04-23 03:11 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_30.dll
2017-04-23 03:11 - 2006-03-31 12:40 - 00352464 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_1.dll
2017-04-23 03:11 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_1.dll
2017-04-23 03:11 - 2006-03-31 12:39 - 00083664 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_1.dll
2017-04-23 03:11 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_1.dll
2017-04-23 03:11 - 2006-02-03 08:43 - 03830992 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_29.dll
2017-04-23 03:11 - 2006-02-03 08:43 - 02332368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_29.dll
2017-04-23 03:11 - 2006-02-03 08:42 - 00355536 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_0.dll
2017-04-23 03:11 - 2006-02-03 08:42 - 00230096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_0.dll
2017-04-23 03:11 - 2006-02-03 08:41 - 00016592 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_0.dll
2017-04-23 03:11 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_0.dll
2017-04-23 03:11 - 2005-12-05 18:09 - 03815120 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_28.dll
2017-04-23 03:11 - 2005-12-05 18:09 - 02323664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_28.dll
2017-04-23 03:11 - 2005-07-22 19:59 - 03807440 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_27.dll
2017-04-23 03:11 - 2005-07-22 19:59 - 02319568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_27.dll
2017-04-23 03:11 - 2005-05-26 15:34 - 03767504 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_26.dll
2017-04-23 03:11 - 2005-05-26 15:34 - 02297552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_26.dll
2017-04-23 03:11 - 2005-03-18 17:19 - 03823312 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_25.dll
2017-04-23 03:11 - 2005-03-18 17:19 - 02337488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_25.dll
2017-04-23 03:11 - 2005-02-05 19:45 - 03544272 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_24.dll
2017-04-23 03:11 - 2005-02-05 19:45 - 02222800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_24.dll
2017-04-23 03:09 - 2017-04-28 03:03 - 00000000 ____D C:\Users\Rick 0\Documents\My Games
2017-04-23 02:19 - 2017-04-23 02:19 - 00000000 ____D C:\Users\Rick 0\AppData\Local\Comms
2017-04-23 02:16 - 2017-04-23 02:16 - 00000000 ____D C:\Users\Rick 0\AppData\Local\Steam
2017-04-23 02:16 - 2017-04-23 02:16 - 00000000 ____D C:\Users\Rick 0\AppData\Local\CEF
2017-04-23 02:12 - 2017-04-23 02:12 - 00004214 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1492938726
2017-04-23 02:12 - 2017-04-23 02:12 - 00001427 _____ C:\Users\Rick 0\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2017-04-23 02:12 - 2017-04-23 02:12 - 00000000 ____D C:\Users\Rick 0\AppData\Roaming\Opera Software
2017-04-23 02:12 - 2017-04-23 02:12 - 00000000 ____D C:\Users\Rick 0\AppData\Local\Opera Software
2017-04-23 02:11 - 2017-04-23 02:11 - 01186224 _____ (Opera Software) C:\Users\Rick 0\Downloads\OperaSetup.exe
2017-04-23 02:07 - 2017-05-11 13:39 - 00000000 ____D C:\Users\Rick 0\Desktop\mods
2017-04-23 02:07 - 2017-04-23 02:07 - 00000000 ____D C:\Users\Rick 0\AppData\Local\MicrosoftEdge
2017-04-23 02:04 - 2017-04-23 02:04 - 00002366 _____ C:\Users\Rick 0\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2017-04-23 02:04 - 2017-04-23 02:04 - 00000000 ___RD C:\Users\Rick 0\OneDrive
2017-04-23 02:03 - 2017-04-23 17:27 - 00000000 ____D C:\Users\Rick 0\AppData\Roaming\Apple Computer
2017-04-23 02:02 - 2017-05-16 20:25 - 00000000 __SHD C:\Users\Rick 0\IntelGraphicsProfiles
2017-04-23 02:02 - 2017-05-04 11:19 - 00000000 ____D C:\Users\Rick 0\AppData\Local\Packages
2017-04-23 02:02 - 2017-04-23 02:02 - 00000000 ____D C:\Users\Rick 0\AppData\Roaming\Adobe
2017-04-23 02:02 - 2017-04-23 02:02 - 00000000 ____D C:\Users\Rick 0\AppData\Local\VirtualStore
2017-04-23 02:02 - 2017-04-23 02:02 - 00000000 ____D C:\Users\Rick 0\AppData\Local\TileDataLayer
2017-04-23 02:02 - 2017-04-23 02:02 - 00000000 ____D C:\Users\Rick 0\AppData\Local\Publishers
2017-04-23 02:02 - 2017-04-23 02:02 - 00000000 ____D C:\Users\Rick 0\AppData\Local\ConnectedDevicesPlatform
2017-04-23 02:01 - 2017-05-16 00:25 - 00000000 ____D C:\Users\Rick 0
2017-04-23 02:01 - 2017-04-23 02:01 - 00000020 ___SH C:\Users\Rick 0\ntuser.ini
2017-04-23 02:01 - 2017-04-23 02:01 - 00000000 _SHDL C:\Users\Rick 0\My Documents
2017-04-23 02:01 - 2017-04-23 02:01 - 00000000 _SHDL C:\Users\Rick 0\Documents\My Videos
2017-04-23 02:01 - 2017-04-23 02:01 - 00000000 _SHDL C:\Users\Rick 0\Documents\My Pictures
2017-04-23 02:01 - 2017-04-23 02:01 - 00000000 _SHDL C:\Users\Rick 0\Documents\My Music
2017-04-23 01:40 - 2017-05-16 20:28 - 00000000 ____D C:\Program Files (x86)\Steam
2017-04-23 01:40 - 2017-04-23 01:40 - 01446792 _____ C:\Users\Neeko\Downloads\SteamSetup.exe
2017-04-23 01:40 - 2017-04-23 01:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2017-04-23 01:36 - 2017-04-23 01:37 - 00000000 ____D C:\Users\Neeko\AppData\Roaming\Apple Computer
2017-04-23 01:36 - 2017-04-23 01:36 - 00000000 ____D C:\Users\Neeko\AppData\Local\Apple Computer
2017-04-23 01:36 - 2017-04-23 01:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2017-04-23 01:36 - 2017-04-23 01:36 - 00000000 ____D C:\ProgramData\Apple Computer
2017-04-23 01:36 - 2017-04-23 01:36 - 00000000 ____D C:\Program Files\iTunes
2017-04-23 01:36 - 2017-04-23 01:36 - 00000000 ____D C:\Program Files\iPod
2017-04-23 01:34 - 2017-04-23 01:34 - 00002535 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2017-04-23 01:34 - 2017-04-23 01:34 - 00000000 ____D C:\Users\Neeko\AppData\Local\Apple
2017-04-23 01:34 - 2017-04-23 01:34 - 00000000 ____D C:\Program Files\Common Files\Apple
2017-04-23 01:34 - 2017-04-23 01:34 - 00000000 ____D C:\Program Files\Bonjour
2017-04-23 01:34 - 2017-04-23 01:34 - 00000000 ____D C:\Program Files (x86)\Bonjour
2017-04-23 01:34 - 2017-04-23 01:34 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2017-04-23 01:33 - 2017-04-23 01:34 - 00000000 ____D C:\ProgramData\Apple
2017-04-23 01:29 - 2017-04-23 01:31 - 257659208 _____ (Apple Inc.) C:\Users\Neeko\Downloads\iTunes64Setup.exe
2017-04-22 13:44 - 2017-04-22 13:44 - 00000000 ____D C:\ProgramData\Sophos
2017-04-22 13:43 - 2017-04-22 13:43 - 00002775 _____ C:\Users\Public\Desktop\Sophos Virus Removal Tool.lnk
2017-04-22 13:43 - 2017-04-22 13:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sophos
2017-04-22 13:42 - 2017-04-22 13:42 - 00000000 ____D C:\Program Files (x86)\Sophos
2017-04-22 13:39 - 2017-04-22 13:40 - 165798592 _____ (Sophos Limited) C:\Users\Neeko\Desktop\Sophos Virus Removal Tool.exe
2017-04-22 13:30 - 2017-04-22 13:30 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_SynTP_01011.Wdf
2017-04-22 13:30 - 2017-04-22 13:30 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_Smb_driver_Intel_01011.Wdf
2017-04-22 13:30 - 2017-04-22 13:30 - 00000000 ____D C:\Program Files\Synaptics
2017-04-22 13:30 - 2016-10-05 00:44 - 00079960 _____ (Synaptics Incorporated) C:\Windows\system32\Drivers\Smb_driver_Intel.sys
2017-04-22 11:15 - 2017-04-22 11:11 - 00532136 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2017-04-22 11:11 - 2017-04-22 11:11 - 00014568 _____ C:\Windows\system32\Drivers\rtkhdasetting.zip
2017-04-22 11:11 - 2017-04-22 11:11 - 00002026 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bang & Olufsen.lnk
2017-04-22 11:11 - 2017-04-22 11:11 - 00000000 ____D C:\Windows\SysWOW64\RTCOM
2017-04-22 11:11 - 2017-04-22 11:11 - 00000000 ____D C:\Windows\system32\SRSLabs
2017-04-22 11:11 - 2017-04-22 11:11 - 00000000 ____D C:\ProgramData\SRS Labs
2017-04-22 11:11 - 2017-04-22 11:11 - 00000000 ____D C:\Program Files\Realtek
2017-04-22 11:10 - 2017-04-22 11:10 - 00000000 ____D C:\Program Files (x86)\VulkanRT
2017-04-22 11:10 - 2016-09-09 11:25 - 00269600 _____ C:\Windows\SysWOW64\vulkan-1.dll
2017-04-22 11:10 - 2016-09-09 11:25 - 00261920 _____ C:\Windows\system32\vulkan-1.dll
2017-04-22 11:10 - 2016-09-09 11:25 - 00110880 _____ C:\Windows\SysWOW64\vulkaninfo.exe
2017-04-22 11:10 - 2016-09-09 11:24 - 00125216 _____ C:\Windows\system32\vulkaninfo.exe
2017-04-22 11:09 - 2017-05-10 00:16 - 00000000 ____D C:\ProgramData\NVIDIA
2017-04-22 11:09 - 2017-04-22 11:09 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2017-04-22 11:09 - 2017-03-29 12:20 - 06399544 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2017-04-22 11:09 - 2017-03-29 12:20 - 02476480 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2017-04-22 11:09 - 2017-03-29 12:20 - 01762752 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2017-04-22 11:09 - 2017-03-29 12:20 - 00548408 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshext.dll
2017-04-22 11:09 - 2017-03-29 12:20 - 00393784 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2017-04-22 11:09 - 2017-03-29 12:20 - 00081856 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshextr.dll
2017-04-22 11:09 - 2017-03-29 12:20 - 00069568 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2017-04-22 11:09 - 2017-03-29 12:13 - 00001951 _____ C:\Windows\NvContainerRecovery.bat
2017-04-22 11:09 - 2017-03-29 00:30 - 07847617 _____ C:\Windows\system32\nvcoproc.bin
2017-04-22 11:08 - 2017-04-22 11:09 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2017-04-22 11:08 - 2017-04-22 11:08 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2017-04-22 11:07 - 2017-04-22 11:07 - 01381582 _____ (Igor Pavlov) C:\Users\Neeko\Downloads\7z1604-x64.exe
2017-04-22 11:07 - 2017-04-22 11:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2017-04-22 11:07 - 2017-04-22 11:07 - 00000000 ____D C:\Program Files\7-Zip
2017-04-22 11:06 - 2017-05-16 20:28 - 00000000 ____D C:\ProgramData\MCShield
2017-04-22 11:06 - 2017-04-22 11:06 - 00001145 _____ C:\Users\Public\Desktop\MCShield Real-Time Monitor.lnk
2017-04-22 11:06 - 2017-04-22 11:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MCShield
2017-04-22 11:06 - 2017-04-22 11:06 - 00000000 ____D C:\Program Files (x86)\MCShield
2017-04-22 11:05 - 2017-04-22 11:05 - 02856736 _____ (MyCity) C:\Users\Neeko\Downloads\MCShield-Setup.exe
2017-04-22 11:04 - 2017-04-22 11:04 - 01551792 _____ (RaMMicHaeL) C:\Users\Neeko\Downloads\unchecky_setup.exe
2017-04-22 11:04 - 2017-04-22 11:04 - 00001088 _____ C:\Users\Public\Desktop\Unchecky.lnk
2017-04-22 11:04 - 2017-04-22 11:04 - 00000000 ____D C:\ProgramData\Unchecky
2017-04-22 11:04 - 2017-04-22 11:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Unchecky
2017-04-22 11:04 - 2017-04-22 11:04 - 00000000 ____D C:\Program Files (x86)\Unchecky
2017-04-21 17:10 - 2017-04-21 16:15 - 00000000 ____D C:\Windows\Panther
2017-04-21 16:47 - 2017-05-16 20:29 - 00000000 ____D C:\FRST
2017-04-21 16:46 - 2017-04-21 16:46 - 00003326 _____ C:\Users\Neeko\Desktop\rk_5BE3.tmp.txt
2017-04-21 16:42 - 2017-05-16 16:01 - 02429952 _____ (Farbar) C:\Users\Neeko\Desktop\FRST64.exe
2017-04-21 16:42 - 2017-04-21 16:42 - 00000000 ____D C:\Windows\SysWOW64\sda
2017-04-21 16:42 - 2017-04-21 16:42 - 00000000 ____D C:\Users\Neeko\AppData\Local\Comms
2017-04-21 16:31 - 2017-04-21 16:47 - 00000000 ____D C:\ProgramData\RogueKiller
2017-04-21 16:31 - 2017-04-21 16:31 - 00028272 _____ C:\Windows\system32\Drivers\TrueSight.sys
2017-04-21 16:31 - 2017-04-21 16:31 - 00000899 _____ C:\Users\Public\Desktop\RogueKiller.lnk
2017-04-21 16:31 - 2017-04-21 16:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller
2017-04-21 16:30 - 2017-05-16 20:27 - 00000180 _____ C:\Windows\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2017-04-21 16:30 - 2017-05-16 20:27 - 00000000 __SHD C:\Users\Neeko\IntelGraphicsProfiles
2017-04-21 16:30 - 2017-04-23 11:13 - 00000000 ____D C:\Program Files\Intel
2017-04-21 16:30 - 2017-04-21 16:31 - 00000000 ____D C:\Program Files\RogueKiller
2017-04-21 16:30 - 2017-04-21 16:30 - 00000200 _____ C:\Windows\system32\{EC94D02F-D200-4428-9531-05AF7F9799CB}.bat
2017-04-21 16:30 - 2017-04-21 16:30 - 00000000 ____D C:\Program Files (x86)\Intel
2017-04-21 16:30 - 2017-04-21 16:30 - 00000000 ____D C:\Intel
2017-04-21 16:30 - 2017-04-21 16:30 - 00000000 _____ C:\Windows\system32\GfxValDisplayLog.bin
2017-04-21 16:30 - 2017-01-13 19:38 - 00103936 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.DLL
2017-04-21 16:30 - 2017-01-13 19:38 - 00099840 _____ (Khronos Group) C:\Windows\system32\OpenCL.DLL
2017-04-21 16:29 - 2017-04-21 16:30 - 35331712 _____ (Adlice Software ) C:\Users\Neeko\Downloads\setup.exe
2017-04-21 16:28 - 2017-05-10 00:16 - 00000000 ____D C:\ProgramData\Synaptics
2017-04-21 16:28 - 2017-04-21 16:28 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_wbf_vfs_0050_01_09_00.Wdf
2017-04-21 16:28 - 2017-04-21 16:28 - 00000000 ____D C:\Program Files (x86)\HP
2017-04-21 16:27 - 2017-04-21 16:27 - 00003290 _____ C:\Windows\System32\Tasks\OneDrive Standalone Update Task v2
2017-04-21 16:27 - 2017-04-21 16:27 - 00002363 _____ C:\Users\Neeko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2017-04-21 16:27 - 2017-04-21 16:27 - 00000000 ___RD C:\Users\Neeko\OneDrive
2017-04-21 16:26 - 2017-04-21 16:26 - 00000000 ____D C:\Users\Neeko\AppData\Local\MicrosoftEdge
2017-04-21 16:26 - 2017-04-21 16:26 - 00000000 ____D C:\ProgramData\USOShared
2017-04-21 16:25 - 2017-04-21 16:25 - 00000000 ____D C:\ProgramData\Microsoft OneDrive
2017-04-21 16:23 - 2017-05-16 11:30 - 00000000 ____D C:\Users\Neeko\AppData\Local\Packages
2017-04-21 16:23 - 2017-05-16 11:29 - 00000000 __RHD C:\Users\Public\AccountPictures
2017-04-21 16:23 - 2017-04-23 01:27 - 00000000 ____D C:\Users\Neeko\AppData\Local\ConnectedDevicesPlatform
2017-04-21 16:23 - 2017-04-21 16:23 - 00000000 ____D C:\Users\Neeko\AppData\Roaming\Adobe
2017-04-21 16:23 - 2017-04-21 16:23 - 00000000 ____D C:\Users\Neeko\AppData\Local\VirtualStore
2017-04-21 16:23 - 2017-04-21 16:23 - 00000000 ____D C:\Users\Neeko\AppData\Local\TileDataLayer
2017-04-21 16:23 - 2017-04-21 16:23 - 00000000 ____D C:\Users\Neeko\AppData\Local\Publishers
2017-04-21 16:22 - 2017-04-23 01:26 - 00000000 ____D C:\Users\Neeko
2017-04-21 16:22 - 2017-04-21 16:22 - 00000020 ___SH C:\Users\Neeko\ntuser.ini
2017-04-21 16:22 - 2017-04-21 16:22 - 00000000 _SHDL C:\Users\Neeko\My Documents
2017-04-21 16:22 - 2017-04-21 16:22 - 00000000 _SHDL C:\Users\Neeko\Documents\My Videos
2017-04-21 16:22 - 2017-04-21 16:22 - 00000000 _SHDL C:\Users\Neeko\Documents\My Pictures
2017-04-21 16:22 - 2017-04-21 16:22 - 00000000 _SHDL C:\Users\Neeko\Documents\My Music
2017-04-21 16:20 - 2017-05-11 12:21 - 01491364 _____ C:\Windows\system32\PerfStringBackup.INI
2017-04-21 16:18 - 2017-03-18 13:56 - 02233344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PrintConfig.dll
2017-04-21 16:16 - 2017-04-21 16:16 - 00000000 _SHDL C:\Users\Public\Documents\My Videos
2017-04-21 16:16 - 2017-04-21 16:16 - 00000000 _SHDL C:\Users\Public\Documents\My Pictures
2017-04-21 16:16 - 2017-04-21 16:16 - 00000000 _SHDL C:\Users\Public\Documents\My Music
2017-04-21 16:16 - 2017-04-21 16:16 - 00000000 _SHDL C:\Users\Default\My Documents
2017-04-21 16:16 - 2017-04-21 16:16 - 00000000 _SHDL C:\Users\Default\Documents\My Videos
2017-04-21 16:16 - 2017-04-21 16:16 - 00000000 _SHDL C:\Users\Default\Documents\My Pictures
2017-04-21 16:16 - 2017-04-21 16:16 - 00000000 _SHDL C:\Users\Default\Documents\My Music
2017-04-21 16:16 - 2017-04-21 16:16 - 00000000 _SHDL C:\Users\Default User\Documents\My Videos
2017-04-21 16:16 - 2017-04-21 16:16 - 00000000 _SHDL C:\Users\Default User\Documents\My Pictures
2017-04-21 16:16 - 2017-04-21 16:16 - 00000000 _SHDL C:\Users\Default User\Documents\My Music
2017-04-21 16:16 - 2017-04-21 16:16 - 00000000 _SHDL C:\Documents and Settings
2017-04-21 16:11 - 2017-05-16 16:00 - 00000000 ____D C:\Windows\system32\SleepStudy
2017-04-21 16:11 - 2017-05-10 00:17 - 00217000 _____ C:\Windows\system32\FNTCACHE.DAT
2017-04-21 16:11 - 2017-05-10 00:16 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-04-21 16:11 - 2017-04-21 16:11 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2017-04-21 16:11 - 2017-04-21 16:11 - 00000000 ____D C:\Windows\ServiceProfiles
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-05-16 20:25 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\AppReadiness
2017-05-16 16:02 - 2017-03-18 14:01 - 00000000 ____D C:\Windows\INF
2017-05-16 13:49 - 2017-03-18 14:03 - 00000000 ___HD C:\Program Files\WindowsApps
2017-05-12 13:53 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\rescache
2017-05-10 00:16 - 2017-03-18 04:40 - 01310720 _____ C:\Windows\system32\config\BBI
2017-05-10 00:15 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\system32\appraiser
2017-05-10 00:15 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\ShellExperiences
2017-05-10 00:15 - 2017-03-18 14:03 - 00000000 ____D C:\Program Files\Windows Photo Viewer
2017-05-10 00:15 - 2017-03-18 14:03 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2017-05-09 22:56 - 2017-03-18 13:51 - 00000000 ____D C:\Windows\CbsTemp
2017-05-09 16:59 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2017-05-09 16:59 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\system32\Macromed
2017-05-01 00:02 - 2017-03-18 14:03 - 00000000 ___SD C:\Windows\SysWOW64\F12
2017-05-01 00:02 - 2017-03-18 14:03 - 00000000 ___SD C:\Windows\system32\F12
2017-05-01 00:02 - 2017-03-18 14:03 - 00000000 ___RD C:\Windows\ImmersiveControlPanel
2017-05-01 00:02 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\SysWOW64\Dism
2017-05-01 00:02 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\system32\WinBioPlugIns
2017-05-01 00:02 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\Provisioning
2017-05-01 00:02 - 2017-03-18 04:40 - 00000000 ____D C:\Windows\system32\Dism
2017-04-28 18:05 - 2017-03-18 14:06 - 00835576 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-04-28 18:05 - 2017-03-18 14:06 - 00177656 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-04-28 16:18 - 2017-03-18 14:03 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2017-04-26 10:38 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\appcompat
2017-04-23 01:22 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\system32\WinBioDatabase
2017-04-22 11:09 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\Help
2017-04-21 17:10 - 2017-03-18 14:03 - 00028672 _____ C:\Windows\system32\config\BCD-Template
2017-04-21 16:44 - 2017-03-18 14:03 - 00000000 ___HD C:\Windows\system32\GroupPolicy
2017-04-21 16:26 - 2017-03-18 14:03 - 00000000 ____D C:\ProgramData\USOPrivate
2017-04-21 16:18 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\system32\spool
2017-04-21 16:18 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\system32\FxsTmp
2017-04-21 16:17 - 2017-03-18 14:03 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2017-04-21 16:15 - 2017-03-18 04:40 - 00000000 ____D C:\Windows\system32\Sysprep
2017-04-21 16:12 - 2017-03-18 19:31 - 00000000 ____D C:\Windows\HoloShell
2017-04-21 16:12 - 2017-03-18 14:03 - 00000000 ___RD C:\Windows\PrintDialog
2017-04-21 16:12 - 2017-03-18 14:03 - 00000000 ___RD C:\Windows\MiracastView
2017-04-21 16:11 - 2017-03-18 04:40 - 00032768 _____ C:\Windows\system32\config\ELAM
Some files in TEMP:
====================
2017-04-21 16:31 - 2017-03-18 13:57 - 1930320 _____ (Microsoft Corporation) C:\Users\Neeko\AppData\Local\Temp\dllnt_dump.dll
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2017-05-08 03:04
==================== End of FRST.txt ============================
 
Thank you!
Link to post
Share on other sites

I posted about a week ago and no one has checked the topic it seems. But im not 100% sure i have a virus, but my disk usage spikes to 60-99% regularly on my windows 10. I have installed game patches and mods so im not sure if i picked up anything bad. I have scanned the computer with Sophos which detected no threats to my system, but i dont have malwarebytes i just use windows defender for day to day protection. Let me know if theres anythig else i can do, thank you.

Link to post
Share on other sites

  • Root Admin

Hello @Jwinebago382

Sorry for the delay. I've been out of the office for a couple weeks which has left the forums with one less helper.

Please restart the computer first and then run the following steps and post back the logs when ready.

STEP 01
Please download Junkware Removal Tool to your desktop.

  • Shutdown your antivirus to avoid any conflicts.
  • Right click over JRT.exe and select Run as administrator on Windows Vista or Windows 7, double-click on XP.
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next reply message
  • When completed make sure to re-enable your antivirus

STEP 02

adwcleaner_new.png Fix with AdwCleaner

Please download AdwCleaner by Xplode and save the file to your Desktop.

  • Right-click on adwcleaner_new.png icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
  • Accept the Terms of use.
  • Wait until the database is updated.
  • Click Scan.
  • When finished, please click Clean.
  • Your PC should reboot now.
  • After reboot, logfile will be opened. Copy its content into your next reply.

Note: Reports will be saved in your system partition, usually at C:\Adwcleaner

STEP 03
Download Sophos Free Virus Removal Tool and save it to your desktop.
 

  • Double click the icon and select Run
  • Click Next
  • Select I accept the terms in this license agreement, then click Next twice
  • Click Install
  • Click Finish to launch the program
  • Once the virus database has been updated click Start Scanning
  • If any threats are found click Details, then View Log file (bottom left-hand corner)
  • Copy and paste the results in your reply
  • Close the Notepad document, close the Threat Details screen, then click Start cleanup
  • Click Exit to close the program
  • If no threats were found, please confirm that result.

STEP 04
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

  • Double-click to run it. When the tool opens, click Yes to disclaimer.
  • Press the Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
  • The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
  • Please attach the Additions.txt log to your reply as well.

 

Thanks

Link to post
Share on other sites

Hi,

So when I got this on 5/16/2017, I lost the opera(default internet browser) shortcut on my admin profile, which seemed weird at the time. I've been using the desktop since then because I haven't experienced any other issues. Today 5/25/2017 I received a notification from Windows Defender saying that there were 0 threats in my system, but one quarantined. So I clicked the notification which took me to the defender program where one file called SupportScam:JS/TechBrolo.AA was quarantined.

 

I clicked more details for the file which presented a page that said the file status is "unknown." This seems very strange to me, since this could mean this file is still active though my windows defender said it was quarantined. Anyways Here is the stuff, also I haven't been able to get back to the quarantined file pen in windows defender.

 

JRT

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.3 (04.10.2017)
Operating System: Windows 10 Home x64
Ran by Neeko (Administrator) on Thu 05/25/2017 at 19:05:54.55
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

File System: 0
 

Registry: 0
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Thu 05/25/2017 at 19:08:01.93
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
adwcleaner
# AdwCleaner v6.047 - Logfile created 25/05/2017 at 14:22:05
# Updated on 19/05/2017 by Malwarebytes
# Database : 2017-05-19.1 [Local]
# Operating System : Windows 10 Home  (X64)
# Username : Neeko - DESKTOP-M7IRLC6
# Running from : C:\Users\Neeko\Desktop\AdwCleaner.exe
# Mode: Scan
# Support : https://www.malwarebytes.com/support
 
***** [ Services ] *****
No malicious services found.

***** [ Folders ] *****
No malicious folders found.

***** [ Files ] *****
No malicious files found.

***** [ DLL ] *****
No malicious DLLs found.

***** [ WMI ] *****
No malicious keys found.

***** [ Shortcuts ] *****
No infected shortcut found.

***** [ Scheduled Tasks ] *****
No malicious task found.

***** [ Registry ] *****
No malicious registry entries found.

***** [ Web browsers ] *****
No malicious Firefox based browser items found.
No malicious Chromium based browser items found.
*************************
C:\AdwCleaner\AdwCleaner[S0].txt - [990 Bytes] - [25/05/2017 14:22:05]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1062 Bytes] ##########
 
 
FRST
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 24-05-2017
Ran by Neeko (administrator) on DESKTOP-M7IRLC6 (25-05-2017 18:38:02)
Running from C:\Users\Neeko\Desktop
Loaded Profiles: Neeko (Available Profiles: Neeko & Rick 0)
Platform: Windows 10 Home Version 1703 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Edge)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(HP) C:\Windows\System32\hpservice.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe
(Intel Corporation) C:\Windows\System32\Intel\DPTF\esif_uf.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
(RaMMicHaeL) C:\Program Files (x86)\Unchecky\bin\unchecky_svc.exe
(Synaptics Incorporated) C:\Windows\System32\valWBFPolicyService.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(MyCity) C:\Program Files (x86)\MCShield\MCShieldRTM.exe
(Intel Corporation) C:\Windows\Temp\DPTF\esif_assist_64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(RaMMicHaeL) C:\Program Files (x86)\Unchecky\bin\unchecky_bg.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
==================== Registry (Whitelisted) ====================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [629152 2017-03-18] (Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8843520 2016-01-28] (Realtek Semiconductor)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [303928 2017-03-22] (Apple Inc.)
HKU\S-1-5-21-166261395-844033189-1565394352-1001\...\Run: [MCShield Monitor] => C:\Program Files (x86)\MCShield\MCShieldRTM.exe [650816 2014-04-11] (MyCity)
HKU\S-1-5-21-166261395-844033189-1565394352-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3019552 2017-04-25] (Valve Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 66.253.214.16 50.30.184.16
Tcpip\..\Interfaces\{4b71d5e5-183c-42bf-abcf-210136008644}: [DhcpNameServer] 66.253.214.16 50.30.184.16
Tcpip\..\Interfaces\{9a33da33-3bcb-4a80-b5e2-687e90d240a5}: [DhcpNameServer] 66.253.214.16 50.30.184.16
Internet Explorer:
==================
FireFox:
========
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll [2017-04-28] ()
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2017-03-17] (Apple Inc.)
R2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2286848 2015-10-01] (Broadcom Corporation.)
R2 esifsvc; C:\Windows\system32\Intel\DPTF\esif_uf.exe [2219072 2016-10-25] (Intel Corporation)
R2 hpsrv; C:\Windows\system32\Hpservice.exe [38728 2016-10-12] (HP)
R2 igfxCUIService2.0.0.0; C:\Windows\system32\igfxCUIService.exe [373720 2017-01-13] (Intel Corporation)
R2 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [458176 2017-03-29] (NVIDIA Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [310016 2016-01-28] (Realtek Semiconductor)
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [269400 2016-10-05] (Synaptics Incorporated)
R2 Unchecky; C:\Program Files (x86)\Unchecky\bin\unchecky_svc.exe [304408 2017-04-22] (RaMMicHaeL)
R2 valWBFPolicyService; C:\Windows\system32\valWBFPolicyService.exe [100384 2016-03-09] (Synaptics Incorporated)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [342264 2017-03-18] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [102816 2017-03-18] (Microsoft Corporation)
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 Accelerometer; C:\Windows\system32\DRIVERS\Accelerometer.sys [56128 2016-10-12] (HP)
R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [177440 2016-01-27] (Broadcom Corporation.)
R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [7585280 2017-03-18] (Broadcom Corporation)
R3 dptf_acpi; C:\Windows\System32\drivers\dptf_acpi.sys [72592 2016-10-25] (Intel Corporation)
R3 dptf_cpu; C:\Windows\System32\drivers\dptf_cpu.sys [67984 2016-10-25] (Intel Corporation)
R3 esif_lf; C:\Windows\system32\DRIVERS\esif_lf.sys [355216 2016-10-25] (Intel Corporation)
R0 hpdskflt; C:\Windows\System32\DRIVERS\hpdskflt.sys [42312 2016-10-12] (HP)
R1 MpKsl8e27ddaf; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{2869278D-6DDC-4E76-A154-B737EC625829}\MpKsl8e27ddaf.sys [44928 2017-05-25] (Microsoft Corporation)
R3 nvlddmkm; C:\Windows\System32\DriverStore\FileRepository\nvhm.inf_amd64_0460fff687def1f0\nvlddmkm.sys [14378544 2017-04-11] (NVIDIA Corporation)
R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [604160 2017-03-18] (Realtek                                            )
S3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [760968 2017-02-23] (Realsil Semiconductor Corporation)
S3 SDFRd; C:\Windows\System32\drivers\SDFRd.sys [31128 2017-03-18] ()
S2 SecDrv; C:\Windows\SysWOW64\drivers\SECDRV.SYS [11973 2017-05-24] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [File not signed]
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [79960 2016-10-05] (Synaptics Incorporated)
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44632 2017-03-18] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [294816 2017-03-18] (Microsoft Corporation)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [121248 2017-03-18] (Microsoft Corporation)
R3 WirelessButtonDriver64; C:\Windows\system32\DRIVERS\WirelessButtonDriver64.sys [31656 2016-04-13] (HP)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-05-25 18:38 - 2017-05-25 18:38 - 00007905 _____ C:\Users\Neeko\Desktop\FRST.txt
2017-05-25 14:37 - 2017-05-25 14:40 - 00000000 ____D C:\Windows\Microsoft Antimalware
2017-05-25 14:24 - 2017-05-25 14:24 - 00002775 _____ C:\Users\Public\Desktop\Sophos Virus Removal Tool.lnk
2017-05-25 14:24 - 2017-05-25 14:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sophos
2017-05-25 14:24 - 2017-05-25 14:24 - 00000000 ____D C:\Program Files (x86)\Sophos
2017-05-25 14:22 - 2017-05-25 14:22 - 00001141 _____ C:\Users\Neeko\Desktop\AdwCleaner[S0].txt
2017-05-25 14:20 - 2017-05-25 14:22 - 00000000 ____D C:\AdwCleaner
2017-05-25 14:20 - 2017-05-25 14:20 - 00000555 _____ C:\Users\Neeko\Desktop\JRT.txt
2017-05-25 14:10 - 2017-05-25 14:10 - 04110280 _____ C:\Users\Neeko\Desktop\AdwCleaner.exe
2017-05-25 14:03 - 2017-05-25 14:04 - 01663672 _____ (Malwarebytes) C:\Users\Neeko\Desktop\JRT.exe
2017-05-24 11:49 - 2017-05-24 11:49 - 00001675 _____ C:\Users\Neeko\Desktop\VTM Bloodlines Unofficial Patch.lnk
2017-05-24 02:32 - 2017-05-24 02:32 - 00000000 ____D C:\Users\Neeko\AppData\Local\DBG
2017-05-24 02:32 - 2017-05-24 02:32 - 00000000 ____D C:\Users\Neeko\AppData\Local\CrashDumps
2017-05-24 02:22 - 2017-05-24 02:24 - 00011973 _____ (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) C:\Windows\SysWOW64\Drivers\SECDRV.SYS
2017-05-24 02:08 - 2017-05-24 11:49 - 00001705 _____ C:\Users\Neeko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VTM Bloodlines Unofficial Patch.lnk
2017-05-24 01:48 - 2017-05-24 01:51 - 481960598 _____ (Werner Spahl ) C:\Users\Rick 0\Downloads\VTMBup97.exe
2017-05-23 15:03 - 2017-05-23 15:04 - 02983934 _____ C:\Users\Rick 0\Downloads\Leyda, Selection from Kino.pdf
2017-05-23 12:06 - 2017-05-23 12:06 - 55917364 _____ C:\Users\Rick 0\Downloads\Pastel - Closer.wav
2017-05-23 11:42 - 2017-05-23 11:45 - 00000000 ____D C:\Users\Rick 0\Documents\VirtualDJ
2017-05-23 11:42 - 2017-05-23 11:42 - 00001023 _____ C:\Users\Rick 0\Desktop\VirtualDJ 8.lnk
2017-05-23 11:42 - 2017-05-23 11:42 - 00000000 ____D C:\Users\Rick 0\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VirtualDJ
2017-05-23 11:42 - 2017-05-23 11:42 - 00000000 ____D C:\Program Files (x86)\VirtualDJ
2017-05-20 17:39 - 2017-05-20 17:39 - 00000214 _____ C:\Windows\Tasks\CreateExplorerShellUnelevatedTask.job
2017-05-19 19:17 - 2017-05-19 19:17 - 00000995 _____ C:\Users\Rick 0\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Saved Pictures.lnk
2017-05-16 16:01 - 2017-05-25 18:37 - 00000000 ____D C:\Users\Neeko\Desktop\FRST-OlderVersion
2017-05-16 11:30 - 2017-05-24 02:40 - 00000000 ____D C:\Users\Neeko\AppData\Local\Steam
2017-05-16 11:30 - 2017-05-16 11:30 - 00000000 ____D C:\Users\Neeko\AppData\Local\CEF
2017-05-15 16:57 - 2017-05-15 16:57 - 00634989 _____ C:\Users\Rick 0\Downloads\pathe and other film industry history the decline of euro film.pdf
2017-05-14 17:20 - 2017-05-14 17:20 - 03068415 _____ C:\Users\Rick 0\Downloads\Stam, The Structuring Absences of Silent Cinema.pdf
2017-05-14 17:20 - 2017-05-14 17:20 - 02090697 _____ C:\Users\Rick 0\Downloads\Stewart, We Were Never Immigrants.pdf
2017-05-14 17:18 - 2017-05-14 17:18 - 06436284 _____ C:\Users\Rick 0\Downloads\Abel French Film Industry.pdf
2017-05-14 17:18 - 2017-05-14 17:18 - 05206731 _____ C:\Users\Rick 0\Downloads\Abel, The French Rooster Rules the Roost.pdf
2017-05-14 17:04 - 2017-05-14 17:04 - 00593102 _____ C:\Users\Rick 0\Downloads\Film History I FSP 17.pdf
2017-05-14 17:03 - 2017-05-14 17:03 - 04341528 _____ C:\Users\Rick 0\Downloads\Pathé.pptx
2017-05-13 14:13 - 2017-05-13 14:13 - 00646089 _____ C:\Users\Rick 0\Downloads\Abelson_Night and Day.pdf
2017-05-11 20:31 - 2017-05-11 20:33 - 00000000 ____D C:\Users\Rick 0\Downloads\ps 205
2017-05-11 12:57 - 2017-05-23 14:41 - 00000000 ____D C:\Users\Rick 0\Downloads\film 381
2017-05-10 12:08 - 2017-05-15 18:07 - 00000000 ____D C:\Users\Rick 0\Documents\Sound recordings
2017-05-09 22:52 - 2017-04-27 18:38 - 01411128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32full.dll
2017-05-09 22:52 - 2017-04-27 18:12 - 01604312 _____ (Microsoft Corporation) C:\Windows\system32\gdi32full.dll
2017-05-09 22:52 - 2017-04-27 18:12 - 00543640 _____ (Microsoft Corporation) C:\Windows\system32\securekernel.exe
2017-05-09 22:52 - 2017-04-27 18:11 - 02158544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2017-05-09 22:52 - 2017-04-27 18:08 - 08320920 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2017-05-09 22:52 - 2017-04-27 18:07 - 06759512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Media.Protection.PlayReady.dll
2017-05-09 22:52 - 2017-04-27 18:03 - 00667040 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2017-05-09 22:52 - 2017-04-27 18:00 - 02444192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2017-05-09 22:52 - 2017-04-27 17:59 - 02635336 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2017-05-09 22:52 - 2017-04-27 17:59 - 00388000 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBXHCI.SYS
2017-05-09 22:52 - 2017-04-27 17:56 - 07904784 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.Protection.PlayReady.dll
2017-05-09 22:52 - 2017-04-27 17:52 - 02957824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32kfull.sys
2017-05-09 22:52 - 2017-04-27 17:51 - 20505600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\edgehtml.dll
2017-05-09 22:52 - 2017-04-27 17:46 - 19335168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2017-05-09 22:52 - 2017-04-27 17:46 - 00329728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webplatstorageserver.dll
2017-05-09 22:52 - 2017-04-27 17:44 - 00338432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2017-05-09 22:52 - 2017-04-27 17:44 - 00266240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2017-05-09 22:52 - 2017-04-27 17:42 - 00806400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\StoreAgent.dll
2017-05-09 22:52 - 2017-04-27 17:42 - 00663040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2017-05-09 22:52 - 2017-04-27 17:42 - 00636416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WpcWebFilter.dll
2017-05-09 22:52 - 2017-04-27 17:42 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InstallAgentUserBroker.exe
2017-05-09 22:52 - 2017-04-27 17:40 - 11870208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2017-05-09 22:52 - 2017-04-27 17:40 - 06292992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Chakra.dll
2017-05-09 22:52 - 2017-04-27 17:40 - 02008576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2017-05-09 22:52 - 2017-04-27 17:40 - 00328704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InstallAgent.exe
2017-05-09 22:52 - 2017-04-27 17:39 - 05225984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2017-05-09 22:52 - 2017-04-27 17:39 - 02859520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2017-05-09 22:52 - 2017-04-27 17:38 - 03667456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_47.dll
2017-05-09 22:52 - 2017-04-27 17:38 - 01019904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aadtb.dll
2017-05-09 22:52 - 2017-04-27 17:37 - 04559360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbgeng.dll
2017-05-09 22:52 - 2017-04-27 17:37 - 01626624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2017-05-09 22:52 - 2017-04-27 17:26 - 23677440 _____ (Microsoft Corporation) C:\Windows\system32\edgehtml.dll
2017-05-09 22:52 - 2017-04-27 17:15 - 03672064 _____ (Microsoft Corporation) C:\Windows\system32\win32kfull.sys
2017-05-09 22:52 - 2017-04-27 17:11 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\BasicRender.sys
2017-05-09 22:52 - 2017-04-27 17:08 - 00457728 _____ (Microsoft Corporation) C:\Windows\system32\webplatstorageserver.dll
2017-05-09 22:52 - 2017-04-27 17:08 - 00096256 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2017-05-09 22:52 - 2017-04-27 17:06 - 00386560 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2017-05-09 22:52 - 2017-04-27 17:06 - 00274944 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2017-05-09 22:52 - 2017-04-27 17:05 - 01075712 _____ (Microsoft Corporation) C:\Windows\system32\StoreAgent.dll
2017-05-09 22:52 - 2017-04-27 17:05 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2017-05-09 22:52 - 2017-04-27 17:04 - 23681024 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2017-05-09 22:52 - 2017-04-27 17:04 - 00422400 _____ (Microsoft Corporation) C:\Windows\system32\WpAXHolder.dll
2017-05-09 22:52 - 2017-04-27 17:04 - 00416256 _____ (Microsoft Corporation) C:\Windows\system32\InstallAgentUserBroker.exe
2017-05-09 22:52 - 2017-04-27 17:03 - 00925696 _____ (Microsoft Corporation) C:\Windows\system32\WpcWebFilter.dll
2017-05-09 22:52 - 2017-04-27 17:03 - 00751104 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2017-05-09 22:52 - 2017-04-27 17:01 - 02077184 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2017-05-09 22:52 - 2017-04-27 17:00 - 08244736 _____ (Microsoft Corporation) C:\Windows\system32\Chakra.dll
2017-05-09 22:52 - 2017-04-27 16:59 - 04396032 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_47.dll
2017-05-09 22:52 - 2017-04-27 16:59 - 03307008 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2017-05-09 22:52 - 2017-04-27 16:59 - 02056192 _____ (Microsoft Corporation) C:\Windows\system32\win32kbase.sys
2017-05-09 22:52 - 2017-04-27 16:59 - 01293824 _____ (Microsoft Corporation) C:\Windows\system32\aadtb.dll
2017-05-09 22:52 - 2017-04-27 16:59 - 00373760 _____ (Microsoft Corporation) C:\Windows\system32\InstallAgent.exe
2017-05-09 22:52 - 2017-04-27 16:58 - 12787200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2017-05-09 22:52 - 2017-04-27 16:57 - 05557760 _____ (Microsoft Corporation) C:\Windows\system32\dbgeng.dll
2017-05-09 22:52 - 2017-04-27 16:57 - 01803264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2017-05-09 22:51 - 2017-04-27 18:19 - 01839872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2017-05-09 22:51 - 2017-04-27 18:19 - 00605936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2017-05-09 22:51 - 2017-04-27 18:18 - 02259760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CoreUIComponents.dll
2017-05-09 22:51 - 2017-04-27 18:16 - 00599576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2017-05-09 22:51 - 2017-04-27 18:09 - 01557288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2017-05-09 22:51 - 2017-04-27 18:08 - 02399728 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2017-05-09 22:51 - 2017-04-27 18:08 - 02330520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\combase.dll
2017-05-09 22:51 - 2017-04-27 18:08 - 00775824 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2017-05-09 22:51 - 2017-04-27 18:07 - 00988168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2017-05-09 22:51 - 2017-04-27 18:06 - 02969880 _____ (Microsoft Corporation) C:\Windows\system32\CoreUIComponents.dll
2017-05-09 22:51 - 2017-04-27 18:06 - 00708712 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2017-05-09 22:51 - 2017-04-27 18:05 - 00923040 _____ (Microsoft Corporation) C:\Windows\system32\CoreMessaging.dll
2017-05-09 22:51 - 2017-04-27 18:04 - 00583160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CoreMessaging.dll
2017-05-09 22:51 - 2017-04-27 17:59 - 05477088 _____ (Microsoft Corporation) C:\Windows\system32\OneCoreUAPCommonProxyStub.dll
2017-05-09 22:51 - 2017-04-27 17:59 - 00207264 _____ (Microsoft Corporation) C:\Windows\system32\browserbroker.dll
2017-05-09 22:51 - 2017-04-27 17:59 - 00027040 _____ (Microsoft Corporation) C:\Windows\system32\browser_broker.exe
2017-05-09 22:51 - 2017-04-27 17:58 - 01852776 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2017-05-09 22:51 - 2017-04-27 17:58 - 00872472 _____ (Microsoft Corporation) C:\Windows\system32\ClipSVC.dll
2017-05-09 22:51 - 2017-04-27 17:57 - 03116184 _____ (Microsoft Corporation) C:\Windows\system32\combase.dll
2017-05-09 22:51 - 2017-04-27 17:55 - 21353200 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2017-05-09 22:51 - 2017-04-27 17:55 - 01325456 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2017-05-09 22:51 - 2017-04-27 17:53 - 00387928 _____ (Microsoft Corporation) C:\Windows\system32\wmpps.dll
2017-05-09 22:51 - 2017-04-27 17:52 - 00790528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.dll
2017-05-09 22:51 - 2017-04-27 17:52 - 00584192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIRibbonRes.dll
2017-05-09 22:51 - 2017-04-27 17:49 - 00072192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2017-05-09 22:51 - 2017-04-27 17:49 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\odbcconf.dll
2017-05-09 22:51 - 2017-04-27 17:46 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2017-05-09 22:51 - 2017-04-27 17:45 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2017-05-09 22:51 - 2017-04-27 17:41 - 01248768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AzureSettingSyncProvider.dll
2017-05-09 22:51 - 2017-04-27 17:40 - 00799232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TokenBroker.dll
2017-05-09 22:51 - 2017-04-27 17:40 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cldapi.dll
2017-05-09 22:51 - 2017-04-27 17:39 - 03655680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2017-05-09 22:51 - 2017-04-27 17:34 - 00891904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\autochk.exe
2017-05-09 22:51 - 2017-04-27 17:33 - 00089088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\olepro32.dll
2017-05-09 22:51 - 2017-04-27 17:15 - 01051648 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.dll
2017-05-09 22:51 - 2017-04-27 17:14 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\UIRibbonRes.dll
2017-05-09 22:51 - 2017-04-27 17:11 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2017-05-09 22:51 - 2017-04-27 17:11 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\odbcconf.dll
2017-05-09 22:51 - 2017-04-27 17:09 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2017-05-09 22:51 - 2017-04-27 17:09 - 00064512 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2017-05-09 22:51 - 2017-04-27 17:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\SettingsEnvironment.Desktop.dll
2017-05-09 22:51 - 2017-04-27 17:07 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2017-05-09 22:51 - 2017-04-27 17:06 - 01302528 _____ (Microsoft Corporation) C:\Windows\system32\MSVPXENC.dll
2017-05-09 22:51 - 2017-04-27 17:06 - 00527360 _____ (Microsoft Corporation) C:\Windows\system32\aadcloudap.dll
2017-05-09 22:51 - 2017-04-27 17:04 - 01878016 _____ (Microsoft Corporation) C:\Windows\system32\AzureSettingSyncProvider.dll
2017-05-09 22:51 - 2017-04-27 17:03 - 01085440 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2017-05-09 22:51 - 2017-04-27 17:03 - 01027584 _____ (Microsoft Corporation) C:\Windows\system32\modernexecserver.dll
2017-05-09 22:51 - 2017-04-27 17:03 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\cldapi.dll
2017-05-09 22:51 - 2017-04-27 17:02 - 01260544 _____ (Microsoft Corporation) C:\Windows\system32\GamePanel.exe
2017-05-09 22:51 - 2017-04-27 17:01 - 01886208 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentExtensions.onecore.dll
2017-05-09 22:51 - 2017-04-27 16:58 - 01054208 _____ (Microsoft Corporation) C:\Windows\system32\TokenBroker.dll
2017-05-09 22:51 - 2017-04-27 16:57 - 04730368 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2017-05-09 22:51 - 2017-04-27 16:57 - 02800128 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentServer.dll
2017-05-09 22:51 - 2017-04-27 16:54 - 00985600 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2017-05-09 22:51 - 2017-04-27 16:54 - 00970240 _____ (Microsoft Corporation) C:\Windows\system32\autochk.exe
2017-05-09 22:51 - 2017-04-27 16:54 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2017-05-09 22:51 - 2017-04-27 16:54 - 00414208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2017-05-09 22:51 - 2017-04-27 16:52 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.Streaming.ps.dll
2017-05-09 17:01 - 2017-05-09 17:01 - 00000759 _____ C:\Users\Rick 0\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\flashplayer_25_sa.lnk
2017-05-09 17:00 - 2017-05-09 17:00 - 14966264 _____ (Adobe Systems, Inc.) C:\Users\Rick 0\Documents\flashplayer_25_sa.exe
2017-05-09 16:53 - 2017-05-09 16:59 - 00004646 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier
2017-05-09 16:45 - 2017-05-09 16:59 - 00000000 ____D C:\Users\Neeko\AppData\Local\Adobe
2017-05-09 16:44 - 2017-05-09 16:59 - 00000000 ____D C:\Users\Rick 0\AppData\Local\Adobe
2017-05-09 16:35 - 2017-05-09 16:35 - 00000000 ____D C:\Users\Rick 0\Documents\sd thro
2017-05-08 22:26 - 2017-05-08 22:26 - 00000000 ____D C:\Users\Rick 0\AppData\LocalLow\Temp
2017-05-08 02:11 - 2017-05-08 02:11 - 00000000 ____D C:\Users\Rick 0\AppData\Local\Chromium
2017-05-08 02:08 - 2017-05-08 02:08 - 00000000 ____D C:\Users\Rick 0\AppData\Roaming\The Creative Assembly
2017-05-04 11:38 - 2017-05-04 11:38 - 00120000 _____ C:\Users\Rick 0\Documents\2016TurboTaxReturn.pdf
2017-05-04 00:32 - 2017-05-13 02:45 - 00000000 ____D C:\Users\Rick 0\AppData\Roaming\NVIDIA
2017-05-04 00:32 - 2017-05-04 00:32 - 00000000 ____D C:\Users\Rick 0\Documents\BioWare
2017-05-03 13:45 - 2017-05-03 13:45 - 00001166 _____ C:\Users\Public\Desktop\Mass Effect 2.lnk
2017-05-03 13:45 - 2017-05-03 13:45 - 00000000 ____D C:\Windows\SysWOW64\AGEIA
2017-05-03 13:45 - 2017-05-03 13:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2017-05-03 13:45 - 2017-05-03 13:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mass Effect 2
2017-05-03 13:45 - 2017-05-03 13:45 - 00000000 ____D C:\Program Files (x86)\AGEIA Technologies
2017-05-03 13:15 - 2017-05-03 13:32 - 00000000 ____D C:\Program Files (x86)\Mass Effect 2
2017-05-02 18:55 - 2017-05-19 19:53 - 00000000 ____D C:\Users\Rick 0\AppData\Roaming\Origin
2017-05-02 18:52 - 2017-05-02 18:56 - 00000000 ____D C:\Users\Rick 0\AppData\Local\Origin
2017-05-02 18:52 - 2017-05-02 18:52 - 00000000 ____D C:\Users\Rick 0\.QtWebEngineProcess
2017-05-02 18:52 - 2017-05-02 18:52 - 00000000 ____D C:\Users\Rick 0\.Origin
2017-04-29 23:07 - 2017-04-18 23:18 - 00118784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netvsc.sys
2017-04-29 23:07 - 2017-04-18 23:13 - 00980992 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bthport.sys
2017-04-29 23:07 - 2017-04-18 22:58 - 20374424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2017-04-29 23:07 - 2017-04-18 22:36 - 01291776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSVPXENC.dll
2017-04-29 23:07 - 2017-04-18 22:34 - 00507392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2017-04-29 23:07 - 2017-04-18 22:30 - 00909312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSyncCore.dll
2017-04-29 23:07 - 2017-04-18 22:29 - 02298880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2017-04-29 23:07 - 2017-04-13 16:43 - 04469832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2017-04-29 23:07 - 2017-04-13 16:31 - 01611776 _____ (Microsoft Corporation) C:\Windows\system32\SpeechPal.dll
2017-04-29 23:07 - 2017-04-13 16:21 - 06728192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2017-04-29 23:07 - 2017-04-13 16:18 - 00731136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmgaserver.exe
2017-04-29 23:07 - 2017-04-13 16:18 - 00362496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\daxexec.dll
2017-04-29 23:07 - 2017-04-13 16:13 - 00354304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InputSwitch.dll
2017-04-29 23:06 - 2017-04-19 00:06 - 00651680 _____ (Microsoft Corporation) C:\Windows\system32\SettingSyncHost.exe
2017-04-29 23:06 - 2017-04-19 00:04 - 00142240 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wcifs.sys
2017-04-29 23:06 - 2017-04-19 00:02 - 00716440 _____ (Microsoft Corporation) C:\Windows\system32\MSVideoDSP.dll
2017-04-29 23:06 - 2017-04-18 23:19 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\musdialoghandlers.dll
2017-04-29 23:06 - 2017-04-18 23:13 - 00585728 _____ (Microsoft Corporation) C:\Windows\system32\OneDriveSettingSyncProvider.dll
2017-04-29 23:06 - 2017-04-18 23:12 - 00805888 _____ (Microsoft Corporation) C:\Windows\system32\ieproxy.dll
2017-04-29 23:06 - 2017-04-18 23:12 - 00590848 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2017-04-29 23:06 - 2017-04-18 23:12 - 00203776 _____ (Microsoft Corporation) C:\Windows\system32\PackageStateRoaming.dll
2017-04-29 23:06 - 2017-04-18 23:11 - 04446208 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers_nt.dll
2017-04-29 23:06 - 2017-04-18 23:10 - 04175872 _____ (Microsoft Corporation) C:\Windows\system32\StartTileData.dll
2017-04-29 23:06 - 2017-04-18 23:10 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Shell.UnifiedTile.CuratedTileCollections.dll
2017-04-29 23:06 - 2017-04-18 23:10 - 01600512 _____ (Microsoft Corporation) C:\Windows\system32\dbghelp.dll
2017-04-29 23:06 - 2017-04-18 23:08 - 01103872 _____ (Microsoft Corporation) C:\Windows\system32\SettingSyncCore.dll
2017-04-29 23:06 - 2017-04-18 23:07 - 01242624 _____ (Microsoft Corporation) C:\Windows\system32\SharedStartModel.dll
2017-04-29 23:06 - 2017-04-18 23:07 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2017-04-29 23:06 - 2017-04-18 23:06 - 02651648 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2017-04-29 23:06 - 2017-04-18 23:04 - 01356800 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2017-04-29 23:06 - 2017-04-18 23:04 - 00624640 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll
2017-04-29 23:06 - 2017-04-18 23:02 - 00559000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSyncHost.exe
2017-04-29 23:06 - 2017-04-18 23:01 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\catsrvps.dll
2017-04-29 23:06 - 2017-04-18 22:59 - 02435584 _____ (Microsoft Corporation) C:\Windows\system32\ResetEngine.dll
2017-04-29 23:06 - 2017-04-18 22:37 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WiFiDisplay.dll
2017-04-29 23:06 - 2017-04-18 22:35 - 00476672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\OneDriveSettingSyncProvider.dll
2017-04-29 23:06 - 2017-04-18 22:34 - 00358400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieproxy.dll
2017-04-29 23:06 - 2017-04-18 22:34 - 00175616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PackageStateRoaming.dll
2017-04-29 23:06 - 2017-04-18 22:32 - 01285120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbghelp.dll
2017-04-29 23:06 - 2017-04-13 17:35 - 04848440 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2017-04-29 23:06 - 2017-04-13 17:33 - 02085280 _____ (Microsoft Corporation) C:\Windows\system32\UpdateAgent.dll
2017-04-29 23:06 - 2017-04-13 17:30 - 00105456 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2017-04-29 23:06 - 2017-04-13 16:43 - 00523296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppResolver.dll
2017-04-29 23:06 - 2017-04-13 16:41 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\mssprxy.dll
2017-04-29 23:06 - 2017-04-13 16:40 - 00095584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2017-04-29 23:06 - 2017-04-13 16:39 - 07931392 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2017-04-29 23:06 - 2017-04-13 16:39 - 00974848 _____ (Microsoft Corporation) C:\Windows\system32\mmgaserver.exe
2017-04-29 23:06 - 2017-04-13 16:39 - 00334336 _____ (Microsoft Corporation) C:\Windows\system32\wc_storage.dll
2017-04-29 23:06 - 2017-04-13 16:39 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\VEStoreEventHandlers.dll
2017-04-29 23:06 - 2017-04-13 16:38 - 00251904 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Gaming.Preview.dll
2017-04-29 23:06 - 2017-04-13 16:37 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\NotificationObjFactory.dll
2017-04-29 23:06 - 2017-04-13 16:35 - 01433600 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettings.Handlers.dll
2017-04-29 23:06 - 2017-04-13 16:35 - 00510976 _____ (Microsoft Corporation) C:\Windows\system32\TDLMigration.dll
2017-04-29 23:06 - 2017-04-13 16:35 - 00257024 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2017-04-29 23:06 - 2017-04-13 16:34 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\InputSwitch.dll
2017-04-29 23:06 - 2017-04-13 16:33 - 01269760 _____ (Microsoft Corporation) C:\Windows\system32\enterprisecsps.dll
2017-04-29 23:06 - 2017-04-13 16:31 - 00673280 _____ (Microsoft Corporation) C:\Windows\system32\LockAppBroker.dll
2017-04-29 23:06 - 2017-04-13 16:29 - 01583616 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2017-04-29 23:06 - 2017-04-13 16:29 - 01295872 _____ (Microsoft Corporation) C:\Windows\system32\dosvc.dll
2017-04-29 23:06 - 2017-04-13 16:26 - 01257472 _____ (Microsoft Corporation) C:\Windows\system32\wpnapps.dll
2017-04-29 23:06 - 2017-04-13 16:25 - 00750080 _____ (Microsoft Corporation) C:\Windows\system32\StorSvc.dll
2017-04-29 23:06 - 2017-04-13 16:24 - 01628160 _____ (Microsoft Corporation) C:\Windows\system32\comsvcs.dll
2017-04-29 23:06 - 2017-04-13 16:21 - 00078848 _____ (Microsoft Corporation) C:\Windows\system32\offreg.dll
2017-04-29 23:06 - 2017-04-13 16:15 - 00282112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VEEventDispatcher.dll
2017-04-29 23:06 - 2017-04-13 16:15 - 00232448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CloudBackupSettings.dll
2017-04-29 23:06 - 2017-04-13 16:13 - 00232960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2017-04-29 23:06 - 2017-04-13 16:08 - 01463296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2017-04-29 23:06 - 2017-04-13 16:06 - 00987648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpnapps.dll
2017-04-29 23:06 - 2017-04-13 16:04 - 00392704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PlayToManager.dll
2017-04-29 23:06 - 2017-04-13 16:01 - 00057856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\offreg.dll
2017-04-29 23:05 - 2017-04-19 00:07 - 00712600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms2.sys
2017-04-29 23:05 - 2017-04-18 23:16 - 00280064 _____ (Microsoft Corporation) C:\Windows\system32\WiFiDisplay.dll
2017-04-29 23:05 - 2017-04-18 23:15 - 00232960 _____ (Microsoft Corporation) C:\Windows\system32\wcmcsp.dll
2017-04-29 23:05 - 2017-04-18 23:14 - 00646656 _____ (Microsoft Corporation) C:\Windows\system32\LockHostingFramework.dll
2017-04-29 23:05 - 2017-04-18 23:13 - 00409600 _____ (Microsoft Corporation) C:\Windows\system32\updatehandlers.dll
2017-04-29 23:05 - 2017-04-18 23:11 - 00687104 _____ (Microsoft Corporation) C:\Windows\system32\LogonController.dll
2017-04-29 23:05 - 2017-04-18 23:08 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\usocore.dll
2017-04-29 23:05 - 2017-04-18 22:59 - 01087488 _____ (Microsoft Corporation) C:\Windows\system32\reseteng.dll
2017-04-29 23:05 - 2017-04-13 17:35 - 00741784 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Internal.Shell.Broker.dll
2017-04-29 23:05 - 2017-04-13 17:35 - 00673112 _____ (Microsoft Corporation) C:\Windows\system32\AppResolver.dll
2017-04-29 23:05 - 2017-04-13 17:32 - 01320352 _____ (Microsoft Corporation) C:\Windows\system32\wpx.dll
2017-04-29 23:05 - 2017-04-13 16:41 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\EnterpriseModernAppMgmtCSP.dll
2017-04-29 23:05 - 2017-04-13 16:39 - 00517632 _____ (Microsoft Corporation) C:\Windows\system32\daxexec.dll
2017-04-29 23:05 - 2017-04-13 16:38 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.AppDefaults.dll
2017-04-29 23:05 - 2017-04-13 16:37 - 00450048 _____ (Microsoft Corporation) C:\Windows\system32\bcdedit.exe
2017-04-29 23:05 - 2017-04-13 16:37 - 00301056 _____ (Microsoft Corporation) C:\Windows\system32\EnterpriseAppMgmtSvc.dll
2017-04-29 23:05 - 2017-04-13 16:37 - 00246272 _____ (Microsoft Corporation) C:\Windows\system32\domgmt.dll
2017-04-29 23:05 - 2017-04-13 16:36 - 00524800 _____ (Microsoft Corporation) C:\Windows\system32\TileDataRepository.dll
2017-04-29 23:05 - 2017-04-13 16:36 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\CloudBackupSettings.dll
2017-04-29 23:05 - 2017-04-13 16:34 - 01468416 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentExtensions.desktop.dll
2017-04-29 23:05 - 2017-04-13 16:33 - 00864256 _____ (Microsoft Corporation) C:\Windows\system32\NotificationController.dll
2017-04-29 23:05 - 2017-04-13 16:29 - 02499584 _____ (Microsoft Corporation) C:\Windows\system32\twinui.pcshell.dll
2017-04-29 23:05 - 2017-04-13 16:29 - 00840192 _____ (Microsoft Corporation) C:\Windows\system32\fveapi.dll
2017-04-29 23:05 - 2017-04-13 16:29 - 00647168 _____ (Microsoft Corporation) C:\Windows\system32\RDXService.dll
2017-04-29 23:05 - 2017-04-13 16:28 - 02443776 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2017-04-28 19:07 - 2017-04-28 19:07 - 00000000 ____D C:\Users\Neeko\AppData\Roaming\Macromedia
2017-04-28 18:38 - 2017-04-28 18:38 - 00000000 ____D C:\Users\Rick 0\Documents\League of Legends
2017-04-28 18:32 - 2017-04-28 18:32 - 00067728 _____ C:\Users\Rick 0\Downloads\ListeningPortfolioSPAN202.pdf
2017-04-28 16:39 - 2017-04-28 16:39 - 00098256 _____ C:\Users\Rick 0\Downloads\ListeningPortfolio_Sugerencias_Spring2017.pdf
2017-04-28 16:30 - 2017-05-24 02:28 - 00000000 ____D C:\Users\Rick 0\AppData\Local\CrashDumps
2017-04-28 16:21 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2017-04-28 16:21 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2017-04-28 16:21 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll
2017-04-28 16:21 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll
2017-04-28 16:21 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2017-04-28 16:21 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2017-04-28 16:21 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2017-04-28 16:21 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll
2017-04-28 16:21 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll
2017-04-28 16:21 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_43.dll
2017-04-28 16:21 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll
2017-04-28 16:21 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll
2017-04-28 16:21 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll
2017-04-28 16:21 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll
2017-04-28 16:21 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2017-04-28 16:21 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2017-04-27 16:06 - 2017-04-27 16:06 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_esif_umdf2_02_00_00.Wdf
2017-04-27 16:06 - 2017-04-27 16:06 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_esif_lf_01011.Wdf
2017-04-27 16:05 - 2017-05-24 10:58 - 00000130 _____ C:\Users\Rick 0\Documents\New Text Document.txt
2017-04-27 16:05 - 2017-04-27 16:05 - 00000000 ____D C:\Windows\system32\Intel
2017-04-26 20:03 - 2017-04-26 20:03 - 00266367 _____ C:\Users\Rick 0\Downloads\EClare.pdf
2017-04-25 12:04 - 2017-04-25 12:04 - 00000000 ____D C:\Users\Rick 0\Documents\DAMN_
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-05-25 18:38 - 2017-04-21 16:47 - 00000000 ____D C:\FRST
2017-05-25 18:37 - 2017-04-21 16:42 - 02429952 _____ (Farbar) C:\Users\Neeko\Desktop\FRST64.exe
2017-05-25 18:29 - 2017-04-21 16:11 - 00000000 ____D C:\Windows\system32\SleepStudy
2017-05-25 16:07 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\AppReadiness
2017-05-25 14:10 - 2017-03-18 14:03 - 00000000 ___HD C:\Program Files\WindowsApps
2017-05-25 14:02 - 2017-04-22 11:06 - 00000000 ____D C:\ProgramData\MCShield
2017-05-25 14:01 - 2017-04-23 01:40 - 00000000 ____D C:\Program Files (x86)\Steam
2017-05-25 14:01 - 2017-04-21 16:30 - 00000180 _____ C:\Windows\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2017-05-25 14:01 - 2017-04-21 16:30 - 00000000 __SHD C:\Users\Neeko\IntelGraphicsProfiles
2017-05-25 13:51 - 2017-04-23 02:02 - 00000000 __SHD C:\Users\Rick 0\IntelGraphicsProfiles
2017-05-25 13:41 - 2017-04-22 11:09 - 00000000 ____D C:\ProgramData\NVIDIA
2017-05-25 13:41 - 2017-04-21 16:28 - 00000000 ____D C:\ProgramData\Synaptics
2017-05-25 13:41 - 2017-04-21 16:11 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-05-25 13:37 - 2017-03-18 04:40 - 01310720 _____ C:\Windows\system32\config\BBI
2017-05-25 13:31 - 2017-04-21 16:20 - 01595598 _____ C:\Windows\system32\PerfStringBackup.INI
2017-05-25 00:33 - 2017-04-23 02:01 - 00000000 ____D C:\Users\Rick 0
2017-05-24 13:55 - 2017-04-23 02:02 - 00000000 ____D C:\Users\Rick 0\AppData\Local\Packages
2017-05-24 01:42 - 2017-04-23 03:09 - 00000000 ____D C:\Users\Rick 0\Documents\My Games
2017-05-23 15:06 - 2017-04-23 11:43 - 00000000 ____D C:\Users\Rick 0\Documents\Moduntandblade mods
2017-05-23 10:56 - 2017-04-23 10:59 - 00000000 ____D C:\Windows\system32\MRT
2017-05-23 10:54 - 2017-04-23 10:58 - 132223576 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-05-19 19:21 - 2017-04-23 02:03 - 00000000 ____D C:\Users\Rick 0\AppData\Roaming\Apple Computer
2017-05-19 19:00 - 2017-04-23 02:12 - 00004214 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1492938726
2017-05-19 19:00 - 2017-04-23 02:12 - 00001433 _____ C:\Users\Rick 0\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2017-05-16 16:02 - 2017-03-18 14:01 - 00000000 ____D C:\Windows\INF
2017-05-16 11:30 - 2017-04-21 16:23 - 00000000 ____D C:\Users\Neeko\AppData\Local\Packages
2017-05-16 11:29 - 2017-04-21 16:23 - 00000000 __RHD C:\Users\Public\AccountPictures
2017-05-14 18:50 - 2017-04-23 11:53 - 00000000 ____D C:\Users\Rick 0\Documents\PSU
2017-05-12 13:53 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\rescache
2017-05-11 13:39 - 2017-04-23 16:02 - 00000000 ____D C:\Users\Rick 0\Desktop\Nexus Mod Manager
2017-05-11 13:39 - 2017-04-23 02:07 - 00000000 ____D C:\Users\Rick 0\Desktop\mods
2017-05-10 00:17 - 2017-04-21 16:11 - 00217000 _____ C:\Windows\system32\FNTCACHE.DAT
2017-05-10 00:15 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\system32\appraiser
2017-05-10 00:15 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\ShellExperiences
2017-05-10 00:15 - 2017-03-18 14:03 - 00000000 ____D C:\Program Files\Windows Photo Viewer
2017-05-10 00:15 - 2017-03-18 14:03 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2017-05-09 22:56 - 2017-03-18 13:51 - 00000000 ____D C:\Windows\CbsTemp
2017-05-09 16:59 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2017-05-09 16:59 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\system32\Macromed
2017-05-02 18:54 - 2017-04-23 11:13 - 00000000 ____D C:\ProgramData\Package Cache
2017-05-01 00:02 - 2017-03-18 14:03 - 00000000 ___SD C:\Windows\SysWOW64\F12
2017-05-01 00:02 - 2017-03-18 14:03 - 00000000 ___SD C:\Windows\system32\F12
2017-05-01 00:02 - 2017-03-18 14:03 - 00000000 ___RD C:\Windows\ImmersiveControlPanel
2017-05-01 00:02 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\SysWOW64\Dism
2017-05-01 00:02 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\system32\WinBioPlugIns
2017-05-01 00:02 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\Provisioning
2017-05-01 00:02 - 2017-03-18 04:40 - 00000000 ____D C:\Windows\system32\Dism
2017-04-28 18:38 - 2017-04-23 11:20 - 00001749 _____ C:\Users\Public\Desktop\League of Legends.lnk
2017-04-28 18:05 - 2017-03-18 14:06 - 00835576 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-04-28 18:05 - 2017-03-18 14:06 - 00177656 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-04-28 16:18 - 2017-03-18 14:03 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2017-04-26 10:38 - 2017-03-18 14:03 - 00000000 ____D C:\Windows\appcompat
Some files in TEMP:
====================
2017-04-21 16:31 - 2017-03-18 13:57 - 1930320 _____ (Microsoft Corporation) C:\Users\Neeko\AppData\Local\Temp\dllnt_dump.dll
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2017-05-24 11:09
==================== End of FRST.txt ============================
 
addition log
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-05-2017
Ran by Neeko (25-05-2017 18:38:40)
Running from C:\Users\Neeko\Desktop
Windows 10 Home Version 1703 (X64) (2017-04-21 23:17:14)
Boot Mode: Normal
==========================================================

==================== Accounts: =============================
Administrator (S-1-5-21-166261395-844033189-1565394352-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-166261395-844033189-1565394352-503 - Limited - Disabled)
Guest (S-1-5-21-166261395-844033189-1565394352-501 - Limited - Disabled)
Neeko (S-1-5-21-166261395-844033189-1565394352-1001 - Administrator - Enabled) => C:\Users\Neeko
Rick 0 (S-1-5-21-166261395-844033189-1565394352-1002 - Limited - Enabled) => C:\Users\Rick 0
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 16.04 (x64) (HKLM\...\7-Zip) (Version: 16.04 - Igor Pavlov)
Adobe Flash Player 11 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 11.1.102.55 - Adobe Systems Incorporated)
Adobe Flash Player 25 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 25.0.0.171 - Adobe Systems Incorporated)
Ansel (Version: 377.19 - NVIDIA Corporation) Hidden
Apple Application Support (32-bit) (HKLM-x32\...\{05E07D23-91E9-4E70-A4CC-EF505088F967}) (Version: 5.4.1 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{741291DA-2B34-4D44-8FB6-58EDE21261D8}) (Version: 5.4.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{DB18F1C0-846F-46F5-A074-5B97C8AF5C8E}) (Version: 10.3.1.2 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{52D87F32-70E4-4348-8148-C0B9F35B1314}) (Version: 2.3.0.177 - Apple Inc.)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Chivalry: Medieval Warfare (HKLM\...\Steam App 219640) (Version:  - Torn Banner Studios)
Intel(R) Chipset Device Software (x32 Version: 10.1.1.42 - Intel(R) Corporation) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.4549 - Intel Corporation)
iTunes (HKLM\...\{6C01A0A7-7440-4D48-93C6-2927A1E93FE6}) (Version: 12.6.0.100 - Apple Inc.)
League of Legends (HKLM-x32\...\League of Legends 4.1.2) (Version: 4.1.2 - Riot Games)
League of Legends (x32 Version: 4.1.2 - Riot Games) Hidden
Mass Effect 2 (HKLM-x32\...\{75D84EF7-0D8C-4e70-B3FA-7B42A5D4E0EB}) (Version: 1.00 - Electronic Arts, Inc.)
MCShield ::Anti-Malware Tool:: (HKLM-x32\...\MCShield) (Version: 3.0.5.28 - MyCity)
Microsoft OneDrive (HKU\S-1-5-21-166261395-844033189-1565394352-1001\...\OneDriveSetup.exe) (Version: 17.3.6816.0313 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Nexus Mod Manager (HKLM\...\6af12c54-643b-4752-87d0-8335503010de_is1) (Version: 0.63.14 - Black Tree Gaming)
No More Room in Hell (HKLM\...\Steam App 224260) (Version:  - No More Room in Hell Team)
NVIDIA Graphics Driver 377.19 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 377.19 - NVIDIA Corporation)
NVIDIA PhysX (HKLM-x32\...\{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}) (Version: 9.09.0814 - NVIDIA Corporation)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7730 - Realtek Semiconductor Corp.)
Sophos Virus Removal Tool (HKLM-x32\...\{B829E117-D072-41EA-9606-9826A38D34C1}) (Version: 2.5.6 - Sophos Limited)
STAR WARS™ Jedi Knight: Jedi Academy™ (HKLM\...\Steam App 6020) (Version:  - Raven Software)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Synaptics ClickPad Driver (HKLM\...\SynTPDeinstKey) (Version: 19.2.4.10 - Synaptics Incorporated)
The Elder Scrolls V: Skyrim (HKLM\...\Steam App 72850) (Version:  - Bethesda Game Studios)
Total War: SHOGUN 2 (HKLM\...\Steam App 34330) (Version:  - The Creative Assembly)
Unchecky v1.0.2 (HKLM-x32\...\Unchecky) (Version: 1.0.2 - RaMMicHaeL)
Vampire: The Masquerade - Bloodlines (HKLM\...\Steam App 2600) (Version:  - Troika Games)
VirtualDJ 8 (HKLM-x32\...\{CBE3A208-6EE2-4FD1-B888-00BA54022FDC}) (Version: 8.2.3734.0 - Atomix Productions)
Vulkan Run Time Libraries 1.0.26.0 (HKLM\...\VulkanRT1.0.26.0) (Version: 1.0.26.0 - LunarG, Inc.)
XCom Long War EW Mod version 1.0 (HKLM-x32\...\{860C3266-65B9-4BF2-937A-1778483046B5}_is1) (Version: 1.0 - JohnnyLump)
XCOM: Enemy Unknown (HKLM\...\Steam App 200510) (Version:  - Firaxis Games)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {227E73A4-94C7-4435-B06B-458EF8191271} - System32\Tasks\Opera scheduled Autoupdate 1492938726 => C:\Users\Rick 0\AppData\Local\Programs\Opera\launcher.exe [2017-05-14] (Opera Software)
Task: {C2A36005-B47E-45D3-8EB5-B167E47CC5AE} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_25_0_0_171_pepper.exe [2017-05-09] (Adobe Systems Incorporated)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\CreateExplorerShellUnelevatedTask.job => C:\Windows\explorer.exe
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
==================== Loaded Modules (Whitelisted) ==============
2017-03-16 16:08 - 2017-03-16 16:08 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2017-03-16 16:08 - 2017-03-16 16:08 - 01354040 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2017-03-18 13:58 - 2017-03-18 13:58 - 00138000 _____ () C:\Windows\SYSTEM32\inputhost.dll
2017-03-18 13:59 - 2017-03-18 19:31 - 01731072 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2017-03-18 14:03 - 2017-05-25 13:41 - 00002024 _____ C:\Windows\system32\Drivers\etc\hosts
0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomaly
0.0.0.0 tracking.opencandy.com.s3.amazonaws.com
0.0.0.0 media.opencandy.com
0.0.0.0 cdn.opencandy.com
0.0.0.0 tracking.opencandy.com
0.0.0.0 api.opencandy.com
0.0.0.0 api.recommendedsw.com
0.0.0.0 installer.betterinstaller.com
0.0.0.0 installer.filebulldog.com
0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net
0.0.0.0 inno.bisrv.com
0.0.0.0 nsis.bisrv.com
0.0.0.0 cdn.file2desktop.com
0.0.0.0 cdn.goateastcach.us
0.0.0.0 cdn.guttastatdk.us
0.0.0.0 cdn.inskinmedia.com
0.0.0.0 cdn.insta.oibundles2.com
0.0.0.0 cdn.insta.playbryte.com
0.0.0.0 cdn.llogetfastcach.us
0.0.0.0 cdn.montiera.com
0.0.0.0 cdn.msdwnld.com
0.0.0.0 cdn.mypcbackup.com
0.0.0.0 cdn.ppdownload.com
0.0.0.0 cdn.riceateastcach.us
0.0.0.0 cdn.shyapotato.us
0.0.0.0 cdn.solimba.com
0.0.0.0 cdn.tuto4pc.com
0.0.0.0 cdn.appround.biz
0.0.0.0 cdn.bigspeedpro.com
0.0.0.0 cdn.bispd.com
There are 4 more lines.

==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-166261395-844033189-1565394352-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\Windows\img0.jpg
DNS Servers: 66.253.214.16 - 50.30.184.16
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==

==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{3C00E47E-854D-4D8B-A007-3A70ECF35823}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{7A9CE419-C4A6-428F-AE60-AC45929012AE}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{FE3F1B7F-7047-4430-A5CB-71E4493B86FB}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{8E239960-A4CC-4421-A5BD-09A255400A4F}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{635F5ECE-2183-4967-B139-97EBBF83F47E}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{BFD5C38A-6823-4F25-BA40-238731852BE4}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{35FEEAC4-46A2-4410-9BE9-F005CEEA97CE}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{B057F416-53A6-4C6F-8C21-C88420942318}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{90D614FB-523B-4851-AFEA-6FC18F06EC25}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{5D238DCD-CFF8-45DD-AE88-21C33C3CD67F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{7FE60437-9651-4408-94F8-EA18ADB97E29}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{68229938-B1CF-4D61-9C9E-FFD538720F47}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Total War SHOGUN 2\Shogun2.exe
FirewallRules: [{6C669914-FFF6-4E4B-99A2-73A6B84F95D9}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Total War SHOGUN 2\Shogun2.exe
FirewallRules: [{3742DBA0-3DE4-4B63-B472-D1F5ED252790}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\chivalrymedievalwarfare\Binaries\Win64\CMW.exe
FirewallRules: [{FDA96598-BE4F-4926-A337-C41D33F2766C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\chivalrymedievalwarfare\Binaries\Win64\CMW.exe
FirewallRules: [{9C86BCE6-DB0F-413A-B41D-246A5D14621B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\chivalrymedievalwarfare\Binaries\Win32\CMW.exe
FirewallRules: [{41518BCE-A1D1-483E-8E98-7CEA964E26CF}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\chivalrymedievalwarfare\Binaries\Win32\CMW.exe
FirewallRules: [{49F84B8A-C598-4767-8BCE-E0ACF0B1C2F8}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\chivalrymedievalwarfare\ChivLauncher.exe
FirewallRules: [{DDE1C744-CFF9-4179-A653-F5CF4CC5143A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\chivalrymedievalwarfare\ChivLauncher.exe
FirewallRules: [{EDC6298A-6F43-4C82-873E-0F23B26F7C16}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\nmrih\sdk\hl2.exe
FirewallRules: [{C057B7F8-667E-4084-A1DB-FB302CB33836}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\nmrih\sdk\hl2.exe
FirewallRules: [{66D0F362-AB4C-42C4-9301-C4F34A2A590A}] => (Allow) C:\Program Files (x86)\Mass Effect 2\Binaries\MassEffect2.exe
FirewallRules: [{B2A87300-6B0D-4A3A-8428-179FA0194906}] => (Allow) C:\Program Files (x86)\Mass Effect 2\Binaries\MassEffect2.exe
FirewallRules: [{989952DC-B4D2-4276-AAB7-FE2FF3B6566C}] => (Allow) C:\Program Files (x86)\Mass Effect 2\MassEffect2Launcher.exe
FirewallRules: [{986BCF36-29D9-4324-A3E8-2DF1055B5739}] => (Allow) C:\Program Files (x86)\Mass Effect 2\MassEffect2Launcher.exe
FirewallRules: [{DE36195A-5144-4221-A79B-7715DFBEA64F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Jedi Academy\GameData\jasp.exe
FirewallRules: [{51C7DDE8-F514-43A3-86DB-21282164F264}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Jedi Academy\GameData\jasp.exe
FirewallRules: [{4D47512C-C415-40E1-A8C5-835D03A9D044}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Jedi Academy\GameData\jamp.exe
FirewallRules: [{4A10CDCB-29B0-49A1-B1A6-CA3ABEBEB6D6}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Jedi Academy\GameData\jamp.exe
FirewallRules: [{B0D84DE2-67AC-40D7-9471-B1F31CD2F4E0}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\XCom-Enemy-Unknown\Binaries\Win32\XComGame.exe
FirewallRules: [{32434A64-AEA7-4A9B-8343-F262C67AA9C4}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\XCom-Enemy-Unknown\Binaries\Win32\XComGame.exe
FirewallRules: [{AF705E2C-102D-4F55-A5B4-13FCB92DF0CC}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Vampire The Masquerade - Bloodlines\vampire.exe
FirewallRules: [{F52CB4FC-24F3-40DD-BC2A-94AC207C360E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Vampire The Masquerade - Bloodlines\vampire.exe
FirewallRules: [TCP Query User{8C6CB43C-FA3C-4299-AF74-4F7A4FBD6443}C:\program files (x86)\steam\steamapps\common\xcom-enemy-unknown\xew\binaries\win32\xcomew.exe] => (Block) C:\program files (x86)\steam\steamapps\common\xcom-enemy-unknown\xew\binaries\win32\xcomew.exe
FirewallRules: [UDP Query User{9BEEB072-F366-4B38-A00E-D511159F0086}C:\program files (x86)\steam\steamapps\common\xcom-enemy-unknown\xew\binaries\win32\xcomew.exe] => (Block) C:\program files (x86)\steam\steamapps\common\xcom-enemy-unknown\xew\binaries\win32\xcomew.exe
==================== Restore Points =========================
23-05-2017 10:53:05 Windows Update
25-05-2017 14:18:13 JRT Pre-Junkware Removal
==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================
Application errors:
==================
Error: (05/25/2017 05:37:30 PM) (Source: SecurityCenter) (EventID: 16) (User: )
Description: Error while updating Windows Defender status to SECURITY_PRODUCT_STATE_ON.
Error: (05/25/2017 05:37:30 PM) (Source: SecurityCenter) (EventID: 16) (User: )
Description: Error while updating Windows Defender status to SECURITY_PRODUCT_STATE_ON.
Error: (05/25/2017 05:33:28 PM) (Source: SecurityCenter) (EventID: 16) (User: )
Description: Error while updating Windows Defender status to SECURITY_PRODUCT_STATE_ON.
Error: (05/25/2017 05:33:28 PM) (Source: SecurityCenter) (EventID: 16) (User: )
Description: Error while updating Windows Defender status to SECURITY_PRODUCT_STATE_ON.
Error: (05/25/2017 02:10:37 PM) (Source: SecurityCenter) (EventID: 16) (User: )
Description: Error while updating Windows Defender status to SECURITY_PRODUCT_STATE_ON.
Error: (05/25/2017 02:10:37 PM) (Source: SecurityCenter) (EventID: 16) (User: )
Description: Error while updating Windows Defender status to SECURITY_PRODUCT_STATE_ON.
Error: (05/24/2017 07:49:29 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine QueryFullProcessImageNameW.  hr = 0x80070006, The handle is invalid.
.

Operation:
   Executing Asynchronous Operation
Context:
   Current State: DoSnapshotSet
Error: (05/24/2017 11:40:29 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-M7IRLC6)
Description: Activation of app Microsoft.WindowsStore_8wekyb3d8bbwe!App failed with error: -2144927142 See the Microsoft-Windows-TWinUI/Operational log for additional information.
Error: (05/24/2017 11:28:44 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-M7IRLC6)
Description: Activation of app Microsoft.Windows.Photos_8wekyb3d8bbwe!App failed with error: -2144927142 See the Microsoft-Windows-TWinUI/Operational log for additional information.
Error: (05/24/2017 11:13:47 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-M7IRLC6)
Description: Activation of app Microsoft.Windows.Photos_8wekyb3d8bbwe!App failed with error: -2144927142 See the Microsoft-Windows-TWinUI/Operational log for additional information.

System errors:
=============
Error: (05/25/2017 04:01:49 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (05/25/2017 02:13:24 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (05/25/2017 01:41:10 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The SecDrv service failed to start due to the following error:
This driver has been blocked from loading
Error: (05/25/2017 01:41:10 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Windows\SysWow64\drivers\SECDRV.SYS
Error: (05/25/2017 01:41:09 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The CldFlt service failed to start due to the following error:
The request is not supported.
Error: (05/25/2017 01:34:45 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (05/25/2017 01:34:45 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (05/25/2017 01:27:31 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (05/25/2017 01:27:31 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (05/25/2017 01:27:31 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

CodeIntegrity:
===================================
  Date: 2017-05-25 17:33:33.390
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Windows\System32\DriverStore\FileRepository\nvhm.inf_amd64_0460fff687def1f0\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
  Date: 2017-05-25 14:18:49.494
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
  Date: 2017-05-25 14:18:49.492
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
  Date: 2017-05-25 14:18:49.461
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
  Date: 2017-05-25 14:18:49.459
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
  Date: 2017-05-25 14:18:49.411
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
  Date: 2017-05-25 14:18:49.408
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
  Date: 2017-05-25 13:09:21.426
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
  Date: 2017-05-25 13:09:21.417
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
  Date: 2017-05-25 12:08:00.711
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-5500U CPU @ 2.40GHz
Percentage of memory in use: 20%
Total physical RAM: 8107.39 MB
Available physical RAM: 6449.61 MB
Total Virtual: 9387.39 MB
Available Virtual: 7608.55 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:930.96 GB) (Free:524.13 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 06A3DEBE)
Partition: GPT.
==================== End of Addition.txt ============================
 
Link to post
Share on other sites

  • Root Admin

It doesn't look like you have any active live threats on the system. Probably some site downloaded a javascript file in order to attempt an attack but was thwarted before it could do anything.

 

Please Run TFC by OldTimer to clear temporary files:

  • Download TFC from here and save it to your desktop.
  • http://oldtimer.geekstogo.com/TFC.exe
  • Close any open programs and Internet browsers.
  • Double click TFC.exe to run it on XP (for Vista and Windows 7 right click and choose "Run as administrator") and once it opens click on the Start button on the lower left of the program to allow it to begin cleaning.
  • Please be patient as clearing out temp files may take a while.
  • Once it completes you may be prompted to restart your computer, please do so.
  • Once it's finished you may delete TFC.exe from your desktop or save it for later use for the cleaning of temporary files.

 

Then reboot the computer and let me know if there are still any signs of an infection or not.

Thanks

Ron

 

Link to post
Share on other sites

Hi,

TFC didn't ask me to restart my system, but it did clear out my temporary files. I do still get CPU usages at 50-85%, disk usage jumps to 80-99% every now and then. My computer doesn't seem messed up besides that, and its slow at startup but that improves. Also sometimes when I search something on google the google search page appears in a different style, I haven't noticed anything else to be changed though. I assume everything is fine but who knows for sure right?

Link to post
Share on other sites

  • Root Admin

1. Open a CMD Window as an Administrator on the computer and enter the following commands:

 

  • cd %windir%\system32\
  • lodctr /R
  • cd %windir%\sysWOW64\
  • lodctr /R

 

    Note: This command resyncs the counter values.

 

2. Open up Regedit and navigate to the following registry key:

 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfProc\Performance

 

3. Make sure that the value (if it exists) for the Disable Performance Counters is not 1.  If the entry does exist and the entry is 1, change it to 0 or delete that entry within the key.  ** PLEASE NOTE ** make sure you contact your system administrator before making changes to the registry, and make sure that you back it up before you delete it.

 

4. Restart the computer

 

Let me know if performance has improved any or not.

Thanks

 

 

 

Link to post
Share on other sites

I didn't perform any steps past the command prompt because I got the error for both system32 and sysWOW64 that 'error: unable to rebuild performance counter setting from system backup store, error code is 5.'

My system is still really slow on startup, and sometimes before I get to the sign in page there's a light blue screen which feels disconcerting but hasn't proved problematic.

EDIT: Also, and this is strange, right now I typed in 'google.com' to get some info on what an error code 5 is, but then it redirected to some shady website that I'd never seen before. Very strange since this was going towards a well known site like google. Also, a random site redirect like this hasnt happened since the initial attack. So maybe its not a virus that made the redirect, since ive been using this laptop almost everyday since  without a random redirect like this. Also, windows and opera got updated a couple days after the attack, which worries me because maybe that could help hide the threat on the system? I wouldnt know. Thamk you for the assistance

 

Edited by Jwinebago382
Link to post
Share on other sites

  • Root Admin

The error 5 is access denied because you more than likely tried to run it without starting the command prompt with Admin rights. This is the first and only time I've seen it fail and Error 5 indicates a regular user attempted to run it.

Please double-check and make sure you run the command prompt with Elevated Admin rights. Then run the command again and it should work or give another error aside from 5

Thanks

 

Link to post
Share on other sites

  • 2 months later...
  • Root Admin

We're sorry. It looks like your topic was somehow overlooked. Due to the length of time we'll go ahead and close this topic now but if you still actually need help please send a private message to one of the Moderators and we'll assist you.Thank you and sorry we missed your topic.

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.