Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 01-01-2017
Ran by Felipe (administrator) on FELIPE (06-01-2017 10:29:46)
Running from D:\User2016\Desktop
Loaded Profiles: Felipe (Available Profiles: Felipe)
Platform: Windows 7 Home Premium (X64) Language: Español (España, internacional)
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Safe Mode (minimal)
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-10] (Realtek Semiconductor)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES/MALWAREBYTES/ANTI-MALWARE\mbamtray.exe [2776528 2016-12-14] (Malwarebytes)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-12-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [ControlCenter4] => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [139264 2013-05-14] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [4522496 2012-12-27] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-3052470422-392353544-3589946678-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-12] (Piriform Ltd)
HKU\S-1-5-21-3052470422-392353544-3589946678-1000\...\Run: [f.lux] => C:\Users\Felipe\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2013-10-23] (Flux Software LLC)
HKU\S-1-5-21-3052470422-392353544-3589946678-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [51656320 2016-04-08] (Skype Technologies S.A.)
HKU\S-1-5-21-3052470422-392353544-3589946678-1000\...\RunOnce: [Adobe Speed Launcher] => 1483715921
HKU\S-1-5-21-3052470422-392353544-3589946678-1000\...\MountPoints2: F - F:\HiSuiteDownLoader.exe
HKU\S-1-5-21-3052470422-392353544-3589946678-1000\...\MountPoints2: {ac1b0cb2-91fa-11e6-9a82-50e5492444fa} - F:\LG_PC_Programs.exe
HKU\S-1-5-21-3052470422-392353544-3589946678-1000\...\MountPoints2: {f9f8731d-7286-11e6-b397-50e5492444fa} - F:\HiSuiteDownLoader.exe
Startup: C:\Users\Felipe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Start.lnk [2017-01-06]
ShortcutTarget: Start.lnk -> C:\Users\Felipe\AppData\Roaming\dfenqkn\lfomuvgye.exe (Microsoft Corporation)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\..\Interfaces\{92B75EA1-5721-4377-9BB8-8BE2FE93959C}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{A49E6196-757F-47AB-87CF-9D04061CDD5D}: [NameServer] 200.108.96.220,200.108.96.217

Internet Explorer:
==================
HKU\S-1-5-21-3052470422-392353544-3589946678-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://login.centamnetworks.com/
HKU\S-1-5-21-3052470422-392353544-3589946678-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://login.centamnetworks.com/
HKU\S-1-5-21-3052470422-392353544-3589946678-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/es-pe/?ocid=iehp
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation)
Toolbar: HKU\S-1-5-21-3052470422-392353544-3589946678-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2009-07-13] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2009-07-13] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2009-07-13] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2009-07-13] (Microsoft Corporation)

FireFox:
========
FF DefaultProfile: 793f1rku.default
FF ProfilePath: C:\Users\Felipe\AppData\Roaming\Mozilla\Firefox\Profiles\793f1rku.default [2017-01-06]
FF user.js: detected! => C:\Users\Felipe\AppData\Roaming\Mozilla\Firefox\Profiles\793f1rku.default\user.js [2017-01-06]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2016-10-06] (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2014-01-06] (Google, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-22] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3052470422-392353544-3589946678-1000: SkypePlugin -> C:\Users\Felipe\AppData\Local\SkypePlugin\7.17.0.44\npGatewayNpapi.dll [2016-03-31] (Skype Technologies S.A.)
FF Plugin HKU\S-1-5-21-3052470422-392353544-3589946678-1000: SkypePlugin64 -> C:\Users\Felipe\AppData\Local\SkypePlugin\7.17.0.44\npGatewayNpapi-x64.dll [2016-03-31] (Skype Technologies S.A.)

Chrome: 
=======
CHR DefaultProfile: Default
CHR StartupUrls: Default -> "hxxps://www.google.com.pe/?gws_rd=ssl"
CHR DefaultSearchURL: Default -> hxxps://auth.gfx.ms/16.000.26210.00/favicon.ico?v=2
CHR Profile: C:\Users\Felipe\AppData\Local\Google\Chrome\User Data\Default [2017-01-06]
CHR Extension: (HOTMAIL) - C:\Users\Felipe\AppData\Local\Google\Chrome\User Data\Default\Extensions\alkekcgkpcoagcmachoigbfdghlbeoon [2016-04-02]
CHR Extension: (Google Docs) - C:\Users\Felipe\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-03-15]
CHR Extension: (Google Drive) - C:\Users\Felipe\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-03-15]
CHR Extension: (YouTube) - C:\Users\Felipe\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-03-15]
CHR Extension: (Búsqueda de Google) - C:\Users\Felipe\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-03-15]
CHR Extension: (Documentos de Google sin conexión) - C:\Users\Felipe\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-15]
CHR Extension: (AdBlock) - C:\Users\Felipe\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-12-29]
CHR Extension: (Skype) - C:\Users\Felipe\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2016-12-10]
CHR Extension: (Sistema de pagos de Chrome Web Store) - C:\Users\Felipe\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-02]
CHR Extension: (Gmail) - C:\Users\Felipe\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-03-15]
CHR Extension: (Chrome Media Router) - C:\Users\Felipe\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-12-17]
CHR Extension: (Llamadas de Skype) - C:\Users\Felipe\AppData\Local\Google\Chrome\User Data\Default\Extensions\poghlonenmjdkfghdpfomojhhfggildk [2016-04-09]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
S3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [282112 2012-10-26] (Brother Industries, Ltd.) [File not signed]
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4317648 2016-12-14] (Malwarebytes)
S2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
S2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
S2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [7500048 2016-09-20] (TeamViewer GmbH)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-13] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [22680 2012-10-25] ()
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [250816 2017-01-06] (Malwarebytes)
S3 gdrv; \??\C:\Windows\gdrv.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-01-06 10:21 - 2017-01-06 10:29 - 00000000 ____D C:\FRST
2017-01-03 07:18 - 2017-01-06 10:20 - 00250816 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-01-03 07:18 - 2017-01-06 10:19 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2017-01-03 07:18 - 2017-01-03 07:18 - 00001391 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2017-01-03 07:18 - 2017-01-03 07:18 - 00001379 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2017-01-03 07:18 - 2017-01-03 07:18 - 00000656 _____ C:\Windows\Tasks\Check for updates (Spybot - Search & Destroy).job
2017-01-03 07:18 - 2017-01-03 07:18 - 00000628 _____ C:\Windows\Tasks\Refresh immunization (Spybot - Search & Destroy).job
2017-01-03 07:18 - 2017-01-03 07:18 - 00000458 _____ C:\Windows\Tasks\Scan the system (Spybot - Search & Destroy).job
2017-01-03 07:18 - 2017-01-03 07:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2017-01-03 07:18 - 2017-01-03 07:18 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2017-01-03 07:18 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2017-01-03 07:17 - 2017-01-03 07:17 - 00001867 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-01-03 07:17 - 2017-01-03 07:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-01-03 07:17 - 2017-01-03 07:17 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-01-03 07:17 - 2017-01-03 07:17 - 00000000 ____D C:\Program Files\Malwarebytes
2017-01-03 07:17 - 2017-01-03 06:10 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\Felipe\spybot-2.4.exe
2017-01-03 07:17 - 2016-12-14 12:55 - 00077416 _____ C:\Windows\system32\Drivers\mbae64.sys
2017-01-03 07:16 - 2017-01-03 06:03 - 54199488 _____ (Malwarebytes ) C:\Users\Felipe\mb3-setup-35891.35891-3.0.5.1299.exe
2017-01-03 07:15 - 2017-01-06 10:29 - 00340288 _____ C:\Windows\ntbtlog.txt
2016-12-29 12:04 - 2017-01-03 07:19 - 00000000 ____D C:\ProgramData\AVAST Software
2016-12-29 12:01 - 2016-12-29 12:02 - 00000000 __SHD C:\Config.Msi
2016-12-10 16:53 - 2016-12-10 16:53 - 00002144 _____ C:\Users\Public\Desktop\Google Earth.lnk
2016-12-10 16:53 - 2016-12-10 16:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-01-06 10:18 - 2009-07-14 00:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-01-06 10:17 - 2009-07-13 23:45 - 00018880 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-01-06 10:17 - 2009-07-13 23:45 - 00018880 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-01-06 09:50 - 2009-07-14 04:31 - 00746992 _____ C:\Windows\system32\perfh00A.dat
2017-01-06 09:50 - 2009-07-14 04:31 - 00158464 _____ C:\Windows\system32\perfc00A.dat
2017-01-06 09:50 - 2009-07-14 00:13 - 01675926 _____ C:\Windows\system32\PerfStringBackup.INI
2017-01-06 09:50 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\inf
2017-01-06 09:46 - 2016-08-03 06:39 - 00000000 ___HD C:\Users\Felipe\AppData\Roaming\dfenqkn
2017-01-03 07:32 - 2016-04-09 21:38 - 00000000 ____D C:\Users\Felipe\AppData\Roaming\Skype
2017-01-03 07:28 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\system32\NDF
2017-01-03 07:17 - 2016-03-15 11:31 - 00000000 ____D C:\Users\Felipe
2016-12-30 20:05 - 2016-08-17 04:38 - 00524288 ___SH C:\Windows\system32\config\components{a1d86b91-645a-11e6-b8e4-50e5492444fa}.TMContainer00000000000000000001.regtrans-ms
2016-12-30 20:05 - 2016-08-17 04:38 - 00065536 ___SH C:\Windows\system32\config\components{a1d86b91-645a-11e6-b8e4-50e5492444fa}.TM.blf
2016-12-30 20:05 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\system32\config
2016-12-30 20:05 - 2009-07-13 21:34 - 29360128 _____ C:\Windows\system32\config\components
2016-12-30 20:05 - 2009-07-13 21:34 - 00262144 ____H C:\Windows\system32\config\COMPONENTS.LOG1
2016-12-29 12:02 - 2016-03-15 11:35 - 00000000 __SHD C:\Windows\Installer
2016-12-29 12:01 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\system32\DriverStore
2016-12-29 12:01 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\system32\catroot
2016-12-27 06:55 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\system32\config\RegBack
2016-12-24 10:28 - 2016-03-15 13:00 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2016-12-17 20:26 - 2016-03-15 11:34 - 00000000 ____D C:\Users\Felipe\AppData\Local\Google
2016-12-17 04:00 - 2016-03-15 11:35 - 00002193 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-12-17 04:00 - 2016-03-15 11:35 - 00002181 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-12-17 03:53 - 2016-03-15 11:34 - 00003468 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2016-12-17 03:53 - 2016-03-15 11:34 - 00003340 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2016-12-14 06:13 - 2016-04-12 21:36 - 00000000 ____D C:\Users\Felipe\AppData\Roaming\vlc
2016-12-14 05:35 - 2016-03-15 13:01 - 00000971 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 11.lnk
2016-12-14 05:35 - 2016-03-15 13:01 - 00000959 _____ C:\Users\Public\Desktop\TeamViewer 11.lnk
2016-12-14 05:35 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\system32\Tasks
2016-12-13 23:00 - 2016-03-15 12:40 - 00000000 ____D C:\Users\Felipe\AppData\Roaming\Adobe
2016-12-13 05:42 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\system32\catroot2
2016-12-13 05:02 - 2016-04-09 21:38 - 00000000 ___RD C:\Program Files (x86)\Skype
2016-12-11 03:18 - 2009-07-14 00:08 - 00032630 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2016-12-10 16:52 - 2016-03-15 11:34 - 00000000 ____D C:\Program Files (x86)\Google

Files to move or delete:
====================
C:\Users\Felipe\mb3-setup-35891.35891-3.0.5.1299.exe
C:\Users\Felipe\spybot-2.4.exe


==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe
[2009-07-13 18:52] - [2011-01-15 19:01] - 0389632 ____A (Microsoft Corporation) 81257415084B84F3C0D95C381A8D4C8F

C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll
[2009-07-13 18:38] - [2011-01-15 19:01] - 1008640 ____A (Microsoft Corporation) 0B864E15A0BADFF0E7BB8B59009FDDCF

C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2016-12-27 06:55

==================== End of FRST.txt ============================