Jump to content

I might have a bitcoin miner virus......


Recommended Posts

Hey, I've recently been playing games and suddenly I go from a consistent 100 frames to very low frames. I checked my task manager and the background processes called Client Service Runtime Process and Desktop Window Manager uses 70%-90% of my GPU. I did some research and some say that was a bitcoin miner virus. How do I know if I have this virus or not?

 

Link to post
Share on other sites

Hello lonlyplayrealm and welcome to Malwarebytes,

Continue with the following and post the produced logs:

If you do not have Malwarebytes installed do the following:

Download Malwarebytes version 3 from the following link:

https://www.malwarebytes.com/mwb-download/thankyou/

Double click on the installer and follow the prompts. If necessary select the Blue Help tab for video instructions....

When the install completes or Malwarebytes is already installed do the following:

Open Malwarebytes, select > "settings" > "protection tab"

Scroll down to "Scan Options" ensure Scan for Rootkits and Scan within Archives are both on....

Go back to "DashBoard" select the Blue "Scan Now" tab......

When the scan completes deal with any found entries...

To get the log from Malwarebytes do the following:
 
  • Click on the Report tab > from main interface.
  • Double click on the Scan log which shows the Date and time of the scan just performed.
  • Click Export > From export you have two options:
    Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
    Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply

     
  • Please use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply…


Next,

Download Farbar Recovery Scan Tool and save it to your desktop.

Alternative download option: http://www.techspot.com/downloads/6731-farbar-recovery-scan-tool.html

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way...

Be aware FRST must be run from an account with Administrator status...
 
  • Double-click to run it. When the tool opens click Yes to disclaimer.(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.)
  • Make sure Addition.txt is checkmarked under "Optional scans"
    user posted image
     
  • Press Scan button to run the tool....
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The tool will also make a log named (Addition.txt) Please attach that log to your reply.


Let me see those logs in your reply...

Thank you,

Kevin...
Link to post
Share on other sites

8 hours ago, kevinf80 said:


When the install completes or Malwarebytes is already installed do the following

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 4/3/18
Scan Time: 1:01 AM
Log File: 069fa7b8-36fc-11e8-b0e2-b06ebf11be6b.json
Administrator: Yes

-Software Information-
Version: 3.4.5.2467
Components Version: 1.0.342
Update Package Version: 1.0.4594
License: Trial

-System Information-
OS: Windows 10 (Build 16299.309)
CPU: x64
File System: NTFS
User: LAPTOP-D2FHA3JU\jacki

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 302065
Threats Detected: 0
(No malicious items detected)
Threats Quarantined: 0
(No malicious items detected)
Time Elapsed: 1 min, 17 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 0
(No malicious items detected)

Physical Sector: 0
(No malicious items detected)


(end)

8 hours ago, kevinf80 said:

 

 

Link to post
Share on other sites

This is the FRST.txt log

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 14.03.2018
Ran by jacki (administrator) on LAPTOP-D2FHA3JU (03-04-2018 13:06:59)
Running from C:\Users\jacki\Downloads
Loaded Profiles: jacki (Available Profiles: jacki)
Platform: Windows 10 Home Version 1709 16299.309 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_0d8b06fa651db23a\igfxCUIService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Drivers\APOService\LogiRegistryService.exe
() C:\Program Files\Intel\SUR\QUEENCREEK\SurSvc.exe
(Intel Corporation) C:\Windows\System32\ibtsiva.exe
(Intel) C:\Program Files (x86)\Intel Driver and Support Assistant\DSAService.exe
(Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_0d8b06fa651db23a\IntelCpHDCPSvc.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_0d8b06fa651db23a\IntelCpHeciSvc.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_0d8b06fa651db23a\igfxEM.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(Logitech, Inc.) C:\Program Files\Logitech Gaming Software\LAClient\laclient.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Discord Inc.) C:\Users\jacki\AppData\Local\Discord\app-0.0.300\Discord.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
(Epic Games, Inc.) C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe
(Discord Inc.) C:\Users\jacki\AppData\Local\Discord\app-0.0.300\Discord.exe
(Spotify Ltd) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.75.483.0_x86__zpdnekdrzrea0\SpotifyWebHelper.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1811.248.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.11.717\SSScheduler.exe
(Discord Inc.) C:\Users\jacki\AppData\Local\Discord\app-0.0.300\Discord.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
(Adobe Systems, Inc.) C:\Users\jacki\Downloads\flashplayer_29_sa.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [630168 2017-09-29] (Microsoft Corporation)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM\...\Run: [Launch LCore] => C:\Program Files\Logitech Gaming Software\LCore.exe [17987704 2017-10-19] (Logitech Inc.)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [245608 2018-03-20] (AVAST Software)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-09-05] (Oracle Corporation)
HKLM-x32\...\Run: [DSATray] => C:\Program Files (x86)\Intel Driver and Support Assistant\DsaTray.exe [131360 2018-01-17] (Intel)
HKU\S-1-5-21-1575408045-1876520637-41634806-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3198752 2018-03-26] (Valve Corporation)
HKU\S-1-5-21-1575408045-1876520637-41634806-1001\...\Run: [BingSvc] => C:\Users\jacki\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2015-11-05] (© 2015 Microsoft Corporation)
HKU\S-1-5-21-1575408045-1876520637-41634806-1001\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3100456 2018-02-22] ()
HKU\S-1-5-21-1575408045-1876520637-41634806-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27832264 2017-10-06] (Skype Technologies S.A.)
HKU\S-1-5-21-1575408045-1876520637-41634806-1001\...\Run: [McAfeeSafeConnect] => C:\Program Files (x86)\McAfee Safe Connect\McAfee Safe Connect.exe
HKU\S-1-5-21-1575408045-1876520637-41634806-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [17074688 2018-03-06] (Piriform Ltd)
HKU\S-1-5-21-1575408045-1876520637-41634806-1001\...\Run: [Discord] => C:\Users\jacki\AppData\Local\Discord\app-0.0.300\Discord.exe [57821176 2018-01-08] (Discord Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2018-04-02]
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.717\SSScheduler.exe (McAfee, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: 0.0.0.1    mssplus.mcafee.com
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 68.237.161.12
Tcpip\..\Interfaces\{7140F7FF-76EC-480E-B472-C9ED45348B43}: [NameServer] 95.211.101.196 95.211.101.197
Tcpip\..\Interfaces\{eb63e854-5a44-435e-af69-9b03f8e65665}: [DhcpNameServer] 192.168.1.1 68.237.161.12
Tcpip\..\Interfaces\{f2f73fa1-3fe1-456d-b1cd-b2d5d8e2e47a}: [NameServer] 8.8.8.8 8.8.4.4
Tcpip\..\Interfaces\{f2f73fa1-3fe1-456d-b1cd-b2d5d8e2e47a}: [DhcpNameServer] 192.168.1.1 68.237.161.12

Internet Explorer:
==================
HKU\S-1-5-21-1575408045-1876520637-41634806-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus17swin10.msn.com/?pc=SSJE
HKU\S-1-5-21-1575408045-1876520637-41634806-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus17swin10.msn.com/?pc=SSJE
SearchScopes: HKU\S-1-5-21-1575408045-1876520637-41634806-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1575408045-1876520637-41634806-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll [2018-04-02] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\ssv.dll [2018-01-13] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\jp2ssv.dll [2018-01-13] (Oracle Corporation)
Handler: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2018-04-02] (Microsoft Corporation)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2018-04-02] (Microsoft Corporation)
Handler: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2018-04-02] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2018-04-02] (Microsoft Corporation)
Handler: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2018-04-02] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2018-04-02] (Microsoft Corporation)
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2018-04-02] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2018-04-02] (Microsoft Corporation)

FireFox:
========
FF DefaultProfile: we0r1iu0.default
FF ProfilePath: C:\Users\jacki\AppData\Roaming\Mozilla\Firefox\Profiles\we0r1iu0.default [2018-04-03]
FF Extension: (Adblock Plus) - C:\Users\jacki\AppData\Roaming\Mozilla\Firefox\Profiles\we0r1iu0.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2018-03-18]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_29_0_0_113.dll [2018-03-18] ()
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL [2018-04-02] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_29_0_0_113.dll [2018-03-18] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.151.2 -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\dtplugin\npDeployJava1.dll [2018-01-13] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.151.2 -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\plugin2\npjp2.dll [2018-01-13] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\NPSPWRAP.DLL [2018-03-01] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-12-02] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-12-02] (Google Inc.)

Chrome: 
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> hxxps://mail.google.com/mail/u/0/#inbox?compose=152adeab1aed9217
CHR StartupUrls: Default -> "hxxp://schools.nyc.gov/default.htm"
CHR NewTab: Default ->  Active:"chrome-extension://dpnkggieociffokefcfiocfkppakljgm/start/index.html"
CHR DefaultSearchURL: Default -> hxxps://search.totalav.com/search/web?fcoid=417&fcop=topnav&fpid=27&q={searchTerms}
CHR DefaultSearchKeyword: Default -> safesearch
CHR Session Restore: Default -> is enabled.
CHR Profile: C:\Users\jacki\AppData\Local\Google\Chrome\User Data\Default [2018-04-03]
CHR Extension: (Slides) - C:\Users\jacki\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-12-02]
CHR Extension: (Docs) - C:\Users\jacki\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-12-02]
CHR Extension: (Google Drive) - C:\Users\jacki\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-12-02]
CHR Extension: (YouTube) - C:\Users\jacki\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-12-02]
CHR Extension: (SaferVPN - FREE VPN) - C:\Users\jacki\AppData\Local\Google\Chrome\User Data\Default\Extensions\cocfojppfigjeefejbpfmedgjbpchcng [2018-02-18]
CHR Extension: (Space Galaxy Wallpaper HD New Tab Themes) - C:\Users\jacki\AppData\Local\Google\Chrome\User Data\Default\Extensions\dpnkggieociffokefcfiocfkppakljgm [2018-04-02]
CHR Extension: (Sheets) - C:\Users\jacki\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-12-02]
CHR Extension: (Google Docs Offline) - C:\Users\jacki\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-12-03]
CHR Extension: (AdBlock) - C:\Users\jacki\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2018-03-14]
CHR Extension: (Demon) - C:\Users\jacki\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkogjokmbmidekocngmoamkkoankbodg [2018-04-02]
CHR Extension: (Hotspot Shield Free VPN Proxy – Unblock Sites) - C:\Users\jacki\AppData\Local\Google\Chrome\User Data\Default\Extensions\heajfgnegopeedndeahkdjedjkjcmnpb [2017-12-03]
CHR Extension: (SaferVPN - FREE VPN | Privacy & Unblock Sites) - C:\Users\jacki\AppData\Local\Google\Chrome\User Data\Default\Extensions\iamifmhbkeeccbjkaenolpghohlpnioi [2017-12-03]
CHR Extension: (Grammarly for Chrome) - C:\Users\jacki\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbfnbcaeplbcioakkpcpgfkobkghlhen [2018-03-27]
CHR Extension: (Total AV Safe Search) - C:\Users\jacki\AppData\Local\Google\Chrome\User Data\Default\Extensions\looohgelibjoplmkhecmalapkgadkfcc [2018-01-14]
CHR Extension: (Chrome Web Store Payments) - C:\Users\jacki\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-12-02]
CHR Extension: (Gmail) - C:\Users\jacki\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-12-02]
CHR Extension: (Chrome Media Router) - C:\Users\jacki\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-02-28]
CHR Profile: C:\Users\jacki\AppData\Local\Google\Chrome\User Data\Guest Profile [2018-04-02]
CHR Profile: C:\Users\jacki\AppData\Local\Google\Chrome\User Data\System Profile [2018-04-02]
CHR HKLM\...\Chrome\Extension: [looohgelibjoplmkhecmalapkgadkfcc] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - D:\GAMES\Internet Download Manager\IDMGCExt.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [looohgelibjoplmkhecmalapkgadkfcc] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe [7556704 2018-03-20] (AVAST Software)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [303728 2018-03-20] (AVAST Software)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [5708808 2018-03-29] ()
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [8521384 2018-03-24] (Microsoft Corporation)
R2 DSAService; C:\Program Files (x86)\Intel Driver and Support Assistant\DSAService.exe [22304 2018-01-17] (Intel)
S3 EasyAntiCheat; C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe [774272 2018-03-12] (EasyAntiCheat Ltd)
S4 esifsvc; C:\WINDOWS\system32\Intel\DPTF\esif_uf.exe [2210424 2016-12-25] (Intel Corporation)
R2 ESRV_SVC_QUEENCREEK; C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe [886032 2018-01-11] ()
U2 HiPatchService; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9728 2017-09-19] (Hi-Rez Studios) [File not signed]
R2 ibtsiva; C:\WINDOWS\system32\ibtsiva.exe [542320 2018-01-10] (Intel Corporation)
S4 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [987432 2016-07-26] (Intel(R) Corporation)
S3 Intel(R) SUR QC SAM; C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe [18168 2017-07-13] (Intel Corporation)
S4 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [177440 2016-10-06] (Intel Corporation)
R2 LogiRegistryService; C:\Program Files\Logitech Gaming Software\Drivers\APOService\LogiRegistryService.exe [225400 2017-10-19] (Logitech Inc.)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6479136 2018-03-27] (Malwarebytes)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.717\McCHSvc.exe [405392 2018-03-27] (McAfee, Inc.)
S3 mracsvc; C:\WINDOWS\System32\mracsvc.exe [8010968 2018-01-19] (LLC Mail.Ru)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [268968 2018-01-17] ()
R2 SystemUsageReportSvc_QUEENCREEK; C:\Program Files\Intel\SUR\QUEENCREEK\SurSvc.exe [182544 2018-01-11] ()
S3 USER_ESRV_SVC_QUEENCREEK; C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe [886032 2018-01-11] ()
S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\NisSrv.exe [356152 2018-03-01] (Microsoft Corporation)
S3 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpEng.exe [106280 2018-03-01] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3758760 2018-01-17] (Intel® Corporation)
R2 NVDisplay.ContainerLocalSystem; "C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe" -s NVDisplay.ContainerLocalSystem -f "C:\ProgramData\NVIDIA\NVDisplay.ContainerLocalSystem.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem" -r -p 30000
R2 NvTelemetryContainer; "C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe" -s NvTelemetryContainer -f "C:\ProgramData\NVIDIA\NvTelemetryContainer.log" -l 3 -d "C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\plugins" -r
S4 Origin Client Service; "C:\Program Files (x86)\Origin\OriginClientService.exe" [X]
S4 Origin Web Helper Service; "C:\Program Files (x86)\Origin\OriginWebHelperService.exe" [X]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 aftap0901; C:\WINDOWS\System32\drivers\aftap0901.sys [48624 2018-01-23] (The OpenVPN Project)
R3 AsusHFilter; C:\WINDOWS\System32\drivers\AsusHFilter.sys [30200 2016-12-22] ()
R3 AsusPTPDrv; C:\WINDOWS\System32\drivers\AsusPTPFilter.sys [99320 2017-01-25] (ASUS Corporation)
R1 aswArPot; C:\WINDOWS\System32\drivers\aswArPot.sys [196648 2018-03-20] (AVAST Software)
R1 aswbidsdriver; C:\WINDOWS\System32\drivers\aswbidsdrivera.sys [227504 2018-03-20] (AVAST Software)
R0 aswbidsh; C:\WINDOWS\System32\drivers\aswbidsha.sys [199440 2018-03-20] (AVAST Software)
R0 aswblog; C:\WINDOWS\System32\drivers\aswbloga.sys [343752 2018-03-20] (AVAST Software)
R0 aswbuniv; C:\WINDOWS\System32\drivers\aswbuniva.sys [57680 2018-03-20] (AVAST Software)
R1 aswHdsKe; C:\WINDOWS\System32\drivers\aswHdsKe.sys [215320 2018-03-20] (AVAST Software)
S3 aswHwid; C:\WINDOWS\System32\drivers\aswHwid.sys [46968 2018-03-20] (AVAST Software)
R2 aswMonFlt; C:\WINDOWS\System32\drivers\aswMonFlt.sys [146656 2018-03-20] (AVAST Software)
R1 aswRdr; C:\WINDOWS\System32\drivers\aswRdr2.sys [110328 2018-03-20] (AVAST Software)
R0 aswRvrt; C:\WINDOWS\System32\drivers\aswRvrt.sys [84368 2018-03-20] (AVAST Software)
R1 aswSnx; C:\WINDOWS\System32\drivers\aswSnx.sys [1026696 2018-03-20] (AVAST Software)
R1 aswSP; C:\WINDOWS\System32\drivers\aswSP.sys [460520 2018-03-20] (AVAST Software)
R2 aswStm; C:\WINDOWS\System32\drivers\aswStm.sys [205976 2018-03-20] (AVAST Software)
R0 aswVmm; C:\WINDOWS\System32\drivers\aswVmm.sys [380528 2018-03-20] (AVAST Software)
R3 dptf_cpu; C:\WINDOWS\System32\drivers\dptf_cpu.sys [69536 2018-02-10] (Intel Corporation)
R3 esif_lf; C:\WINDOWS\system32\DRIVERS\esif_lf.sys [355200 2016-12-25] (Intel Corporation)
R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [76192 2018-03-19] ()
R3 HIDSwitch; C:\WINDOWS\System32\drivers\AsRadioControl.sys [31112 2018-01-11] (ASUS)
R3 ibtusb; C:\WINDOWS\system32\DRIVERS\ibtusb.sys [136128 2018-01-10] (Intel Corporation)
S3 ladfGSS; C:\WINDOWS\system32\drivers\ladfGSS.sys [45192 2017-10-19] (Logitech Inc.)
R2 LGCoreTemp; C:\Program Files\Logitech Gaming Software\Drivers\LgCoreTemp\lgcoretemp.sys [14184 2015-06-21] (Logitech)
R3 LGJoyXlCore; C:\WINDOWS\system32\drivers\LGJoyXlCore.sys [67736 2017-10-19] (Logitech Inc.)
R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [193768 2018-04-03] (Malwarebytes)
R3 MBAMFarflt; C:\WINDOWS\System32\DRIVERS\farflt.sys [112864 2018-04-03] (Malwarebytes)
R3 MBAMProtection; C:\WINDOWS\system32\DRIVERS\mbam.sys [44768 2018-04-03] (Malwarebytes)
R0 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [253664 2018-04-03] (Malwarebytes)
R3 MBAMWebProtection; C:\WINDOWS\system32\DRIVERS\mwac.sys [102112 2018-04-03] (Malwarebytes)
S1 MpKslb9e55050; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{272CA794-D7DB-46AE-85F2-42F211E006A3}\MpKslb9e55050.sys [58120 2018-03-15] () [File not signed]
S1 MpKslbcd53f16; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{272CA794-D7DB-46AE-85F2-42F211E006A3}\MpKslbcd53f16.sys [58120 2018-03-15] () [File not signed]
S1 MpKslfc7cac21; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{F86FBF05-5968-46C2-8729-CB6828B7CC94}\MpKslfc7cac21.sys [58120 2018-03-14] () [File not signed]
S3 mracdrv; C:\WINDOWS\System32\drivers\mracdrv.sys [7238880 2018-01-19] (LLC Mail.Ru)
S3 Netwtw04; C:\WINDOWS\System32\drivers\Netwtw04.sys [7689728 2017-09-29] (Intel Corporation)
R3 Netwtw06; C:\WINDOWS\System32\drivers\Netwtw06.sys [8646632 2018-01-17] (Intel Corporation)
R3 nvlddmkm; C:\WINDOWS\System32\DriverStore\FileRepository\nvami.inf_amd64_1474122a0ce2f241\nvlddmkm.sys [17544792 2018-03-25] (NVIDIA Corporation)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [1024848 2018-02-10] (Realtek )
S3 semav6msr64; C:\WINDOWS\system32\drivers\semav6msr64.sys [41512 2018-01-11] ()
S3 WdBoot; C:\WINDOWS\system32\drivers\wd\WdBoot.sys [46072 2018-03-01] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\wd\WdFilter.sys [288296 2018-03-01] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [129568 2018-03-01] (Microsoft Corporation)
S3 cpuz140; \??\C:\Users\jacki\AppData\Local\Temp\cpuz140\cpuz140_x64.sys [X] <==== ATTENTION
S3 nvdimmn; \SystemRoot\System32\drivers\nvdimmn.sys [X]
S4 nvvad_WaveExtensible; \SystemRoot\system32\drivers\nvvad64v.sys [X]
S4 nvvhci; \SystemRoot\System32\drivers\nvvhci.sys [X]
S3 xhunter1; \??\C:\WINDOWS\xhunter1.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-04-03 13:06 - 2018-04-03 13:07 - 000024997 _____ C:\Users\jacki\Downloads\FRST.txt
2018-04-03 13:06 - 2018-04-03 13:06 - 002403328 _____ (Farbar) C:\Users\jacki\Downloads\FRST64.exe
2018-04-03 13:06 - 2018-04-03 13:06 - 000000000 ____D C:\FRST
2018-04-03 01:55 - 2018-04-03 01:55 - 1132891688 _____ C:\WINDOWS\MEMORY.DMP
2018-04-03 01:55 - 2018-04-03 01:55 - 001371476 _____ C:\WINDOWS\Minidump\040318-7437-01.dmp
2018-04-03 01:01 - 2018-04-03 01:02 - 072135408 _____ (Malwarebytes ) C:\Users\jacki\Downloads\mb3-setup-consumer-3.4.5.2467-1.0.342-1.0.4576 (1).exe
2018-04-03 00:57 - 2018-04-03 12:33 - 000102112 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2018-04-03 00:57 - 2018-04-03 11:27 - 000112864 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
2018-04-03 00:57 - 2018-04-03 11:27 - 000044768 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2018-04-03 00:57 - 2018-04-03 00:57 - 000253664 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
2018-04-03 00:57 - 2018-04-03 00:57 - 000193768 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamChameleon.sys
2018-04-03 00:56 - 2018-04-03 00:56 - 000001872 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2018-04-03 00:56 - 2018-04-03 00:56 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2018-04-03 00:56 - 2018-04-03 00:56 - 000000000 ____D C:\ProgramData\Malwarebytes
2018-04-03 00:56 - 2018-04-03 00:56 - 000000000 ____D C:\Program Files\Malwarebytes
2018-04-03 00:56 - 2018-03-19 12:57 - 000076192 _____ C:\WINDOWS\system32\Drivers\mbae64.sys
2018-04-03 00:54 - 2018-04-03 00:55 - 072135408 _____ (Malwarebytes ) C:\Users\jacki\Downloads\mb3-setup-consumer-3.4.5.2467-1.0.342-1.0.4576.exe
2018-04-02 14:18 - 2018-04-02 14:18 - 000000000 ____D C:\Program Files\Common Files\DESIGNER
2018-04-02 14:15 - 2018-04-02 14:15 - 000000000 ____D C:\WINDOWS\LastGood.Tmp
2018-04-02 14:14 - 2018-03-25 12:15 - 000998424 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFR64.dll
2018-04-02 14:14 - 2018-03-25 12:15 - 000950016 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFR.dll
2018-04-02 14:14 - 2018-03-25 12:15 - 000625504 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFROpenGL.dll
2018-04-02 14:14 - 2018-03-25 12:15 - 000516024 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFROpenGL.dll
2018-04-02 14:14 - 2018-03-25 12:14 - 004318112 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuvid.dll
2018-04-02 14:14 - 2018-03-25 12:14 - 003719096 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuvid.dll
2018-04-02 14:14 - 2018-03-25 12:14 - 001985112 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispco6439135.dll
2018-04-02 14:14 - 2018-03-25 12:14 - 001683712 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispgenco6439135.dll
2018-04-02 14:14 - 2018-03-25 12:14 - 001138720 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvFBC64.dll
2018-04-02 14:14 - 2018-03-25 12:14 - 001065888 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvFBC.dll
2018-04-02 14:14 - 2018-03-25 12:13 - 040278608 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcompiler.dll
2018-04-02 14:14 - 2018-03-25 12:13 - 035188992 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcompiler.dll
2018-04-02 14:14 - 2018-03-25 12:10 - 013571520 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvptxJitCompiler.dll
2018-04-02 14:14 - 2018-03-25 12:10 - 011132384 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvptxJitCompiler.dll
2018-04-02 14:14 - 2018-03-25 12:09 - 019855144 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvopencl.dll
2018-04-02 14:14 - 2018-03-25 12:09 - 016496776 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvopencl.dll
2018-04-02 14:14 - 2018-03-25 12:09 - 001355216 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvEncMFThevc.dll
2018-04-02 14:14 - 2018-03-25 12:09 - 001346128 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvEncMFTH264.dll
2018-04-02 14:14 - 2018-03-25 12:09 - 001153744 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvfatbinaryLoader.dll
2018-04-02 14:14 - 2018-03-25 12:09 - 001067560 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvEncMFThevc.dll
2018-04-02 14:14 - 2018-03-25 12:09 - 001061352 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvEncMFTH264.dll
2018-04-02 14:14 - 2018-03-25 12:09 - 000902096 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvfatbinaryLoader.dll
2018-04-02 14:14 - 2018-03-25 12:09 - 000811808 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvEncodeAPI64.dll
2018-04-02 14:14 - 2018-03-25 12:09 - 000650232 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvEncodeAPI.dll
2018-04-02 14:14 - 2018-03-25 12:08 - 012967056 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuda.dll
2018-04-02 14:14 - 2018-03-25 12:08 - 011001504 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuda.dll
2018-04-02 12:54 - 2018-04-02 12:54 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
2018-04-02 12:54 - 2018-04-02 12:54 - 000000000 ____D C:\ProgramData\McAfee Security Scan
2018-03-29 16:53 - 2018-03-29 16:53 - 000000000 __SHD C:\82ace7d6-0197-474d-bf4b-a2043e72329b
2018-03-21 16:16 - 2018-04-03 11:09 - 000000000 ____D C:\Users\jacki\AppData\Roaming\discord
2018-03-21 16:16 - 2018-03-25 15:50 - 000002233 _____ C:\Users\jacki\Desktop\Discord.lnk
2018-03-21 16:16 - 2018-03-21 16:16 - 000000000 ____D C:\Users\jacki\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Discord Inc
2018-03-21 16:16 - 2018-03-21 16:16 - 000000000 ____D C:\Users\jacki\AppData\Local\SquirrelTemp
2018-03-21 16:16 - 2018-03-21 16:16 - 000000000 ____D C:\Users\jacki\AppData\Local\Discord
2018-03-21 16:12 - 2018-03-21 16:15 - 057954808 _____ (Discord Inc.) C:\Users\jacki\Downloads\DiscordSetup.exe
2018-03-20 18:41 - 2018-03-20 18:41 - 000000000 _____ C:\Users\jacki\Desktop\New Text Document.txt
2018-03-20 18:09 - 2018-03-20 18:09 - 000000000 ____D C:\Users\jacki\AppData\Roaming\AVAST Software
2018-03-20 18:02 - 2018-04-03 11:26 - 000000000 ____D C:\WINDOWS\System32\Tasks\Avast Software
2018-03-20 18:02 - 2018-03-20 18:02 - 000001939 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast Free Antivirus.lnk
2018-03-20 18:02 - 2018-03-20 18:02 - 000001927 _____ C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2018-03-20 18:01 - 2018-04-02 10:42 - 000004264 _____ C:\WINDOWS\System32\Tasks\Avast Emergency Update
2018-03-20 18:01 - 2018-03-20 18:01 - 001026696 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSnx.sys
2018-03-20 18:01 - 2018-03-20 18:01 - 000460520 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys
2018-03-20 18:01 - 2018-03-20 18:01 - 000380768 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2018-03-20 18:01 - 2018-03-20 18:01 - 000380528 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswVmm.sys
2018-03-20 18:01 - 2018-03-20 18:01 - 000343752 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswbloga.sys
2018-03-20 18:01 - 2018-03-20 18:01 - 000227504 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswbidsdrivera.sys
2018-03-20 18:01 - 2018-03-20 18:01 - 000215320 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswHdsKe.sys
2018-03-20 18:01 - 2018-03-20 18:01 - 000205976 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswStm.sys
2018-03-20 18:01 - 2018-03-20 18:01 - 000199440 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswbidsha.sys
2018-03-20 18:01 - 2018-03-20 18:01 - 000196648 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswArPot.sys
2018-03-20 18:01 - 2018-03-20 18:01 - 000146656 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys
2018-03-20 18:01 - 2018-03-20 18:01 - 000110328 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys
2018-03-20 18:01 - 2018-03-20 18:01 - 000084368 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRvrt.sys
2018-03-20 18:01 - 2018-03-20 18:01 - 000061304 _____ () C:\WINDOWS\system32\Drivers\lpsport.sys
2018-03-20 18:01 - 2018-03-20 18:01 - 000057680 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswbuniva.sys
2018-03-20 18:01 - 2018-03-20 18:01 - 000046968 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswHwid.sys
2018-03-20 18:01 - 2018-03-20 18:01 - 000000000 ____D C:\Program Files\Common Files\AVAST Software
2018-03-20 17:59 - 2018-03-20 17:59 - 000000000 ____D C:\Program Files\AVAST Software
2018-03-20 17:58 - 2018-04-03 11:27 - 000002216 _____ C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2018-03-20 17:58 - 2018-03-21 15:10 - 000003048 _____ C:\WINDOWS\System32\Tasks\CCleaner Update
2018-03-20 17:58 - 2018-03-20 23:09 - 000000000 ____D C:\ProgramData\AVAST Software
2018-03-20 17:58 - 2018-03-20 17:58 - 000000823 _____ C:\Users\Public\Desktop\CCleaner.lnk
2018-03-20 17:58 - 2018-03-20 17:58 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2018-03-20 17:58 - 2018-03-20 17:58 - 000000000 ____D C:\Program Files\CCleaner
2018-03-20 17:57 - 2018-03-20 17:58 - 015333512 _____ (Piriform Ltd) C:\Users\jacki\Downloads\ccsetup541.exe
2018-03-20 17:04 - 2018-03-20 17:05 - 016010752 _____ (Adobe Systems, Inc.) C:\Users\jacki\Downloads\flashplayer_29_sa.exe
2018-03-18 12:29 - 2018-04-02 12:54 - 000000000 ____D C:\Program Files\McAfee Security Scan
2018-03-18 12:05 - 2018-03-18 18:53 - 000000000 ____D C:\Program Files (x86)\McAfee Safe Connect
2018-03-18 12:05 - 2018-03-18 12:05 - 000000000 ____D C:\Users\jacki\AppData\Roaming\McAfee Safe Connect
2018-03-18 12:05 - 2018-03-18 12:05 - 000000000 ____D C:\Users\jacki\AppData\Local\McAfee_Inc
2018-03-18 11:59 - 2018-04-02 12:54 - 000001969 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2018-03-18 11:59 - 2018-03-21 15:10 - 000003808 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player NPAPI Notifier
2018-03-18 11:59 - 2018-03-21 15:10 - 000003506 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2018-03-18 11:59 - 2018-03-18 11:59 - 000000000 ____D C:\ProgramData\McAfee
2018-03-18 11:58 - 2018-03-18 11:59 - 000000000 ____D C:\Users\jacki\AppData\Local\Adobe
2018-03-18 11:56 - 2018-03-20 22:05 - 000000000 ____D C:\Users\jacki\AppData\LocalLow\Mozilla
2018-03-18 11:56 - 2018-03-18 12:00 - 000000000 ____D C:\Users\jacki\AppData\Local\Mozilla
2018-03-18 11:56 - 2018-03-18 11:56 - 000000965 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2018-03-18 11:56 - 2018-03-18 11:56 - 000000953 _____ C:\Users\Public\Desktop\Firefox.lnk
2018-03-18 11:56 - 2018-03-18 11:56 - 000000000 ____D C:\Users\jacki\AppData\Roaming\Mozilla
2018-03-18 11:56 - 2018-03-18 11:56 - 000000000 ____D C:\Program Files\Mozilla Firefox
2018-03-18 11:56 - 2018-03-18 11:56 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2018-03-18 11:53 - 2018-03-18 11:53 - 000313544 _____ (Mozilla) C:\Users\jacki\Downloads\Firefox Installer.exe
2018-03-18 11:50 - 2018-03-20 18:39 - 000000000 ____D C:\Users\jacki\AppData\Roaming\RotMG.Production
2018-03-18 11:49 - 2018-03-18 11:49 - 000000222 _____ C:\Users\jacki\Desktop\Realm of the Mad God.url
2018-03-13 19:42 - 2018-03-01 23:36 - 017085440 _____ (Microsoft Corporation) C:\WINDOWS\system32\HologramCompositor.dll
2018-03-13 19:42 - 2018-03-01 23:02 - 000037888 _____ C:\WINDOWS\system32\SpectrumSyncClient.dll
2018-03-13 19:42 - 2018-03-01 23:01 - 000640000 _____ (Microsoft Corporation) C:\WINDOWS\system32\HeadTrackerStorage.dll
2018-03-13 19:42 - 2018-03-01 23:00 - 000329728 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Feedback.Analog.dll
2018-03-13 19:42 - 2018-03-01 23:00 - 000248320 _____ (Microsoft Corporation) C:\WINDOWS\system32\svf.dll
2018-03-13 19:42 - 2018-03-01 23:00 - 000230912 _____ (Microsoft Corporation) C:\WINDOWS\system32\HoloShellRuntime.dll
2018-03-13 19:42 - 2018-03-01 22:59 - 000956416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Spectrum.exe
2018-03-13 19:42 - 2018-03-01 16:28 - 000181760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\HoloShellRuntime.dll
2018-03-13 19:42 - 2018-03-01 03:50 - 000270744 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2018-03-13 19:42 - 2018-03-01 03:49 - 000389536 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2018-03-13 19:42 - 2018-03-01 03:48 - 000664472 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2018-03-13 19:42 - 2018-03-01 03:47 - 000749464 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2018-03-13 19:42 - 2018-03-01 03:47 - 000035224 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCensus.exe
2018-03-13 19:42 - 2018-03-01 03:46 - 002003352 _____ (Microsoft Corporation) C:\WINDOWS\system32\aitstatic.exe
2018-03-13 19:42 - 2018-03-01 03:46 - 001568664 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2018-03-13 19:42 - 2018-03-01 03:46 - 000609176 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2018-03-13 19:42 - 2018-03-01 03:46 - 000138144 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2018-03-13 19:42 - 2018-03-01 03:45 - 000070040 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32appinventorycsp.dll
2018-03-13 19:42 - 2018-03-01 03:40 - 002514936 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2018-03-13 19:42 - 2018-03-01 03:40 - 000461720 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcntel.dll
2018-03-13 19:42 - 2018-03-01 03:40 - 000273304 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2018-03-13 19:42 - 2018-03-01 03:37 - 007831760 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll
2018-03-13 19:42 - 2018-03-01 03:31 - 008602520 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2018-03-13 19:42 - 2018-03-01 03:30 - 000540064 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcasvc.dll
2018-03-13 19:42 - 2018-03-01 03:30 - 000264040 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotifyIcon.exe
2018-03-13 19:42 - 2018-03-01 03:29 - 000733592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\acpi.sys
2018-03-13 19:42 - 2018-03-01 03:27 - 001173576 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2018-03-13 19:42 - 2018-03-01 03:26 - 000170912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2018-03-13 19:42 - 2018-03-01 03:25 - 000377752 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msrpc.sys
2018-03-13 19:42 - 2018-03-01 03:23 - 000749976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2018-03-13 19:42 - 2018-03-01 03:19 - 000710768 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVideoDSP.dll
2018-03-13 19:42 - 2018-03-01 03:17 - 002710736 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2018-03-13 19:42 - 2018-03-01 03:17 - 000519152 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecurityHealthService.exe
2018-03-13 19:42 - 2018-03-01 03:17 - 000408984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2018-03-13 19:42 - 2018-03-01 03:15 - 002574232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2018-03-13 19:42 - 2018-03-01 03:14 - 007675784 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2018-03-13 19:42 - 2018-03-01 03:14 - 007384576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2018-03-13 19:42 - 2018-03-01 03:14 - 005105664 _____ (Microsoft Corporation) C:\WINDOWS\system32\AuthFWSnapin.dll
2018-03-13 19:42 - 2018-03-01 03:14 - 001694224 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmde.dll
2018-03-13 19:42 - 2018-03-01 03:14 - 000356952 _____ (Microsoft Corporation) C:\WINDOWS\system32\wintrust.dll
2018-03-13 19:42 - 2018-03-01 03:14 - 000147872 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wcifs.sys
2018-03-13 19:42 - 2018-03-01 03:14 - 000128928 _____ (Microsoft Corporation) C:\WINDOWS\system32\offlinelsa.dll
2018-03-13 19:42 - 2018-03-01 03:12 - 000677272 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2018-03-13 19:42 - 2018-03-01 03:12 - 000250264 _____ (Microsoft Corporation) C:\WINDOWS\system32\offlinesam.dll
2018-03-13 19:42 - 2018-03-01 03:12 - 000189344 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecurityHealthAgent.dll
2018-03-13 19:42 - 2018-03-01 03:11 - 000093600 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2018-03-13 19:42 - 2018-03-01 03:10 - 001779936 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfplat.dll
2018-03-13 19:42 - 2018-03-01 03:10 - 000075168 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecurityHealthProxyStub.dll
2018-03-13 19:42 - 2018-03-01 03:10 - 000022936 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\isapnp.sys
2018-03-13 19:42 - 2018-03-01 03:09 - 001054272 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvproc.dll
2018-03-13 19:42 - 2018-03-01 02:51 - 000777904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2018-03-13 19:42 - 2018-03-01 02:48 - 001930736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2018-03-13 19:42 - 2018-03-01 02:39 - 000213400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aepic.dll
2018-03-13 19:42 - 2018-03-01 02:30 - 005615968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll
2018-03-13 19:42 - 2018-03-01 02:29 - 006092152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2018-03-13 19:42 - 2018-03-01 02:29 - 000574960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVideoDSP.dll
2018-03-13 19:42 - 2018-03-01 02:28 - 006480616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2018-03-13 19:42 - 2018-03-01 02:28 - 002193168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2018-03-13 19:42 - 2018-03-01 02:28 - 000115096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\offlinelsa.dll
2018-03-13 19:42 - 2018-03-01 02:27 - 000284112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wintrust.dll
2018-03-13 19:42 - 2018-03-01 02:27 - 000221592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\offlinesam.dll
2018-03-13 19:42 - 2018-03-01 02:26 - 001524776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfplat.dll
2018-03-13 19:42 - 2018-03-01 02:26 - 001057816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvproc.dll
2018-03-13 19:42 - 2018-03-01 02:23 - 005105664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AuthFWSnapin.dll
2018-03-13 19:42 - 2018-03-01 02:21 - 001558856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll
2018-03-13 19:42 - 2018-03-01 02:09 - 025251840 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2018-03-13 19:42 - 2018-03-01 02:03 - 002902528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2018-03-13 19:42 - 2018-03-01 02:03 - 000471552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcSpecfc.dll
2018-03-13 19:42 - 2018-03-01 02:03 - 000344576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgeIso.dll
2018-03-13 19:42 - 2018-03-01 02:03 - 000162304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\IndexedDbLegacy.dll
2018-03-13 19:42 - 2018-03-01 02:03 - 000065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usoapi.dll
2018-03-13 19:42 - 2018-03-01 02:01 - 019354624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2018-03-13 19:42 - 2018-03-01 02:01 - 006575616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2018-03-13 19:42 - 2018-03-01 02:01 - 000155648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EdgeManager.dll
2018-03-13 19:42 - 2018-03-01 02:01 - 000019456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\credssp.dll
2018-03-13 19:42 - 2018-03-01 02:00 - 000098304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TSpkg.dll
2018-03-13 19:42 - 2018-03-01 01:59 - 000220672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MicrosoftAccountWAMExtension.dll
2018-03-13 19:42 - 2018-03-01 01:58 - 004839424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll
2018-03-13 19:42 - 2018-03-01 01:58 - 000459776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll
2018-03-13 19:42 - 2018-03-01 01:58 - 000405504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Payments.dll
2018-03-13 19:42 - 2018-03-01 01:58 - 000368128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\daxexec.dll
2018-03-13 19:42 - 2018-03-01 01:57 - 000369152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll
2018-03-13 19:42 - 2018-03-01 01:56 - 018922496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2018-03-13 19:42 - 2018-03-01 01:56 - 000559104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2018-03-13 19:42 - 2018-03-01 01:55 - 000346112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\zipfldr.dll
2018-03-13 19:42 - 2018-03-01 01:54 - 003664384 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2018-03-13 19:42 - 2018-03-01 01:54 - 003181568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdp.dll
2018-03-13 19:42 - 2018-03-01 01:54 - 001296896 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll
2018-03-13 19:42 - 2018-03-01 01:54 - 000665088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2018-03-13 19:42 - 2018-03-01 01:54 - 000496128 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll
2018-03-13 19:42 - 2018-03-01 01:54 - 000463360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2018-03-13 19:42 - 2018-03-01 01:53 - 000863232 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
2018-03-13 19:42 - 2018-03-01 01:53 - 000536576 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgeIso.dll
2018-03-13 19:42 - 2018-03-01 01:53 - 000399872 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
2018-03-13 19:42 - 2018-03-01 01:53 - 000246272 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe
2018-03-13 19:42 - 2018-03-01 01:53 - 000206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\IndexedDbLegacy.dll
2018-03-13 19:42 - 2018-03-01 01:53 - 000107520 _____ (Microsoft Corporation) C:\WINDOWS\system32\musdialoghandlers.dll
2018-03-13 19:42 - 2018-03-01 01:53 - 000097792 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatecsp.dll
2018-03-13 19:42 - 2018-03-01 01:53 - 000092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\usoapi.dll
2018-03-13 19:42 - 2018-03-01 01:53 - 000056320 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcSpecfc.dll
2018-03-13 19:42 - 2018-03-01 01:53 - 000039424 _____ (Microsoft Corporation) C:\WINDOWS\system32\UsoClient.exe
2018-03-13 19:42 - 2018-03-01 01:52 - 011923968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2018-03-13 19:42 - 2018-03-01 01:52 - 006030336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2018-03-13 19:42 - 2018-03-01 01:51 - 002329088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVidCtl.dll
2018-03-13 19:42 - 2018-03-01 01:51 - 000201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeManager.dll
2018-03-13 19:42 - 2018-03-01 01:51 - 000034816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\BasicRender.sys
2018-03-13 19:42 - 2018-03-01 01:51 - 000023552 _____ (Microsoft Corporation) C:\WINDOWS\system32\credssp.dll
2018-03-13 19:42 - 2018-03-01 01:50 - 003677184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2018-03-13 19:42 - 2018-03-01 01:50 - 002869760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2018-03-13 19:42 - 2018-03-01 01:50 - 000526336 _____ (Microsoft Corporation) C:\WINDOWS\system32\daxexec.dll
2018-03-13 19:42 - 2018-03-01 01:50 - 000118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSpkg.dll
2018-03-13 19:42 - 2018-03-01 01:50 - 000075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wcnfs.sys
2018-03-13 19:42 - 2018-03-01 01:49 - 000675328 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll
2018-03-13 19:42 - 2018-03-01 01:49 - 000529408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\nwifi.sys
2018-03-13 19:42 - 2018-03-01 01:49 - 000301056 _____ (Microsoft Corporation) C:\WINDOWS\system32\MicrosoftAccountWAMExtension.dll
2018-03-13 19:42 - 2018-03-01 01:49 - 000066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsrv.dll
2018-03-13 19:42 - 2018-03-01 01:48 - 000543232 _____ (Microsoft Corporation) C:\WINDOWS\system32\HolographicExtensions.dll
2018-03-13 19:42 - 2018-03-01 01:48 - 000431616 _____ (Microsoft Corporation) C:\WINDOWS\system32\msIso.dll
2018-03-13 19:42 - 2018-03-01 01:47 - 023674368 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2018-03-13 19:42 - 2018-03-01 01:47 - 000579584 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Payments.dll
2018-03-13 19:42 - 2018-03-01 01:47 - 000484352 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdpusersvc.dll
2018-03-13 19:42 - 2018-03-01 01:46 - 004051968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
2018-03-13 19:42 - 2018-03-01 01:46 - 000770048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdiWiFi.sys
2018-03-13 19:42 - 2018-03-01 01:46 - 000026624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msisip.dll
2018-03-13 19:42 - 2018-03-01 01:45 - 000708096 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2018-03-13 19:42 - 2018-03-01 01:45 - 000594944 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2018-03-13 19:42 - 2018-03-01 01:45 - 000386560 _____ (Microsoft Corporation) C:\WINDOWS\system32\zipfldr.dll
2018-03-13 19:42 - 2018-03-01 01:44 - 008030720 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2018-03-13 19:42 - 2018-03-01 01:44 - 005195776 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdp.dll
2018-03-13 19:42 - 2018-03-01 01:43 - 012830208 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2018-03-13 19:42 - 2018-03-01 01:42 - 003505664 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVidCtl.dll
2018-03-13 19:42 - 2018-03-01 01:42 - 002084352 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2018-03-13 19:42 - 2018-03-01 01:41 - 008103936 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2018-03-13 19:42 - 2018-03-01 01:41 - 004745728 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2018-03-13 19:42 - 2018-03-01 01:41 - 003334144 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2018-03-13 19:42 - 2018-03-01 01:41 - 001548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2018-03-13 19:42 - 2018-03-01 01:41 - 000812032 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2018-03-13 19:42 - 2018-03-01 01:40 - 005833216 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll
2018-03-13 19:42 - 2018-03-01 01:39 - 002222592 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidsvc.dll
2018-03-13 19:42 - 2018-03-01 01:39 - 002035712 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2018-03-13 19:42 - 2018-03-01 01:39 - 000899584 _____ (Microsoft Corporation) C:\WINDOWS\system32\samsrv.dll
2018-03-13 19:42 - 2018-03-01 01:39 - 000666624 _____ (Microsoft Corporation) C:\WINDOWS\system32\DbgModel.dll
2018-03-13 19:42 - 2018-03-01 01:38 - 000963072 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorSvc.dll
2018-03-13 19:42 - 2018-03-01 01:38 - 000726016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv2.sys
2018-03-13 19:42 - 2018-03-01 01:36 - 004050432 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2018-03-13 19:42 - 2018-03-01 01:36 - 000030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\msisip.dll
2018-03-13 19:42 - 2018-03-01 01:35 - 000568320 _____ (Microsoft Corporation) C:\WINDOWS\system32\msra.exe
2018-03-13 19:42 - 2018-03-01 01:35 - 000128000 _____ (Microsoft Corporation) C:\WINDOWS\system32\racpldlg.dll
2018-03-13 19:42 - 2018-03-01 01:35 - 000050176 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcalua.exe
2018-03-13 19:42 - 2018-02-21 22:23 - 001092016 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2018-03-13 19:42 - 2018-02-21 22:23 - 000924648 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2018-03-13 19:42 - 2018-02-21 22:13 - 000279456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msiscsi.sys
2018-03-13 19:42 - 2018-02-21 22:13 - 000077216 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll
2018-03-13 19:42 - 2018-02-21 22:11 - 000109984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmbus.sys
2018-03-13 19:42 - 2018-02-21 22:10 - 000285080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2018-03-13 19:42 - 2018-02-21 22:08 - 001206688 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2018-03-13 19:42 - 2018-02-21 22:08 - 001055648 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2018-03-13 19:42 - 2018-02-21 22:08 - 000571288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys
2018-03-13 19:42 - 2018-02-21 22:07 - 001415296 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2018-03-13 19:42 - 2018-02-21 22:07 - 001209248 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2018-03-13 19:42 - 2018-02-21 22:07 - 000194456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ataport.sys
2018-03-13 19:42 - 2018-02-21 22:03 - 000712600 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2018-03-13 19:42 - 2018-02-21 22:03 - 000082848 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volmgr.sys
2018-03-13 19:42 - 2018-02-21 22:02 - 000149400 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storahci.sys
2018-03-13 19:42 - 2018-02-21 22:00 - 000187296 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys
2018-03-13 19:42 - 2018-02-21 21:59 - 021351624 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2018-03-13 19:42 - 2018-02-21 21:54 - 000437144 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS
2018-03-13 19:42 - 2018-02-21 21:52 - 000103328 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\stornvme.sys
2018-03-13 19:42 - 2018-02-21 21:51 - 000555424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2018-03-13 19:42 - 2018-02-21 21:51 - 000097176 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdstor.sys
2018-03-13 19:42 - 2018-02-21 21:51 - 000045472 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storufs.sys
2018-03-13 19:42 - 2018-02-21 21:50 - 000362904 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys
2018-03-13 19:42 - 2018-02-21 21:50 - 000229272 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tpm.sys
2018-03-13 19:42 - 2018-02-21 20:41 - 020286120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2018-03-13 19:42 - 2018-02-21 20:31 - 000057344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\UcmUcsi.sys
2018-03-13 19:42 - 2018-02-21 20:30 - 000192512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netvsc.sys
2018-03-13 19:42 - 2018-02-21 20:30 - 000046080 _____ (Microsoft Corporation) C:\WINDOWS\system32\hidparse.sys
2018-03-13 19:42 - 2018-02-21 20:30 - 000046080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidparse.sys
2018-03-13 19:42 - 2018-02-21 20:30 - 000043008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\RfxVmt.sys
2018-03-13 19:42 - 2018-02-21 20:27 - 001282048 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVPXENC.dll
2018-03-13 19:42 - 2018-02-21 20:26 - 001015296 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthport.sys
2018-03-13 19:42 - 2018-02-21 20:25 - 000086528 _____ (Microsoft Corporation) C:\WINDOWS\system32\cldapi.dll
2018-03-13 19:42 - 2018-02-21 20:16 - 001286144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVPXENC.dll
2018-03-13 19:42 - 2018-02-21 20:12 - 000076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cldapi.dll
2018-03-12 19:29 - 2018-03-12 19:29 - 000000000 ____D C:\Users\jacki\AppData\LocalLow\Team 17 Digital ltd_
2018-03-09 22:19 - 2018-03-09 22:19 - 000004141 _____ C:\Users\jacki\Downloads\stewie2k.zip
2018-03-09 20:34 - 2018-03-09 20:34 - 000000000 ____D C:\Users\jacki\AppData\Local\My Games
2018-03-09 18:25 - 2018-03-09 18:25 - 000000220 _____ C:\Users\jacki\Desktop\Sid Meier's Civilization V.url
2018-03-05 19:50 - 2018-03-05 19:50 - 000000000 ____D C:\ProgramData\Unknown Worlds
2018-03-05 19:49 - 2018-03-05 19:49 - 000000000 ____D C:\Users\jacki\AppData\LocalLow\Unknown Worlds
2018-03-05 16:45 - 2018-03-05 16:45 - 002925876 _____ C:\Users\jacki\Downloads\8m2b.1.pdf
2018-03-04 23:29 - 2018-03-04 23:29 - 000000222 _____ C:\Users\jacki\Desktop\Subnautica.url

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-04-03 12:52 - 2017-12-03 02:37 - 000000000 ____D C:\Users\jacki\AppData\Roaming\Skype
2018-04-03 12:25 - 2017-12-02 15:03 - 000000000 ____D C:\Users\jacki\AppData\Local\NVIDIA Corporation
2018-04-03 11:31 - 2017-12-11 15:43 - 007350918 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2018-04-03 11:28 - 2018-02-19 13:13 - 000000000 ____D C:\ProgramData\Logishrd
2018-04-03 11:28 - 2017-12-03 02:00 - 000000000 ____D C:\Program Files (x86)\Steam
2018-04-03 11:28 - 2017-12-02 15:01 - 000000000 __SHD C:\Users\jacki\IntelGraphicsProfiles
2018-04-03 11:27 - 2018-02-08 22:40 - 000002984 _____ C:\WINDOWS\System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2018-04-03 11:27 - 2018-02-08 22:40 - 000002956 _____ C:\WINDOWS\System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2018-04-03 11:27 - 2018-02-08 22:40 - 000002838 _____ C:\WINDOWS\System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2018-04-03 11:27 - 2018-02-08 22:40 - 000002744 _____ C:\WINDOWS\System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2018-04-03 11:27 - 2018-02-08 19:38 - 000000000 ____D C:\ProgramData\NVIDIA
2018-04-03 11:27 - 2018-01-14 02:15 - 000000000 ____D C:\Program Files (x86)\Hi-Rez Studios
2018-04-03 11:27 - 2017-12-11 15:38 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2018-04-03 11:27 - 2017-12-11 15:33 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2018-04-03 11:15 - 2017-09-29 09:46 - 000000000 ____D C:\WINDOWS\DeliveryOptimization
2018-04-03 11:14 - 2017-09-29 09:46 - 000000000 ___HD C:\Program Files\WindowsApps
2018-04-03 11:14 - 2017-09-29 09:46 - 000000000 ____D C:\WINDOWS\AppReadiness
2018-04-03 11:08 - 2017-12-11 15:35 - 000000000 ____D C:\Users\jacki
2018-04-03 01:55 - 2017-12-11 15:58 - 000000000 ____D C:\WINDOWS\Minidump
2018-04-03 00:59 - 2017-09-29 04:45 - 000786432 _____ C:\WINDOWS\system32\config\BBI
2018-04-03 00:28 - 2018-02-08 22:42 - 000000000 ____D C:\Users\jacki\AppData\Local\NVIDIA
2018-04-03 00:28 - 2017-09-29 09:44 - 000000000 ____D C:\WINDOWS\INF
2018-04-03 00:28 - 2017-09-13 12:52 - 000000000 ____D C:\ProgramData\NVIDIA Corporation
2018-04-03 00:28 - 2017-09-13 12:52 - 000000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2018-04-03 00:28 - 2017-09-13 12:50 - 000000000 ____D C:\Program Files\NVIDIA Corporation
2018-04-03 00:23 - 2017-12-31 17:21 - 000000000 ____D C:\Users\jacki\AppData\Local\ElevatedDiagnostics
2018-04-02 23:04 - 2017-12-07 20:12 - 000000000 ____D C:\Users\jacki\AppData\Local\CrashDumps
2018-04-02 23:04 - 2017-09-29 09:46 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2018-04-02 14:19 - 2017-09-29 09:46 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2018-04-02 14:18 - 2017-09-29 09:46 - 000000000 ____D C:\Program Files\Common Files\microsoft shared
2018-04-02 14:18 - 2017-09-13 13:08 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2016 Tools
2018-04-02 14:17 - 2017-09-13 13:07 - 000000000 ____D C:\Program Files\Microsoft Office
2018-04-02 14:15 - 2017-09-13 12:49 - 000000000 ____D C:\Program Files (x86)\VulkanRT
2018-04-01 21:41 - 2018-02-11 17:07 - 000000000 ____D C:\Users\jacki\AppData\Local\PlaceholderTileLogoFolder
2018-04-01 19:17 - 2017-12-11 15:35 - 000000000 ____D C:\Users\jacki\AppData\Local\Packages
2018-03-31 18:43 - 2018-02-10 18:37 - 000000000 ____D C:\Program Files (x86)\Intel Driver and Support Assistant
2018-03-29 19:11 - 2017-12-03 17:13 - 000000222 _____ C:\Users\jacki\Desktop\ARK Survival Evolved.url
2018-03-25 12:08 - 2018-02-08 22:38 - 004633920 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvapi64.dll
2018-03-25 12:08 - 2018-02-08 22:38 - 003939624 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvapi.dll
2018-03-23 21:19 - 2018-01-14 17:41 - 000048407 _____ C:\WINDOWS\system32\nvinfo.pb
2018-03-23 19:02 - 2018-02-08 22:37 - 005952392 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcpl.dll
2018-03-23 19:02 - 2018-02-08 22:37 - 002596320 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvsvc64.dll
2018-03-23 19:02 - 2018-02-08 22:37 - 001767824 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvsvcr.dll
2018-03-23 19:02 - 2018-02-08 22:37 - 000633224 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nv3dappshext.dll
2018-03-23 19:02 - 2018-02-08 22:37 - 000451040 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvmctray.dll
2018-03-23 19:02 - 2018-02-08 22:37 - 000123840 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvshext.dll
2018-03-23 19:02 - 2018-02-08 22:37 - 000083072 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nv3dappshextr.dll
2018-03-21 15:11 - 2018-02-16 22:28 - 000000438 _____ C:\WINDOWS\Tasks\Driver Easy Scheduled Scan.job
2018-03-21 15:10 - 2018-02-16 22:28 - 000003622 _____ C:\WINDOWS\System32\Tasks\Driver Easy Scheduled Scan
2018-03-21 15:10 - 2018-02-10 18:37 - 000002750 _____ C:\WINDOWS\System32\Tasks\USER_ESRV_SVC_QUEENCREEK
2018-03-21 15:10 - 2018-01-11 19:25 - 000003102 _____ C:\WINDOWS\System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473
2018-03-21 15:10 - 2018-01-11 18:42 - 000003030 _____ C:\WINDOWS\System32\Tasks\IntelSURQC-Upgrade-86621605-2a0b-4128-8ffc-15514c247132
2018-03-21 15:10 - 2018-01-11 18:42 - 000002664 _____ C:\WINDOWS\System32\Tasks\IntelSURQC-Upgrade-86621605-2a0b-4128-8ffc-15514c247132-Logon
2018-03-21 15:10 - 2017-12-12 15:35 - 000003366 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{CB53DDBC-1EF1-4ADA-A8FD-FF8915ABA0BA}
2018-03-21 15:10 - 2017-12-11 15:38 - 000003404 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2018-03-21 15:10 - 2017-12-11 15:38 - 000003180 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2018-03-21 15:10 - 2017-12-11 15:38 - 000003178 _____ C:\WINDOWS\System32\Tasks\Intel PTT EK Recertification
2018-03-21 15:10 - 2017-12-11 15:38 - 000002984 _____ C:\WINDOWS\System32\Tasks\ATK Package 36D18D69AFC3
2018-03-21 15:10 - 2017-12-11 15:38 - 000002912 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-1575408045-1876520637-41634806-1001
2018-03-21 15:10 - 2017-12-11 15:38 - 000002826 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task v2
2018-03-21 15:10 - 2017-12-11 15:38 - 000002406 _____ C:\WINDOWS\System32\Tasks\RtHDVBg_ListenToDevice
2018-03-21 15:10 - 2017-12-11 15:38 - 000002362 _____ C:\WINDOWS\System32\Tasks\RTKCPL
2018-03-21 15:10 - 2017-12-11 15:38 - 000002274 _____ C:\WINDOWS\System32\Tasks\ATK Package A22126881260
2018-03-21 07:22 - 2018-02-08 22:37 - 008114212 _____ C:\WINDOWS\system32\nvcoproc.bin
2018-03-20 19:17 - 2017-12-02 15:03 - 000002363 _____ C:\Users\jacki\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2018-03-20 19:17 - 2017-12-02 15:03 - 000000000 ___RD C:\Users\jacki\OneDrive
2018-03-20 18:08 - 2018-01-11 21:42 - 000000000 ____D C:\Users\jacki\Downloads\Compressed
2018-03-20 17:59 - 2017-12-10 12:09 - 000000000 ___DC C:\WINDOWS\Panther
2018-03-18 11:59 - 2017-09-29 09:46 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
2018-03-18 11:59 - 2017-09-29 09:46 - 000000000 ____D C:\WINDOWS\system32\Macromed
2018-03-18 11:49 - 2017-12-03 02:08 - 000000000 ____D C:\Users\jacki\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2018-03-17 12:21 - 2017-09-29 09:46 - 000000000 ____D C:\WINDOWS\rescache
2018-03-14 20:02 - 2018-01-04 00:11 - 000000000 ____D C:\Users\jacki\AppData\Local\Ubisoft Game Launcher
2018-03-14 08:44 - 2018-02-08 22:40 - 000001951 _____ C:\WINDOWS\NvTelemetryContainerRecovery.bat
2018-03-14 00:14 - 2017-12-11 15:39 - 000000000 ___RD C:\Users\jacki\3D Objects
2018-03-14 00:14 - 2017-12-11 15:33 - 000381984 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2018-03-14 00:14 - 2017-09-13 12:45 - 000000000 __RHD C:\Users\Public\AccountPictures
2018-03-14 00:13 - 2017-09-29 09:46 - 000000000 ____D C:\WINDOWS\TextInput
2018-03-14 00:13 - 2017-09-29 09:46 - 000000000 ____D C:\WINDOWS\system32\appraiser
2018-03-14 00:13 - 2017-09-29 09:46 - 000000000 ____D C:\WINDOWS\ShellExperiences
2018-03-13 19:45 - 2017-12-03 10:50 - 000000000 ____D C:\WINDOWS\system32\MRT
2018-03-13 19:45 - 2017-09-29 09:37 - 000000000 ____D C:\WINDOWS\CbsTemp
2018-03-13 19:44 - 2017-12-03 10:50 - 130364688 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT-KB890830.exe
2018-03-13 19:44 - 2017-12-03 10:50 - 130364688 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2018-03-13 19:42 - 2017-09-29 09:41 - 000140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2018-03-13 19:42 - 2017-09-29 09:41 - 000106496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
2018-03-09 20:34 - 2017-12-17 01:03 - 000000000 ____D C:\Users\jacki\Documents\My Games

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2018-03-25 21:39

==================== End of FRST.txt ============================

Link to post
Share on other sites

This is the addition file

Processor: Intel(R) Core(TM) i7-7700HQ CPU @ 2.80GHz
Percentage of memory in use: 35%
Total physical RAM: 16265.09 MB
Available physical RAM: 10427 MB
Total Virtual: 18697.09 MB
Available Virtual: 12255.25 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:237.42 GB) (Free:144.13 GB) NTFS
Drive d: (DATA) (Fixed) (Total:931.51 GB) (Free:617.44 GB) NTFS

\\?\Volume{587e30e3-9bf7-44cc-bb03-967ec68236f6}\ (SYSTEM) (Fixed) (Total:0.25 GB) (Free:0.23 GB) FAT32
\\?\Volume{3e0ce6d8-e53f-4c02-a425-955c9c584f57}\ (RECOVERY) (Fixed) (Total:0.78 GB) (Free:0.4 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 238.5 GB) (Disk ID: A70157F5)

Partition: GPT.

========================================================
Disk: 1 (Size: 931.5 GB) (Disk ID: 7385B2E5)

Partition: GPT.

==================== End of Addition.txt ============================

Link to post
Share on other sites

Ok. Here is the full one right?

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 14.03.2018
Ran by jacki (03-04-2018 13:07:33)
Running from C:\Users\jacki\Downloads
Windows 10 Home Version 1709 16299.309 (X64) (2017-12-11 19:39:24)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-1575408045-1876520637-41634806-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1575408045-1876520637-41634806-503 - Limited - Disabled)
Guest (S-1-5-21-1575408045-1876520637-41634806-501 - Limited - Disabled)
jacki (S-1-5-21-1575408045-1876520637-41634806-1001 - Administrator - Enabled) => C:\Users\jacki
WDAGUtilityAccount (S-1-5-21-1575408045-1876520637-41634806-504 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avast Antivirus (Enabled - Up to date) {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
AS: Malwarebytes (Enabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avast Antivirus (Enabled - Up to date) {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

. . (HKLM\...\{569F29BA-2D46-439B-8B7C-01D999B9201D}) (Version: 7.1 - Intel) Hidden
. . . (HKLM-x32\...\{9F460796-0348-4B11-BCA0-714C4B85E3D7}) (Version: 3.1.2.2 - Intel) Hidden
Adobe Flash Player 29 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 29.0.0.113 - Adobe Systems Incorporated)
ASUS PTP Driver (HKLM-x32\...\{7618E419-9124-4E6C-9AF4-487A6DDEC1C5}) (Version: 11.0.16 - ASUS)
ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0051 - ASUS)
AudioWizard (HKLM-x32\...\{57E770A2-2BAF-4CAA-BAA3-BD896E2254D3}) (Version: 1.0.3.32 - ICEpower a/s)
Avast Free Antivirus (HKLM-x32\...\Avast Antivirus) (Version: 18.2.2328 - AVAST Software)
CCleaner (HKLM\...\CCleaner) (Version: 5.41 - Piriform)
Device Setup (HKLM-x32\...\{8D6B05E0-F457-408C-9D13-549334D8FAE1}) (Version: 2.2.7 - ASUSTek COMPUTER INC.)
Discord (HKU\S-1-5-21-1575408045-1876520637-41634806-1001\...\Discord) (Version: 0.0.300 - Discord Inc.)
DisplayDriverAnalyzer (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_DisplayDriverAnalyzer) (Version: 391.35 - NVIDIA Corporation) Hidden
Driver Easy 5.6.0 (HKLM\...\DriverEasy_is1) (Version: 5.6.0 - Easeware)
Epic Games Launcher (HKLM-x32\...\{213B426C-5317-4F2D-8395-AC04B70711C4}) (Version: 1.1.133.0 - Epic Games, Inc.)
Epic Games Launcher Prerequisites (x64) (HKLM\...\{66C5838F-B854-4A55-89E6-A6138747A4DF}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden
Genesys USB Mass Storage Device (HKLM-x32\...\{CA7CA513-2531-4801-83C6-CF8FB6C8711A}) (Version: 4.5.1.1.1001 - Genesys Logic)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 64.0.3282.186 - Google Inc.)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.7 - Google Inc.) Hidden
Hi-Rez Studios Authenticate and Update Service (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}) (Version: 3.0.0.0 - Hi-Rez Studios)
Intel(R) Chipset Device Software (HKLM-x32\...\{bb0592a7-5772-4736-9d55-2402740085db}) (Version: 10.1.1.38 - Intel(R) Corporation) Hidden
Intel(R) Computing Improvement Program (HKLM\...\{699E6891-25C3-443A-9B8E-80C74F0172C8}) (Version: 2.1.03413 - Intel Corporation)
Intel(R) Dynamic Platform and Thermal Framework (HKLM-x32\...\{654EE65D-FAA4-4EA6-8C07-DC94E6A304D4}) (Version: 8.2.11002.3418 - Intel Corporation)
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.6.0.1035 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 21.20.16.4627 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 15.2.5.1035 - Intel Corporation)
Intel(R) Serial IO (HKLM\...\{9FD91C5C-44AE-4D9D-85BE-AE52816B0294}) (Version: 30.100.1643.1 - Intel Corporation)
Intel(R) Wireless Bluetooth(R) (HKLM-x32\...\{00000030-0200-1033-84C8-B8D95FA3C8C3}) (Version: 20.30.0 - Intel Corporation)
Intel® Driver & Support Assistant (HKLM-x32\...\{e7adbf16-34ad-490a-a4e8-feb60fb99973}) (Version: 3.1.2.2 - Intel)
Intel® PROSet/Wireless Software (HKLM-x32\...\{1b3fcb8d-3d2b-4477-b722-0b3e2c1195ba}) (Version: 20.30.1 - Intel Corporation)
Java 8 Update 151 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180151F0}) (Version: 8.0.1510.12 - Oracle Corporation)
League of Legends (HKLM-x32\...\League of Legends 1.0) (Version: 1.0 - Riot Games, Inc)
Logitech Gaming Software 8.96 (HKLM\...\Logitech Gaming Software) (Version: 8.96.88 - Logitech Inc.)
Malwarebytes version 3.4.5.2467 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.4.5.2467 - Malwarebytes)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.11.717.1 - McAfee, Inc.)
Microsoft Office 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 16.0.9126.2116 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1575408045-1876520637-41634806-1001\...\OneDriveSetup.exe) (Version: 18.025.0204.0009 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2017 Redistributable (x64) - 14.10.25008 (HKLM-x32\...\{f1e7e313-06df-4c56-96a9-99fdfd149c51}) (Version: 14.10.25008.0 - Microsoft Corporation)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.10.25008 (HKLM-x32\...\{c239cea1-d49e-4e16-8e87-8c055765f7ec}) (Version: 14.10.25008.0 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\...\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation)
Mozilla Firefox 59.0.1 (x64 en-US) (HKLM\...\Mozilla Firefox 59.0.1 (x64 en-US)) (Version: 59.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 59.0.1 - Mozilla)
NVIDIA Graphics Driver 391.35 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 391.35 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.17.0524 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.17.0524 - NVIDIA Corporation)
Office 16 Click-to-Run Extensibility Component (HKLM\...\{90160000-008C-0000-1000-0000000FF1CE}) (Version: 16.0.9126.2116 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (HKLM\...\{90160000-007E-0000-1000-0000000FF1CE}) (Version: 16.0.9126.2116 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (HKLM\...\{90160000-008C-0409-1000-0000000FF1CE}) (Version: 16.0.9126.2116 - Microsoft Corporation) Hidden
Origin (HKLM-x32\...\Origin) (Version: 10.5.8.17910 - Electronic Arts, Inc.)
PlanetSide 2 (HKU\S-1-5-21-1575408045-1876520637-41634806-1001\...\DG0-PlanetSide 2) (Version:  - Sony Online Entertainment)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.10.714.2016 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.8073 - Realtek Semiconductor Corp.)
Roblox Player for jacki (HKU\S-1-5-21-1575408045-1876520637-41634806-1001\...\{373B1718-8CC5-4567-8EE2-9033AD08A680}) (Version:  - Roblox Corporation)
Sid Meier's Civilization V (HKLM-x32\...\steam app 8930) (Version:  - 2K Games, Inc.)
Skype™ 7.40 (HKLM-x32\...\{3B7E914A-93D5-4A29-92BB-AF8C3F66C431}) (Version: 7.40.151 - Skype Technologies S.A.)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Uplay (HKLM-x32\...\Uplay) (Version: 27.0 - Ubisoft)
Vulkan Run Time Libraries 1.0.33.0 (HKLM\...\VulkanRT1.0.33.0) (Version: 1.0.33.0 - LunarG, Inc.) Hidden
Vulkan Run Time Libraries 1.0.33.0 (HKLM\...\VulkanRT1.0.33.0-2) (Version: 1.0.33.0 - LunarG, Inc.) Hidden
Vulkan Run Time Libraries 1.0.33.0 (HKLM\...\VulkanRT1.0.33.0-3) (Version: 1.0.33.0 - LunarG, Inc.) Hidden
Vulkan Run Time Libraries 1.0.33.0 (HKLM\...\VulkanRT1.0.33.0-4) (Version: 1.0.33.0 - LunarG, Inc.)
Vulkan Run Time Libraries 1.0.42.0 (HKLM\...\VulkanRT1.0.42.0) (Version: 1.0.42.0 - LunarG, Inc.) Hidden
Vulkan Run Time Libraries 1.0.42.0 (HKLM\...\VulkanRT1.0.42.0-2) (Version: 1.0.42.0 - LunarG, Inc.) Hidden
Vulkan Run Time Libraries 1.0.42.0 (HKLM\...\VulkanRT1.0.42.0-3) (Version: 1.0.42.0 - LunarG, Inc.)
Vulkan Run Time Libraries 1.0.65.1 (HKLM\...\VulkanRT1.0.65.1) (Version: 1.0.65.1 - LunarG, Inc.) Hidden
Windows Driver Package - ASUS (AsusPTPDrv) HIDClass  (09/23/2016 11.0.0.14) (HKLM\...\F95583A62AB902A3FC263F668380483F9E0113CD) (Version: 09/23/2016 11.0.0.14 - ASUS)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2018-03-20] (AVAST Software)
ContextMenuHandlers1: [avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2018-03-20] (AVAST Software)
ContextMenuHandlers3: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2018-03-20] (AVAST Software)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-03-27] (Malwarebytes)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\System32\DriverStore\FileRepository\igdlh64.inf_amd64_0d8b06fa651db23a\igfxDTCM.dll [2018-01-13] (Intel Corporation)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\WINDOWS\system32\nvshext.dll [2018-03-23] (NVIDIA Corporation)
ContextMenuHandlers6: [avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2018-03-20] (AVAST Software)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-03-27] (Malwarebytes)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0CC62AA4-0479-4A7E-9D77-2D289E2F5B06} - System32\Tasks\USER_ESRV_SVC_QUEENCREEK => "C:\WINDOWS\System32\Wscript.exe" //B //NoLogo "C:\Program Files\Intel\SUR\QUEENCREEK\x64\task.vbs"
Task: {11333777-6915-4586-9A0C-A528B2340D50} - System32\Tasks\ATK Package A22126881260 => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\SimAppExec.exe [2016-11-14] (ASUSTek Computer Inc.)
Task: {3064F24D-EF2D-41FD-8018-9ED9C98BD909} - System32\Tasks\RTKCPL => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2017-02-22] (Realtek Semiconductor)
Task: {4245F50F-0250-4C00-AF30-FB2A3C430813} - System32\Tasks\Intel PTT EK Recertification => C:\Program Files\Intel\iCLS Client\IntelPTTEKRecertification.exe [2016-07-26] (Intel(R) Corporation)
Task: {49A90BA4-0B62-4E8D-AD8F-F50679F6091F} - System32\Tasks\Avast Emergency Update => C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe [2018-03-20] (AVAST Software)
Task: {55AD65F3-3DA6-4B79-8294-282DCA55E58E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-12-02] (Google Inc.)
Task: {74B4E2BD-4555-4B65-9F2A-113F12A2F673} - System32\Tasks\RtHDVBg_ListenToDevice => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2017-02-22] (Realtek Semiconductor)
Task: {7E3F3024-3CBD-430D-931F-0C38EF223C2A} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe
Task: {851F0435-DB21-4F3F-B87F-FF81FD244834} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2018-03-14] (NVIDIA Corporation)
Task: {88846E90-06B6-4E56-8AB7-6D4F7DA4D425} - System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe [2018-03-14] (NVIDIA Corporation)
Task: {8F9D7E09-04FB-4FA8-B08A-F3C66605388F} - System32\Tasks\Driver Easy Scheduled Scan => C:\Program Files\Easeware\DriverEasy\DriverEasy.exe [2018-01-15] (Easeware)
Task: {97C17069-1F96-44C1-825E-F80ED78A1F29} - System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2018-03-14] (NVIDIA Corporation)
Task: {99BC9BBB-192C-4FB5-98A1-E6678717B585} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2018-03-06] (Piriform Ltd)
Task: {9ADEEE73-FD99-4C33-8CC1-53E6E3E01791} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerRegistration => C:\Program Files\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [2018-04-02] (Microsoft Corporation)
Task: {B23FB8F4-F175-4509-A262-F9CBC2E24E22} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-12-02] (Google Inc.)
Task: {B7C2853A-F964-4BFE-BCEF-52AC3F9C3F3F} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2018-03-24] (Microsoft Corporation)
Task: {B95D0A56-E804-4F9B-8035-9727C01125DF} - System32\Tasks\IntelSURQC-Upgrade-86621605-2a0b-4128-8ffc-15514c247132 => C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe [2017-07-13] (Intel Corporation)
Task: {BC2791E4-7CE8-45B2-A1A6-A189011C5831} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2018-03-18] (Adobe Systems Incorporated)
Task: {C8BC90C9-B36D-4D7F-9A9A-C68A1329F23D} - System32\Tasks\ASUS\ASUS Product Register Service => C:\Program Files (x86)\ASUS\APRP\aprp.exe [2016-11-09] (ASUSTek COMPUTER INC.)
Task: {D161C517-DFCD-49C4-8E19-62D2997C5169} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerLogon => C:\Program Files\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [2018-04-02] (Microsoft Corporation)
Task: {E757E98B-F14A-45CF-93B3-D7A4AD4B99B0} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2018-03-24] (Microsoft Corporation)
Task: {EAF2B17E-C72E-4025-B549-679400010C1C} - System32\Tasks\Avast Software\Overseer => C:\Program Files\AVAST Software\Avast\setup\overseer.exe [2018-03-20] (AVAST Software)
Task: {EE226629-3FF3-415C-89B2-4560F933BBD3} - System32\Tasks\IntelSURQC-Upgrade-86621605-2a0b-4128-8ffc-15514c247132-Logon => C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe [2017-07-13] (Intel Corporation)
Task: {EF4E6141-5AA9-4514-A72F-02F48BCB496F} - System32\Tasks\Adobe Flash Player NPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_29_0_0_113_Plugin.exe [2018-03-18] (Adobe Systems Incorporated)
Task: {F34074C9-741B-4AD6-84CC-983BD3F42B3A} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [2018-03-06] (Piriform Ltd)
Task: {FA02B1FD-4048-4FEF-B306-E7124DF66224} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2018-03-14] (NVIDIA Corporation)
Task: {FA6CCF5E-D933-4255-BA76-8A7C2487479B} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(1): schtasks.exe -> /Change /TN "\CCleanerSkipUAC" /ENABLE
Task: {FA6CCF5E-D933-4255-BA76-8A7C2487479B} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(2): schtasks.exe -> /Change /TN "\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}" /ENABLE
Task: {FA6CCF5E-D933-4255-BA76-8A7C2487479B} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(3): schtasks.exe -> /Change /TN "\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}" /ENABLE
Task: {FA6CCF5E-D933-4255-BA76-8A7C2487479B} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(4): schtasks.exe -> /Change /TN "\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}" /ENABLE
Task: {FA6CCF5E-D933-4255-BA76-8A7C2487479B} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(5): schtasks.exe -> /Change /TN "\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}" /ENABLE
Task: {FA6CCF5E-D933-4255-BA76-8A7C2487479B} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(6): schtasks.exe -> /Change /TN "\AVAST Software\Gaming mode Task Scheduler recovery" /DISABLE
Task: {FE8B6455-5F07-4B33-9E54-146A56D55C80} - System32\Tasks\ATK Package 36D18D69AFC3 => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\SimAppExec.exe [2016-11-14] (ASUSTek Computer Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
Task: C:\WINDOWS\Tasks\Driver Easy Scheduled Scan.job => C:\Program Files\Easeware\DriverEasy\DriverEasy.exe

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


ShortcutWithArgument: C:\Users\jacki\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Hotspot Shield Free VPN Proxy – Unblock Sites.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) ->  --profile-directory=Default --app-id=heajfgnegopeedndeahkdjedjkjcmnpb
ShortcutWithArgument: C:\Users\jacki\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\SaferVPN - FREE VPN _ Privacy & Unblock Sites.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) ->  --profile-directory=Default --app-id=iamifmhbkeeccbjkaenolpghohlpnioi

==================== Loaded Modules (Whitelisted) ==============

2017-09-29 09:41 - 2017-09-29 09:41 - 000184432 _____ () C:\WINDOWS\SYSTEM32\inputhost.dll
2018-02-08 22:40 - 2018-03-23 21:19 - 000544192 _____ () C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem\DisplayDriverAnalyzer\_DisplayDriverCrashAnalyzer64.dll
2018-01-11 02:25 - 2018-01-11 02:25 - 000182544 _____ () C:\Program Files\Intel\SUR\QUEENCREEK\SurSvc.exe
2018-04-03 00:56 - 2018-03-12 15:09 - 002300192 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SelfProtectionSdk.dll
2018-04-03 00:56 - 2018-03-27 13:47 - 002492704 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MwacLib.dll
2018-03-13 19:42 - 2018-02-21 20:26 - 011044864 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2018-03-13 19:42 - 2018-02-21 20:21 - 001804288 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2015-03-06 20:07 - 2015-03-06 20:07 - 000908568 _____ () C:\Program Files\Logitech Gaming Software\libGLESv2.dll
2017-10-19 23:29 - 2017-10-19 23:29 - 001096824 _____ () C:\Program Files\Logitech Gaming Software\platforms\qwindows.dll
2015-03-06 20:07 - 2015-03-06 20:07 - 000060184 _____ () C:\Program Files\Logitech Gaming Software\libEGL.dll
2017-10-19 23:29 - 2017-10-19 23:29 - 000241784 _____ () C:\Program Files\Logitech Gaming Software\imageformats\qjpeg.dll
2017-10-19 23:02 - 2017-10-19 23:02 - 000077824 _____ () C:\Program Files\Logitech Gaming Software\LAClient\zlib.dll
2017-10-19 23:02 - 2017-10-19 23:02 - 000144896 _____ () C:\Program Files\Logitech Gaming Software\LAClient\libssh2.dll
2017-12-03 09:51 - 2017-12-03 09:52 - 098275328 _____ () C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\ThirdParty\CEF3\Win64\libcef.dll
2017-12-03 09:52 - 2017-12-03 09:52 - 003922432 _____ () C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\ThirdParty\CEF3\Win64\libGLESv2.dll
2017-12-03 09:52 - 2017-12-03 09:52 - 000092672 _____ () C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\ThirdParty\CEF3\Win64\libEGL.dll
2018-03-26 14:41 - 2018-03-26 14:41 - 000086528 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1811.248.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2018-03-26 14:41 - 2018-03-26 14:41 - 000195072 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1811.248.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2018-03-26 14:41 - 2018-03-26 14:41 - 022050304 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1811.248.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2018-03-26 14:41 - 2018-03-26 14:41 - 002584576 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1811.248.0_x64__kzf8qxf38zg5c\skypert.dll
2018-03-26 14:41 - 2018-03-26 14:41 - 000657408 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1811.248.0_x64__kzf8qxf38zg5c\RtmMvrUap.dll
2018-02-27 22:10 - 2018-02-21 23:57 - 002918744 _____ () C:\Program Files (x86)\Google\Chrome\Application\64.0.3282.186\swiftshader\libglesv2.dll
2018-02-27 22:10 - 2018-02-21 23:57 - 000138072 _____ () C:\Program Files (x86)\Google\Chrome\Application\64.0.3282.186\swiftshader\libegl.dll
2018-01-11 02:25 - 2018-01-11 02:25 - 000886032 _____ () C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe
2018-01-11 02:25 - 2018-01-11 02:25 - 002309904 _____ () C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_modeler.dll
2018-01-11 02:25 - 2018-01-11 02:25 - 000270096 _____ () C:\Program Files\Intel\SUR\QUEENCREEK\x64\pl_agent_lib.dll
2018-01-11 02:25 - 2018-01-11 02:25 - 000260368 _____ () C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_acpi_battery_input.dll
2018-01-11 02:25 - 2018-01-11 02:25 - 000306960 _____ () C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_wifi_input.dll
2018-01-11 02:25 - 2018-01-11 02:25 - 000231184 _____ () C:\Program Files\Intel\SUR\QUEENCREEK\x64\devices_use_input.dll
2018-01-11 02:25 - 2018-01-11 02:25 - 000277776 _____ () C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_system_power_state_input.dll
2018-01-11 02:25 - 2018-01-11 02:25 - 000638736 _____ () C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_os_input.dll
2018-01-11 02:25 - 2018-01-11 02:25 - 000212240 _____ () C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_winstat_input.dll
2018-01-11 02:25 - 2018-01-11 02:25 - 000453392 _____ () C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_upnp_input.dll
2018-01-11 02:25 - 2018-01-11 02:25 - 000375568 _____ () C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_process_input.dll
2018-01-11 02:25 - 2018-01-11 02:25 - 000609552 _____ () C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_hw_input.dll
2018-01-11 02:25 - 2018-01-11 02:25 - 000295184 _____ () C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_sampler_input.dll
2018-01-11 02:25 - 2018-01-11 02:25 - 000248080 _____ () C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_sgx_input.dll
2018-01-11 02:25 - 2018-01-11 02:25 - 000708368 _____ () C:\Program Files\Intel\SUR\QUEENCREEK\x64\sql_logger.dll
2018-03-20 18:01 - 2018-03-20 18:01 - 067126928 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2018-03-20 18:01 - 2018-03-20 18:01 - 000287960 _____ () C:\Program Files\AVAST Software\Avast\streamback.dll
2018-03-20 18:01 - 2018-03-20 18:01 - 000280280 _____ () C:\Program Files\AVAST Software\Avast\tasks_core.dll
2018-03-20 18:01 - 2018-03-20 18:01 - 000275160 _____ () C:\Program Files\AVAST Software\Avast\gaming_mode_ui.dll
2017-12-03 02:03 - 2018-01-10 22:05 - 000784672 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2017-12-03 02:03 - 2016-08-31 21:02 - 004969248 _____ () C:\Program Files (x86)\Steam\v8.dll
2017-12-03 02:03 - 2018-03-26 18:33 - 002631968 _____ () C:\Program Files (x86)\Steam\video.dll
2017-12-03 02:03 - 2016-08-31 21:02 - 001563936 _____ () C:\Program Files (x86)\Steam\icui18n.dll
2017-12-03 02:03 - 2016-08-31 21:02 - 001195296 _____ () C:\Program Files (x86)\Steam\icuuc.dll
2017-12-14 15:30 - 2017-12-19 21:43 - 005137696 _____ () C:\Program Files (x86)\Steam\libavcodec-57.dll
2017-12-14 15:30 - 2017-12-19 21:43 - 000695584 _____ () C:\Program Files (x86)\Steam\libavformat-57.dll
2017-12-14 15:30 - 2017-12-19 21:43 - 000351520 _____ () C:\Program Files (x86)\Steam\libavresample-3.dll
2017-12-14 15:30 - 2017-12-19 21:43 - 000847136 _____ () C:\Program Files (x86)\Steam\libavutil-55.dll
2017-12-14 15:30 - 2017-12-19 21:43 - 000783648 _____ () C:\Program Files (x86)\Steam\libswscale-4.dll
2017-12-03 02:03 - 2018-03-26 18:33 - 000977184 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2017-12-03 02:03 - 2016-07-04 18:17 - 000266560 _____ () C:\Program Files (x86)\Steam\openvr_api.dll
2017-09-27 01:22 - 2017-09-27 01:22 - 001984000 ____R () C:\Program Files (x86)\Skype\Phone\skypert.dll
2018-03-21 16:16 - 2018-01-08 18:52 - 001891832 _____ () C:\Users\jacki\AppData\Local\Discord\app-0.0.300\ffmpeg.dll
2018-03-21 16:16 - 2018-03-21 16:17 - 001780216 _____ () \\?\C:\Users\jacki\AppData\Roaming\discord\0.0.300\modules\discord_overlay2\discord_overlay2.node
2017-12-03 02:05 - 2017-09-06 22:04 - 000678400 _____ () C:\Program Files (x86)\Steam\bin\cef\cef.win7\SDL2.dll
2017-12-03 02:05 - 2017-12-13 17:16 - 071471392 _____ () C:\Program Files (x86)\Steam\bin\cef\cef.win7\libcef.dll
2017-12-03 02:03 - 2015-09-24 19:52 - 000119208 _____ () C:\Program Files (x86)\Steam\winh264.dll
2018-03-21 16:16 - 2018-01-08 18:52 - 001937912 _____ () C:\Users\jacki\AppData\Local\Discord\app-0.0.300\libglesv2.dll
2018-03-21 16:16 - 2018-01-08 18:52 - 000095736 _____ () C:\Users\jacki\AppData\Local\Discord\app-0.0.300\libegl.dll
2018-03-21 16:16 - 2018-03-21 16:16 - 002662904 _____ () \\?\C:\Users\jacki\AppData\Roaming\discord\0.0.300\modules\discord_rpc\discord_rpc.node
2018-03-21 16:17 - 2018-03-21 16:17 - 001910264 _____ () \\?\C:\Users\jacki\AppData\Roaming\discord\0.0.300\modules\discord_spellcheck\node_modules\cld\build\Release\cld.node
2018-03-21 16:17 - 2018-03-21 16:17 - 000422392 _____ () \\?\C:\Users\jacki\AppData\Roaming\discord\0.0.300\modules\discord_spellcheck\node_modules\spellchecker\build\Release\spellchecker.node
2018-03-21 16:17 - 2018-03-21 16:17 - 000145400 _____ () \\?\C:\Users\jacki\AppData\Roaming\discord\0.0.300\modules\discord_spellcheck\node_modules\keyboard-layout\build\Release\keyboard-layout-manager.node
2018-03-21 16:16 - 2018-03-21 16:17 - 009623896 _____ () \\?\C:\Users\jacki\AppData\Roaming\discord\0.0.300\modules\discord_voice\discord_voice.node
2018-03-21 16:16 - 2018-03-21 16:17 - 001508344 _____ () \\?\C:\Users\jacki\AppData\Roaming\discord\0.0.300\modules\discord_utils\discord_utils.node
2018-03-21 16:16 - 2018-03-21 16:16 - 000513016 _____ () \\?\C:\Users\jacki\AppData\Roaming\discord\0.0.300\modules\discord_erlpack\discord_erlpack.node
2018-03-21 16:16 - 2018-03-21 16:17 - 001517560 _____ () \\?\C:\Users\jacki\AppData\Roaming\discord\0.0.300\modules\discord_game_utils\discord_game_utils.node
2018-03-21 16:18 - 2018-03-21 16:18 - 002749944 _____ () \\?\C:\Users\jacki\AppData\Roaming\discord\0.0.300\modules\discord_contact_import\discord_contact_import.node

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\jacki:Heroes & Generals [38]
AlternateDataStreams: C:\Users\Public\AppData:CSM [472]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2017-03-18 17:03 - 2018-04-02 12:54 - 000000853 _____ C:\WINDOWS\system32\Drivers\etc\hosts

0.0.0.1    mssplus.mcafee.com

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1575408045-1876520637-41634806-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\Signature\Signature01.jpg
DNS Servers: 192.168.1.1 - 68.237.161.12
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: Block)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

MSCONFIG\Services: ASLDRService => 2
MSCONFIG\Services: BEService => 3
MSCONFIG\Services: cphs => 3
MSCONFIG\Services: cplspcon => 2
MSCONFIG\Services: DSAService => 2
MSCONFIG\Services: EasyAntiCheat => 3
MSCONFIG\Services: esifsvc => 2
MSCONFIG\Services: ESRV_SVC_QUEENCREEK => 2
MSCONFIG\Services: EvtEng => 2
MSCONFIG\Services: gupdate => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: HiPatchService => 2
MSCONFIG\Services: HnGSteamService => 3
MSCONFIG\Services: ibtsiva => 2
MSCONFIG\Services: igfxCUIService2.0.0.0 => 2
MSCONFIG\Services: Intel(R) Capability Licensing Service TCP IP Interface => 3
MSCONFIG\Services: Intel(R) SUR QC SAM => 3
MSCONFIG\Services: jhi_service => 2
MSCONFIG\Services: LMS => 2
MSCONFIG\Services: MyWiFiDHCPDNS => 3
MSCONFIG\Services: NvContainerLocalSystem => 2
MSCONFIG\Services: NvContainerNetworkService => 3
MSCONFIG\Services: NVDisplay.ContainerLocalSystem => 2
MSCONFIG\Services: NvTelemetryContainer => 2
MSCONFIG\Services: Origin Client Service => 3
MSCONFIG\Services: Origin Web Helper Service => 2
MSCONFIG\Services: RegSrvc => 2
MSCONFIG\Services: ReimageRealTimeProtector => 2
MSCONFIG\Services: SkypeUpdate => 2
MSCONFIG\Services: Steam Client Service => 3
MSCONFIG\Services: SystemUsageReportSvc_QUEENCREEK => 2
MSCONFIG\Services: USER_ESRV_SVC_QUEENCREEK => 3
MSCONFIG\Services: ZeroConfigService => 2
HKLM\...\StartupApproved\Run: => "SecurityHealth"
HKLM\...\StartupApproved\Run: => "Logitech Download Assistant"
HKLM\...\StartupApproved\Run32: => "DSATray"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKU\S-1-5-21-1575408045-1876520637-41634806-1001\...\StartupApproved\Run: => "BingSvc"
HKU\S-1-5-21-1575408045-1876520637-41634806-1001\...\StartupApproved\Run: => "OneDrive"
HKU\S-1-5-21-1575408045-1876520637-41634806-1001\...\StartupApproved\Run: => "EADM"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{F74CDFA8-3850-47A5-832F-8870AF2AFF1F}] => (Allow) D:\GAMES\steamapps\common\Black Desert Online\Black Desert Online Steam Launcher.exe
FirewallRules: [{7CD2D519-EF40-4AAF-A128-666EEB9308F4}] => (Allow) D:\GAMES\steamapps\common\Black Desert Online\Black Desert Online Steam Launcher.exe
FirewallRules: [{6297BC5A-3408-4C34-8EBD-FEDE2C4AE869}] => (Allow) D:\GAMES\steamapps\common\Unturned\Unturned.exe
FirewallRules: [{CDC1CBAC-BDB1-4374-9AB1-6A0CEE885AEF}] => (Allow) D:\GAMES\steamapps\common\Unturned\Unturned.exe
FirewallRules: [{BCF1C2EA-9D1C-4F26-914A-A48542A5A0AF}] => (Allow) D:\GAMES\steamapps\common\Unturned\Unturned_BE.exe
FirewallRules: [{4B721FA2-D85B-428F-A128-E1E47EF02E2D}] => (Allow) D:\GAMES\steamapps\common\Unturned\Unturned_BE.exe
FirewallRules: [{396F26CB-E8D8-4516-8044-0B13A25C9710}] => (Allow) D:\GAMES\steamapps\common\ARK\ShooterGame\Binaries\Win64\ShooterGame.exe
FirewallRules: [{62ED06A1-2B45-4500-B24C-845635CF343D}] => (Allow) D:\GAMES\steamapps\common\ARK\ShooterGame\Binaries\Win64\ShooterGame.exe
FirewallRules: [{7447E840-48F2-4EC2-8D87-726667278527}] => (Allow) D:\GAMES\steamapps\common\ARK\ShooterGame\Binaries\Win64\ShooterGame_BE.exe
FirewallRules: [{CC5A91E1-481C-4981-A1A8-EA2B5AC38D8F}] => (Allow) D:\GAMES\steamapps\common\ARK\ShooterGame\Binaries\Win64\ShooterGame_BE.exe
FirewallRules: [UDP Query User{3161AC41-77C4-4793-8F2F-D1A2FA349816}D:\games\steamapps\common\h1z1\h1z1.exe] => (Allow) D:\games\steamapps\common\h1z1\h1z1.exe
FirewallRules: [TCP Query User{911FDA60-6135-45B6-844B-77A671CD6A59}D:\games\steamapps\common\h1z1\h1z1.exe] => (Allow) D:\games\steamapps\common\h1z1\h1z1.exe
FirewallRules: [{E805ABBC-3E52-417E-A69F-765612115C50}] => (Allow) D:\GAMES\steamapps\common\H1Z1\LaunchPad.exe
FirewallRules: [{88110A10-5C01-4A76-B1AD-18B8759E50EB}] => (Allow) D:\GAMES\steamapps\common\H1Z1\LaunchPad.exe
FirewallRules: [UDP Query User{4631C61C-DE9F-45CB-A372-2C6EDD244F06}C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe] => (Allow) C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe
FirewallRules: [TCP Query User{5C6E906B-1847-4654-9E28-64373FABDFCB}C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe] => (Allow) C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe
FirewallRules: [UDP Query User{8204526B-4317-4386-A097-8E9080A264BA}C:\program files (x86)\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe] => (Allow) C:\program files (x86)\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe
FirewallRules: [TCP Query User{7E2617B3-C75F-47A6-B785-8B8DB7BFA941}C:\program files (x86)\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe] => (Allow) C:\program files (x86)\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe
FirewallRules: [UDP Query User{796FAB19-2017-4A62-ACB9-763A4EF0E814}C:\program files (x86)\epic games\launcher\portal\binaries\win32\epicgameslauncher.exe] => (Allow) C:\program files (x86)\epic games\launcher\portal\binaries\win32\epicgameslauncher.exe
FirewallRules: [TCP Query User{CF50E611-A50C-4FF3-89E7-B7C26819E3F4}C:\program files (x86)\epic games\launcher\portal\binaries\win32\epicgameslauncher.exe] => (Allow) C:\program files (x86)\epic games\launcher\portal\binaries\win32\epicgameslauncher.exe
FirewallRules: [{5FCD5099-B39F-4681-B023-1466B676D549}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{CBF5ADD9-1DA6-431F-BEAE-1E7F509BB3D0}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{7E40440F-8724-4EB9-BE0E-4E2AAE5FA369}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{79ADD25A-9680-4565-B060-69D2C6EBEA51}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{56ABDA9C-2071-472F-B884-DFA33BB8EAB4}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{DE87CC58-BA31-457C-8398-881361A89677}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{AA14C30B-5E7E-4D5F-BF7F-5CCF2DC003BB}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{3191B624-8AB7-427A-9630-900DEE662A3E}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
FirewallRules: [{6C585521-8B57-4B5A-A63D-998CE8A12BD7}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\NvContainer.exe
FirewallRules: [{840E9DF7-EEA6-435D-8A16-C5A1BB0B0220}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\NvContainer.exe
FirewallRules: [{FE11D186-7055-42BF-864C-C2A187625CF0}] => (Allow) D:\GAMES\steamapps\common\Terraria\Terraria.exe
FirewallRules: [{9029C8CA-BEA8-4EC7-B4F7-277B12D87B00}] => (Allow) D:\GAMES\steamapps\common\Terraria\Terraria.exe
FirewallRules: [TCP Query User{09AD7083-EA0E-4F6B-8581-29F2434B41DC}D:\games\steamapps\common\counter-strike global offensive\csgo.exe] => (Allow) D:\games\steamapps\common\counter-strike global offensive\csgo.exe
FirewallRules: [UDP Query User{68C1363B-184A-4112-9F09-3C710346F4CC}D:\games\steamapps\common\counter-strike global offensive\csgo.exe] => (Allow) D:\games\steamapps\common\counter-strike global offensive\csgo.exe
FirewallRules: [{BEA0A22A-56B2-4FC8-A2E8-62FE5E2701BB}] => (Allow) D:\GAMES\steamapps\common\Warframe\Warframe.exe
FirewallRules: [{78685989-A6E0-40AB-9651-733DF5B69A6A}] => (Allow) D:\GAMES\steamapps\common\Warframe\Warframe.x64.exe
FirewallRules: [{D996AB0C-8943-4980-92E5-2E37FF666D26}] => (Allow) D:\GAMES\steamapps\common\Warframe\Warframe.exe
FirewallRules: [{DE8EA570-7CA1-417B-BB9B-82294BB69851}] => (Allow) D:\GAMES\steamapps\common\Warframe\Warframe.x64.exe
FirewallRules: [{9D963EB1-B08C-459C-8EDE-CB313168224F}] => (Allow) D:\GAMES\steamapps\common\Warframe\Tools\Launcher.exe
FirewallRules: [{5955CBCE-E7F1-43CF-86F4-CB1A03AE6A6F}] => (Allow) D:\GAMES\steamapps\common\Warframe\Tools\RemoteCrashSender.exe
FirewallRules: [{98E3569F-9835-42C8-86C9-5A800EE23630}] => (Allow) D:\GAMES\steamapps\common\Warframe\Warframe.exe
FirewallRules: [{DBF33945-E60F-427C-A6F2-09AD6C463597}] => (Allow) D:\GAMES\steamapps\common\Warframe\Warframe.x64.exe
FirewallRules: [{CA919847-7723-4D7B-891D-BD00CFE46DE6}] => (Allow) D:\GAMES\steamapps\common\Warframe\Warframe.exe
FirewallRules: [{A47032C3-C15A-4BF3-A054-24118A428A94}] => (Allow) D:\GAMES\steamapps\common\Warframe\Warframe.x64.exe
FirewallRules: [{94C542B4-324B-4CF2-BBD8-5096A3BD8FC6}] => (Allow) D:\GAMES\steamapps\common\Warframe\Tools\Launcher.exe
FirewallRules: [{5B5460CA-1B76-4D3F-8E79-FEF143EA93DA}] => (Allow) D:\GAMES\steamapps\common\Warframe\Tools\RemoteCrashSender.exe
FirewallRules: [{0DE13130-551C-4E11-B6C4-A92ED75E4C6E}] => (Allow) D:\GAMES\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{423B3893-96DB-4D7F-87A4-843CB6395E3A}] => (Allow) D:\GAMES\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{22C8FB6D-6D0D-4CE7-883D-000EA72F32CB}] => (Allow) D:\GAMES\steamapps\common\Team Fortress 2\hl2.exe
FirewallRules: [{0BBBCC13-154D-48A6-ADEB-9353C8E22952}] => (Allow) D:\GAMES\steamapps\common\Team Fortress 2\hl2.exe
FirewallRules: [{7655E471-97C5-4165-A05B-D541A50C5B46}] => (Allow) D:\GAMES\steamapps\common\Rust\Rust.exe
FirewallRules: [{4063D723-5E4A-4EEE-AC42-8E858F7846A0}] => (Allow) D:\GAMES\steamapps\common\Rust\Rust.exe
FirewallRules: [TCP Query User{FD6B3CC1-0701-4E41-AA3B-26C7BAB40C7C}D:\games\steamapps\common\arma 3\arma3_x64.exe] => (Allow) D:\games\steamapps\common\arma 3\arma3_x64.exe
FirewallRules: [UDP Query User{9DA02E66-C452-4ABE-B271-03C2C253324D}D:\games\steamapps\common\arma 3\arma3_x64.exe] => (Allow) D:\games\steamapps\common\arma 3\arma3_x64.exe
FirewallRules: [{D73CD8BB-1BF1-457D-8F00-83E6AD5A613C}] => (Allow) D:\GAMES\steamapps\common\Tom Clancy's Rainbow Six Siege\RainbowSix.exe
FirewallRules: [{8FA88CC6-632A-4918-AFCF-E1095BEBF96A}] => (Allow) D:\GAMES\steamapps\common\Tom Clancy's Rainbow Six Siege\RainbowSix.exe
FirewallRules: [{F44A6883-D881-4B21-AFE9-A8881CF529F9}] => (Allow) D:\GAMES\steamapps\common\Tom Clancy's Rainbow Six Siege\RainbowSix_BE.exe
FirewallRules: [{B87A53E8-CF7D-4746-883D-39268AB5D789}] => (Allow) D:\GAMES\steamapps\common\Tom Clancy's Rainbow Six Siege\RainbowSix_BE.exe
FirewallRules: [{67926D91-69DD-4336-A30A-F870F80CD9DF}] => (Allow) D:\GAMES\steamapps\common\VRChat\VRChat.exe
FirewallRules: [{768D8A81-7560-4E52-92E9-86FD631CFDB0}] => (Allow) D:\GAMES\steamapps\common\VRChat\VRChat.exe
FirewallRules: [{D55519C6-25F3-451B-B630-0D77C383DE0B}] => (Allow) D:\GAMES\steamapps\common\Eve Online\eve.exe
FirewallRules: [{1F5E7A15-19D6-4DB8-A463-110E47645FF5}] => (Allow) D:\GAMES\steamapps\common\Eve Online\eve.exe
FirewallRules: [TCP Query User{F741B4F0-4095-4E7A-8F5B-EAC0151EB1B6}D:\games\steamapps\common\eve online\sharedcache\tq\bin\exefile.exe] => (Allow) D:\games\steamapps\common\eve online\sharedcache\tq\bin\exefile.exe
FirewallRules: [UDP Query User{601E51B4-295F-486D-8DAD-3408458F8454}D:\games\steamapps\common\eve online\sharedcache\tq\bin\exefile.exe] => (Allow) D:\games\steamapps\common\eve online\sharedcache\tq\bin\exefile.exe
FirewallRules: [{48F487D3-0BDA-45C6-A431-9D5045214E36}] => (Allow) D:\GAMES\steamapps\common\Paladins\Binaries\Win32\HirezBridge.exe
FirewallRules: [{F32D1D44-07E9-4E48-846D-D7C3D8A1664B}] => (Allow) D:\GAMES\steamapps\common\Paladins\Binaries\Win32\HirezBridge.exe
FirewallRules: [TCP Query User{835A5EBB-1B7D-4BDC-A9AA-169FA6F813BF}D:\games\steamapps\common\paladins\binaries\win32\paladins.exe] => (Allow) D:\games\steamapps\common\paladins\binaries\win32\paladins.exe
FirewallRules: [UDP Query User{AC607EC4-18C4-4DF6-AA80-101F76C0AC3A}D:\games\steamapps\common\paladins\binaries\win32\paladins.exe] => (Allow) D:\games\steamapps\common\paladins\binaries\win32\paladins.exe
FirewallRules: [TCP Query User{C6F8F8D3-9555-4913-B292-0A7CDC6D142A}D:\games\steamapps\common\warface\mycomgames\mycomgames.exe] => (Allow) D:\games\steamapps\common\warface\mycomgames\mycomgames.exe
FirewallRules: [UDP Query User{D8AF32C5-34AF-4BF2-B9B6-DDF73EF3649A}D:\games\steamapps\common\warface\mycomgames\mycomgames.exe] => (Allow) D:\games\steamapps\common\warface\mycomgames\mycomgames.exe
FirewallRules: [{B8610007-7E13-4614-AFB8-A5B91F32A1D6}] => (Allow) D:\GAMES\steamapps\common\insurgency2\insurgency_BE.exe
FirewallRules: [{7724C667-ABDD-47A5-BB6D-48CDB09F22FD}] => (Allow) D:\GAMES\steamapps\common\insurgency2\insurgency_BE.exe
FirewallRules: [TCP Query User{C74B44C8-E60B-4914-8B5D-C4203579B84C}D:\games\steamapps\common\insurgency2\insurgency.exe] => (Block) D:\games\steamapps\common\insurgency2\insurgency.exe
FirewallRules: [UDP Query User{CAC2B024-6859-46EB-AFDB-064BA6D2C8BE}D:\games\steamapps\common\insurgency2\insurgency.exe] => (Block) D:\games\steamapps\common\insurgency2\insurgency.exe
FirewallRules: [TCP Query User{5CFF7674-9829-4B28-AD02-65743799B98B}D:\games\steamapps\common\planetside 2\planetside2_x64.exe] => (Allow) D:\games\steamapps\common\planetside 2\planetside2_x64.exe
FirewallRules: [UDP Query User{86C46051-E54E-4281-9D30-27EE9D7DC7E4}D:\games\steamapps\common\planetside 2\planetside2_x64.exe] => (Allow) D:\games\steamapps\common\planetside 2\planetside2_x64.exe
FirewallRules: [TCP Query User{13DCD4D0-DBDE-4342-8262-E42E9547D494}D:\games\steamapps\common\newz\thenewz.exe] => (Allow) D:\games\steamapps\common\newz\thenewz.exe
FirewallRules: [UDP Query User{FA16FA19-DBB2-4538-A8C2-4C679C75E18F}D:\games\steamapps\common\newz\thenewz.exe] => (Allow) D:\games\steamapps\common\newz\thenewz.exe
FirewallRules: [{6D7D9CD0-80E4-4CDE-B3DD-15E0DCCE67B6}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [{EAD61ACB-02F4-485C-ADD7-492F042594FC}] => (Allow) D:\GAMES\steamapps\common\H1Z1\H1Z1_BE.exe
FirewallRules: [{E743BC18-19DD-422D-8BAE-7796998FB4D0}] => (Allow) D:\GAMES\steamapps\common\H1Z1\H1Z1_BE.exe
FirewallRules: [{2619539F-7939-496D-96C4-2E8B7DB2EC52}] => (Block) C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe
FirewallRules: [{7079BEE9-5CEB-473A-9E5A-B5133D9A8A44}] => (Block) C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe
FirewallRules: [{6A31CB6D-3E45-4447-ADF6-A99E0BC4D777}] => (Allow) C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe
FirewallRules: [{9FCED030-0986-4C0A-8E8C-557B9C5D66B4}] => (Allow) C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe
FirewallRules: [{3ECC0EB1-B3F1-413E-9D07-C54EEFCDDACE}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{607FFF83-CE16-44D9-ACC2-5EFB6401C905}] => (Allow) C:\Program Files\Easeware\DriverEasy\DriverEasy.exe
FirewallRules: [TCP Query User{15C21311-1A18-424C-AA3B-1EDDAF3C88B4}C:\program files\logitech gaming software\lcore.exe] => (Allow) C:\program files\logitech gaming software\lcore.exe
FirewallRules: [UDP Query User{3BC760C0-3104-41A2-A3BE-12503B321EAC}C:\program files\logitech gaming software\lcore.exe] => (Allow) C:\program files\logitech gaming software\lcore.exe
FirewallRules: [TCP Query User{B886EB08-6101-4AE0-88DC-7F25A135BE21}C:\program files\logitech gaming software\lcore.exe] => (Block) C:\program files\logitech gaming software\lcore.exe
FirewallRules: [UDP Query User{E6F446E8-837A-4B32-8884-8BF6CF1E4C66}C:\program files\logitech gaming software\lcore.exe] => (Block) C:\program files\logitech gaming software\lcore.exe
FirewallRules: [{4015AA48-CEAC-4B56-80D2-C72B3E0C2EA8}] => (Allow) C:\Program Files (x86)\Tencent\WeChat\WeChat.exe
FirewallRules: [TCP Query User{F2C3E910-4DA3-46CE-AB01-539F1B3CC215}D:\games\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe] => (Allow) D:\games\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe
FirewallRules: [UDP Query User{79B2654C-A605-4F68-8532-3F1C3AEDCBE7}D:\games\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe] => (Allow) D:\games\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe
FirewallRules: [{46D2DFBD-1D8A-451C-96EB-CC22581441DF}] => (Allow) D:\GAMES\steamapps\common\The Darwin Project\Darwin.exe
FirewallRules: [{76C2EBA7-CCAD-4AB6-8012-225199DF23D9}] => (Allow) D:\GAMES\steamapps\common\The Darwin Project\Darwin.exe
FirewallRules: [{9564C734-3536-4A4F-B7BF-1B3AA4B085D2}] => (Allow) D:\GAMES\steamapps\common\The Darwin Project\Darwin\Binaries\Win64\Darwin-Win64-Shipping.exe
FirewallRules: [{5CCB762C-982A-4B71-A3F8-B27A35810CB3}] => (Allow) D:\GAMES\steamapps\common\The Darwin Project\Darwin\Binaries\Win64\Darwin-Win64-Shipping.exe
FirewallRules: [{19A956CE-7364-41CA-AAA4-3CD1A30BE845}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{5ADCB236-FA90-42B2-A3AD-EC993019C99C}] => (Allow) D:\GAMES\steamapps\common\Subnautica\Subnautica.exe
FirewallRules: [{CBBC33CE-95C6-46E0-9E61-5B808DDD89D8}] => (Allow) D:\GAMES\steamapps\common\Subnautica\Subnautica.exe
FirewallRules: [TCP Query User{3FA580BB-982B-4ADA-9052-C7D53ED41C65}C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.129\deploy\leagueclient.exe] => (Allow) C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.129\deploy\leagueclient.exe
FirewallRules: [UDP Query User{ECE1F473-ADE7-4220-A2E8-3E27DCD6BD92}C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.129\deploy\leagueclient.exe] => (Allow) C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.129\deploy\leagueclient.exe
FirewallRules: [{3466A09F-FAE2-42D9-86B0-C5851C9BB71B}] => (Allow) D:\GAMES\steamapps\common\Sid Meier's Civilization V\Launcher.exe
FirewallRules: [{BFDB697A-E9CC-49A0-BF25-DDB90EADC16B}] => (Allow) D:\GAMES\steamapps\common\Sid Meier's Civilization V\Launcher.exe
FirewallRules: [{F024CABF-235A-4CFA-9841-C297AD273CDF}] => (Allow) D:\GAMES\steamapps\common\The Escapists 2\TheEscapists2.exe
FirewallRules: [{C8D21934-B0C8-47FA-A6EB-BFDC8B5EAE57}] => (Allow) D:\GAMES\steamapps\common\The Escapists 2\TheEscapists2.exe
FirewallRules: [{BBFEF0E8-9A76-4A43-AFEA-1CE148B55526}] => (Allow) D:\GAMES\steamapps\common\Realm of the Mad God\Realm of the Mad God.exe
FirewallRules: [{423BFD84-6A7A-4A03-8CA8-0464B73AAF6D}] => (Allow) D:\GAMES\steamapps\common\Realm of the Mad God\Realm of the Mad God.exe
FirewallRules: [{983F05F6-1E68-4B11-B230-C5117B7DC46D}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{E6259009-7FB3-4D28-BFDE-2B6124769684}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{4A51EC24-08C9-407D-8FAD-539033FE3059}C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.137\deploy\leagueclient.exe] => (Allow) C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.137\deploy\leagueclient.exe
FirewallRules: [UDP Query User{3B25FB91-61B8-4DC9-810F-7C1AFF5844A5}C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.137\deploy\leagueclient.exe] => (Allow) C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.137\deploy\leagueclient.exe
FirewallRules: [{816F047E-BECD-4C79-A219-F4C508EA54C5}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.75.483.0_x86__zpdnekdrzrea0\Spotify.exe
FirewallRules: [{3FFCF5DD-EC2D-4A69-9BF6-43D60D238070}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.75.483.0_x86__zpdnekdrzrea0\Spotify.exe
FirewallRules: [{046E54CD-0218-4D63-AD2C-78A20E8DF7B1}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.75.483.0_x86__zpdnekdrzrea0\Spotify.exe
FirewallRules: [{997BB6FE-713C-40D2-BA5F-B095034FE64D}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.75.483.0_x86__zpdnekdrzrea0\Spotify.exe
FirewallRules: [{06C2F3AD-D445-490A-AAF9-9FD8A653D270}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.75.483.0_x86__zpdnekdrzrea0\Spotify.exe
FirewallRules: [{40F9DB5A-7D19-4225-B11B-12FD6FEB854D}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.75.483.0_x86__zpdnekdrzrea0\Spotify.exe
FirewallRules: [{7A3D1DB3-65DE-4040-9130-DB603EDA231C}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.75.483.0_x86__zpdnekdrzrea0\Spotify.exe
FirewallRules: [{710685F1-8947-49FA-BF0C-E28AC352A847}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.75.483.0_x86__zpdnekdrzrea0\Spotify.exe
FirewallRules: [{529D9C8E-F0CD-4997-A2E0-7C15B5C0D8B5}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.75.483.0_x86__zpdnekdrzrea0\SpotifyWebHelper.exe
FirewallRules: [{BE18F852-C069-442E-8FFB-D1A390C50DB3}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.75.483.0_x86__zpdnekdrzrea0\SpotifyWebHelper.exe

==================== Restore Points =========================

28-03-2018 22:00:50 Scheduled Checkpoint

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (04/03/2018 11:11:08 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: The Open Procedure for service "BITS" in DLL "C:\Windows\System32\bitsperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

Error: (04/02/2018 01:09:44 PM) (Source: Perflib) (EventID: 1023) (User: )
Description: Windows cannot load the extensible counter DLL rdyboost. The first four bytes (DWORD) of the Data section contains the Windows error code.

Error: (04/01/2018 10:06:42 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: The Open Procedure for service "BITS" in DLL "C:\Windows\System32\bitsperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

Error: (03/31/2018 08:09:30 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: flashplayer_29_sa.exe, version: 29.0.0.113, time stamp: 0x5a90c54a
Faulting module name: flashplayer_29_sa.exe, version: 29.0.0.113, time stamp: 0x5a90c54a
Exception code: 0xc0000005
Fault offset: 0x0016b160
Faulting process id: 0x28f0
Faulting application start time: 0x01d3c9345f7224bb
Faulting application path: C:\Users\jacki\Downloads\flashplayer_29_sa.exe
Faulting module path: C:\Users\jacki\Downloads\flashplayer_29_sa.exe
Report Id: 34dc2412-4afc-4050-b91d-78af5b4280d0
Faulting package full name: 
Faulting package-relative application ID:

Error: (03/30/2018 04:45:26 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: The Open Procedure for service "BITS" in DLL "C:\Windows\System32\bitsperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

Error: (03/28/2018 09:04:45 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: The Open Procedure for service "BITS" in DLL "C:\Windows\System32\bitsperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

Error: (03/26/2018 08:04:04 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: flashplayer_29_sa.exe, version: 29.0.0.113, time stamp: 0x5a90c54a
Faulting module name: flashplayer_29_sa.exe, version: 29.0.0.113, time stamp: 0x5a90c54a
Exception code: 0xc0000005
Fault offset: 0x0016b160
Faulting process id: 0x13c0
Faulting application start time: 0x01d3c54ca786922c
Faulting application path: C:\Users\jacki\Downloads\flashplayer_29_sa.exe
Faulting module path: C:\Users\jacki\Downloads\flashplayer_29_sa.exe
Report Id: 1dd8b073-b694-4a0e-b35e-4defcee035c9
Faulting package full name: 
Faulting package-relative application ID:

Error: (03/25/2018 09:00:55 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: flashplayer_29_sa.exe, version: 29.0.0.113, time stamp: 0x5a90c54a
Faulting module name: flashplayer_29_sa.exe, version: 29.0.0.113, time stamp: 0x5a90c54a
Exception code: 0xc0000005
Fault offset: 0x0016b160
Faulting process id: 0x2d44
Faulting application start time: 0x01d3c496de4cef82
Faulting application path: C:\Users\jacki\Downloads\flashplayer_29_sa.exe
Faulting module path: C:\Users\jacki\Downloads\flashplayer_29_sa.exe
Report Id: 68fe41da-6848-475a-80ea-0dfb639bb33b
Faulting package full name: 
Faulting package-relative application ID:


System errors:
=============
Error: (04/03/2018 11:43:19 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 and APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (04/03/2018 11:37:54 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 and APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (04/03/2018 11:28:57 AM) (Source: DCOM) (EventID: 10016) (User: LAPTOP-D2FHA3JU)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 and APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 to the user LAPTOP-D2FHA3JU\jacki SID (S-1-5-21-1575408045-1876520637-41634806-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (04/03/2018 11:28:47 AM) (Source: DCOM) (EventID: 10016) (User: LAPTOP-D2FHA3JU)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 and APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 to the user LAPTOP-D2FHA3JU\jacki SID (S-1-5-21-1575408045-1876520637-41634806-1001) from address LocalHost (Using LRPC) running in the application container SpotifyAB.SpotifyMusic_1.75.483.0_x86__zpdnekdrzrea0 SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (04/03/2018 11:28:40 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 and APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (04/03/2018 11:28:19 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (04/03/2018 11:28:19 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (04/03/2018 11:28:19 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.


Windows Defender:
===================================
Date: 2018-03-11 01:09:09.113
Description: 
Windows Defender Antivirus scan has been stopped before completion.
Scan ID: {68331F23-EA3F-4843-8163-77AF0D838938}
Scan Type: Antimalware
Scan Parameters: Quick Scan

Date: 2018-02-23 00:25:58.803
Description: 
Windows Defender Antivirus scan has been stopped before completion.
Scan ID: {B4E4C29C-5EE1-4AE1-A494-CBE382BB3387}
Scan Type: Antimalware
Scan Parameters: Quick Scan

Date: 2018-02-23 00:19:39.044
Description: 
Windows Defender Antivirus scan has been stopped before completion.
Scan ID: {8024CC3B-1D00-489A-BFAC-06F769AB960F}
Scan Type: Antimalware
Scan Parameters: Quick Scan

Date: 2018-02-20 01:51:44.080
Description: 
Windows Defender Antivirus scan has been stopped before completion.
Scan ID: {12C2FCCC-7803-431F-8A93-948B69714E99}
Scan Type: Antimalware
Scan Parameters: Quick Scan

Date: 2018-02-18 21:08:49.756
Description: 
Windows Defender Antivirus scan has been stopped before completion.
Scan ID: {C5EF3436-5DD7-4CEF-AD84-45A75CDB734B}
Scan Type: Antimalware
Scan Parameters: Full Scan

Date: 2018-03-09 22:04:52.151
Description: 
Windows Defender Antivirus has encountered an error trying to update signatures.
New Signature Version: 
Previous Signature Version: 1.263.409.0
Update Source: Microsoft Update Server
Signature Type: AntiVirus
Update Type: Full
Current Engine Version: 
Previous Engine Version: 1.1.14600.4
Error code: 0x800704cf
Error description: The network location cannot be reached. For information about network troubleshooting, see Windows Help. 

Date: 2018-03-04 17:32:24.369
Description: 
Windows Defender Antivirus has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures.
Signatures Attempted: Current
Error Code: 0x80070003
Error description: The system cannot find the path specified. 
Signature version: 0.0.0.0;0.0.0.0
Engine version: 0.0.0.0

CodeIntegrity:
===================================

Date: 2018-04-03 00:57:12.969
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume3\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Microsoft signing level requirements.

Date: 2018-01-14 16:57:17.101
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\xhunter1.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-01-13 20:06:48.890
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe) attempted to load \Device\HarddiskVolume3\Program Files\NVIDIA Corporation\Ansel\Tools\NvCameraWhitelisting64.dll that did not meet the Store signing level requirements.

Date: 2018-01-10 21:28:20.443
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\xhunter1.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-01-09 19:09:30.983
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\xhunter1.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-01-08 17:50:21.572
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\xhunter1.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-01-08 16:31:24.682
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\xhunter1.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-01-08 16:19:31.411
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\xhunter1.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i7-7700HQ CPU @ 2.80GHz
Percentage of memory in use: 35%
Total physical RAM: 16265.09 MB
Available physical RAM: 10427 MB
Total Virtual: 18697.09 MB
Available Virtual: 12255.25 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:237.42 GB) (Free:144.13 GB) NTFS
Drive d: (DATA) (Fixed) (Total:931.51 GB) (Free:617.44 GB) NTFS

\\?\Volume{587e30e3-9bf7-44cc-bb03-967ec68236f6}\ (SYSTEM) (Fixed) (Total:0.25 GB) (Free:0.23 GB) FAT32
\\?\Volume{3e0ce6d8-e53f-4c02-a425-955c9c584f57}\ (RECOVERY) (Fixed) (Total:0.78 GB) (Free:0.4 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 238.5 GB) (Disk ID: A70157F5)

Partition: GPT.

========================================================
Disk: 1 (Size: 931.5 GB) (Disk ID: 7385B2E5)

Partition: GPT.

==================== End of Addition.txt ============================

Link to post
Share on other sites

Thanks for those logs, continue:

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file when running FRST fix"
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Open FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

Next,

Please download Zemana AntiMalware and save it to your Desktop.
 
  • Install the program and once the installation is complete it will start automatically.
  • Without changing any options, press Scan to begin.
  • After the short scan is finished, if threats are detected press Next to remove them.
    Note: If restart is required to finish the cleaning process, you should click Reboot. If reboot isn't required, please re-boot your computer manually.
     
  • Open Zemana AntiMalware again.
  • Click on user posted image icon and double click the latest report.
  • Now click File > Save As and choose your Desktop before pressing Save.
  • Attach saved report in your next message.


Next,

Download AdwCleaner by Malwarebytes onto your Desktop.

Or from this Mirror
 
  • Right-click on AdwCleaner.exe and select user posted imageRun as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  • Accept the EULA (I accept), then click on Scan
  • Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean button. This will kill all the active processes
  • Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
  • After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply


Next,

Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktop

Ensure to get the correct version for your system....

https://www.microsoft.com/en-gb/download/malicious-software-removal-tool-details.aspx


Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window
In the "Scan Type" window, select Quick Scan
Perform a scan and Click Finish when the scan is done.


Retrieve the MSRT log as follows, and post it in your next reply:

1) Select the Windows key and R key together to open the "Run" function
2) Type or Copy/Paste the following command to the "Run Line" and Press Enter:

notepad c:\windows\debug\mrt.log

The log will include log details for each time MSRT has run, we only need the most recent log by date and time....

Let me see those logs, also tell me if there are any remaining issues or concerns...

Thanks,

Kevin...

fixlist.txt

Link to post
Share on other sites

This is the Fixlog.txt file.

 

Fix result of Farbar Recovery Scan Tool (x64) Version: 14.03.2018
Ran by jacki (03-04-2018 16:00:05) Run:1
Running from C:\Users\jacki\Downloads
Loaded Profiles: jacki (Available Profiles: jacki)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
CloseProcesses:
CreateRestorePoint:
HKU\S-1-5-21-1575408045-1876520637-41634806-1001\...\Run: [BingSvc] => C:\Users\jacki\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2015-11-05] (© 2015 Microsoft Corporation)
C:\Users\jacki\AppData\Local\Microsoft\BingSvc
Tcpip\..\Interfaces\{7140F7FF-76EC-480E-B472-C9ED45348B43}: [NameServer] 95.211.101.196 95.211.101.197
S4 Origin Client Service; "C:\Program Files (x86)\Origin\OriginClientService.exe" [X]
S4 Origin Web Helper Service; "C:\Program Files (x86)\Origin\OriginWebHelperService.exe" [X]
S3 mracdrv; C:\WINDOWS\System32\drivers\mracdrv.sys [7238880 2018-01-19] (LLC Mail.Ru)
C:\WINDOWS\System32\drivers\mracdrv.sys
S3 cpuz140; \??\C:\Users\jacki\AppData\Local\Temp\cpuz140\cpuz140_x64.sys [X] <==== ATTENTION
S3 nvdimmn; \SystemRoot\System32\drivers\nvdimmn.sys [X]
S4 nvvad_WaveExtensible; \SystemRoot\system32\drivers\nvvad64v.sys [X]
S4 nvvhci; \SystemRoot\System32\drivers\nvvhci.sys [X]
S3 xhunter1; \??\C:\WINDOWS\xhunter1.sys [X]
2018-03-29 16:53 - 2018-03-29 16:53 - 000000000 __SHD C:\82ace7d6-0197-474d-bf4b-a2043e72329b
AlternateDataStreams: C:\Users\jacki:Heroes & Generals [38]
AlternateDataStreams: C:\Users\Public\AppData:CSM [472] 
Hosts:
EmptyTemp:
CMD: ipconfig /flushDNS
end


*****************

Processes closed successfully.
Restore point was successfully created.
"HKU\S-1-5-21-1575408045-1876520637-41634806-1001\Software\Microsoft\Windows\CurrentVersion\Run\\BingSvc" => removed successfully
C:\Users\jacki\AppData\Local\Microsoft\BingSvc => moved successfully
"HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{7140F7FF-76EC-480E-B472-C9ED45348B43}\\NameServer" => removed successfully
"HKLM\System\CurrentControlSet\Services\Origin Client Service" => removed successfully
Origin Client Service => service removed successfully
"HKLM\System\CurrentControlSet\Services\Origin Web Helper Service" => removed successfully
Origin Web Helper Service => service removed successfully
"HKLM\System\CurrentControlSet\Services\mracdrv" => removed successfully
mracdrv => service removed successfully
C:\WINDOWS\System32\drivers\mracdrv.sys => moved successfully
"HKLM\System\CurrentControlSet\Services\cpuz140" => removed successfully
cpuz140 => service removed successfully
"HKLM\System\CurrentControlSet\Services\nvdimmn" => removed successfully
nvdimmn => service removed successfully
"HKLM\System\CurrentControlSet\Services\nvvad_WaveExtensible" => removed successfully
nvvad_WaveExtensible => service removed successfully
"HKLM\System\CurrentControlSet\Services\nvvhci" => removed successfully
nvvhci => service removed successfully
"HKLM\System\CurrentControlSet\Services\xhunter1" => removed successfully
xhunter1 => service removed successfully
C:\82ace7d6-0197-474d-bf4b-a2043e72329b => moved successfully
C:\Users\jacki => ":Heroes & Generals" ADS removed successfully
C:\Users\Public\AppData => ":CSM" ADS removed successfully
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.

========= ipconfig /flushDNS =========


Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========


=========== EmptyTemp: ==========

BITS transfer queue => 7888896 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 76165266 B
Java, Flash, Steam htmlcache => 16421801 B
Windows/system/drivers => 16298325 B
Edge => 79984 B
Chrome => 392514403 B
Firefox => 18323095 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 3282 B
NetworkService => 0 B
jacki => 152140293 B

RecycleBin => 90660028 B
EmptyTemp: => 734.8 MB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 16:00:28 ====

 

Link to post
Share on other sites

This is the Zemana Antimalware scan report.

Zemana AntiMalware 2.74.2.150 (Installed)

-------------------------------------------------------
Scan Result            : Completed
Scan Date              : 2018/4/3
Operating System       : Windows 10 64-bit
Processor              : 8X Intel(R) Core(TM) i7-7700HQ CPU @ 2.80GHz
BIOS Mode              : UEFI
CUID                   : 12BFFBAE5CAAA598A3159A
Scan Type              : System Scan
Duration               : 1m 10s
Scanned Objects        : 54596
Detected Objects       : 2
Excluded Objects       : 0
Read Level             : SCSI
Auto Upload            : Enabled
Detect All Extensions  : Disabled
Scan Documents         : Disabled
Domain Info            : WORKGROUP,0,2

Detected Objects
-------------------------------------------------------

tencent
Status             : Scanned
Object             : NE->c:\program files (x86)\tencent
MD5                : -
Publisher          : -
Size               : -
Version            : -
Detection          : PUA:Win32/Tencent.D!Neng
Cleaning Action    : Quarantine
Related Objects    :
                (null) - (null)

tencent
Status             : Scanned
Object             : NE->c:\users\jacki\appdata\roaming\tencent
MD5                : -
Publisher          : -
Size               : -
Version            : -
Detection          : PUA:Win32/Tencent.C!Neng
Cleaning Action    : Quarantine
Related Objects    :
                (null) - (null)


Cleaning Result
-------------------------------------------------------
Cleaned               : 2
Reported as safe      : 0
Failed                : 0

Link to post
Share on other sites

This is the Adware Cleaner Logs

# AdwCleaner 7.0.8.0 - Logfile created on Tue Apr 03 20:15:07 2018
# Updated on 2018/08/02 by Malwarebytes 
# Running on Windows 10 Home (X64)
# Mode: clean
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services deleted.

***** [ Folders ] *****

Deleted: C:\Users\jacki\AppData\Roaming\TotalAV
Deleted: C:\Users\jacki\Documents\TotalAV


***** [ Files ] *****

No malicious files deleted.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks deleted.

***** [ Registry ] *****

Deleted: [Value] - HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules|{4015AA48-CEAC-4B56-80D2-C72B3E0C2EA8}
Deleted: [Key] - HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\services
Deleted: [Value] - HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store|C:\Program Files\Reimage\Reimage Repair\uninst.exe
Deleted: [Key] - HKCU\Software\Classes\CLSID\{d79b57ed-727c-4ab8-ba67-e7c6fd30fac1}
Deleted: [Key] - HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.totalav.passwordvaultassistant
Deleted: [Key] - HKLM\SOFTWARE\Mozilla\NativeMessagingHosts\com.totalav.passwordvaultassistant


***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries deleted.

***** [ Chromium (and derivatives) ] *****

Plugin deleted: Total AV Web Shield - 


*************************

::Tracing keys deleted
::Winsock settings cleared
::Additional Actions: 0

*************************

C:/AdwCleaner/AdwCleaner[S0].txt - [1927 B] - [2018/4/3 20:14:44]


########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt ##########

Link to post
Share on other sites

These are the MSRT logs

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.58, March 2018 (build 5.58.14622.1)
Started On Tue Apr 03 16:26:01 2018

Engine: 1.1.14600.4
Signatures: 1.263.2.0
Run Mode: Interactive Graphical Mode
Successfully Submitted Heartbeat Report
Microsoft Windows Malicious Software Removal Tool Finished On Tue Apr 03 16:26:19 2018


Return code: 0 (0x0)

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.58, March 2018 (build 5.58.14622.1)
Started On Tue Apr 03 16:26:25 2018

Engine: 1.1.14600.4
Signatures: 1.263.2.0
Run Mode: Interactive Graphical Mode

Results Summary:
----------------
No infection found.
Successfully Submitted MAPS Report
Successfully Submitted Heartbeat Report
Microsoft Windows Malicious Software Removal Tool Finished On Tue Apr 03 16:33:09 2018


Return code: 0 (0x0)
 

Link to post
Share on other sites

There is no such thing as a permanent fix. I get your system back to a normal state, after that it really depends how you use it and what you do.. If no remaining issues or concerns we can clean up:

Uninstall Zemana (unless you prefer to keep it) http://www.askvg.com/how-to-completely-uninstall-remove-a-software-program-in-windows-without-using-3rd-party-software/

Next,

Download "Delfix by Xplode" and save it to your desktop.

Or use the following if first link is down:

"Delfix link mirror"

If your security program alerts to Delfix either, accept the alert or turn your security off.

Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator

Make Sure the following items are checked:

 
  • Remove disinfection tools <----- this will remove tools we may have used.
  • Purge System Restore <--- this will remove all previous and possibly exploited restore points, a new point relative to system status at present will be created.
  • Reset system settings <--- this will reset any system settings back to default that were changed either by us during cleansing or malware/infection


Now click on "Run" and wait patiently until the tool has completed.

The tool will create a log when it has completed. We don't need you to post this.

Any remnant files/logs from tools we have used can be deleted…

Next,

Read the following links to fully understand PC Security and Best Practices, you may find them useful....

Answers to Common Security Questions and best Practices

Do I need a Registry Cleaner?

Take care and surf safe

Kevin... user posted image

 

Link to post
Share on other sites

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread.

Thanks

 

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.