Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 15-06-2017 01
Ran by Owner (administrator) on OWNER-PC (15-06-2017 14:19:22)
Running from C:\Users\Owner\Downloads
Loaded Profiles: Owner & postgres (Available Profiles: Owner & postgres & Guest)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(ESET) C:\Program Files\ESET\ESET Smart Security\ekrn.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe
(Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Foxit Software Inc.) C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitConnectedPDFService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.2\bin\pg_ctl.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.2\bin\postgres.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.2\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.2\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.2\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.2\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.2\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.2\bin\postgres.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Malwarebytes) C:\Users\Owner\Downloads\JRT.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10918504 2016-12-13] (Realtek Semiconductor)
HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [594080 2010-07-09] (Atheros Commnucations)
HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [377504 2010-07-09] (Atheros Commnucations)
HKLM\...\Run: [fspuip] => C:\Program Files\FSP\fspuip.exe [3771392 2016-12-13] (Sentelic Corporation)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1825064 2016-12-13] (Synaptics Incorporated)
HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [163800 2016-07-30] (IvoSoft)
HKLM\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
HKLM\...\Run: [occupiers] => "C:\Program Files (x86)\Populations\nauman.exe"
HKLM\...\Run: [occupiersoccupiers] => "C:\Program Files (x86)\Karelian\nauman.exe"
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508128 2016-07-01] (Adobe Systems Incorporated)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [303928 2017-05-09] (Apple Inc.)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [3146704 2017-05-09] (Malwarebytes)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-09-22] (Oracle Corporation)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2137744 2016-10-08] (Wondershare)
HKLM-x32\...\Run: [DelaypluginInstall] => C:\ProgramData\Wondershare\Video Converter Ultimate\DelayPluginI.exe
HKLM-x32\...\Run: [laurette] => "C:\Program Files (x86)\Populations\nauman.exe"
HKLM-x32\...\Run: [laurettelaurette] => "C:\Program Files (x86)\Karelian\nauman.exe"
HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2384984 2016-12-09] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-296150329-2951745003-2715392215-1000\...\Run: [royalist] => "C:\Program Files (x86)\Populations\nauman.exe"
HKU\S-1-5-21-296150329-2951745003-2715392215-1000\...\Run: [royalistroyalist] => "C:\Program Files (x86)\Karelian\nauman.exe"
HKU\S-1-5-21-296150329-2951745003-2715392215-1000\...\Run: [silently] => "C:\Program Files (x86)\Populations\nauman.exe"
HKU\S-1-5-21-296150329-2951745003-2715392215-1000\...\Run: [silentlysilently] => "C:\Program Files (x86)\Karelian\nauman.exe"
HKU\S-1-5-21-296150329-2951745003-2715392215-1000\...\Run: [krzysztof] => "C:\Program Files (x86)\Populations\nauman.exe"
HKU\S-1-5-21-296150329-2951745003-2715392215-1000\...\Run: [Wifi HotSpot] => "C:\Program Files (x86)\WifiHotSpot\WifiHotSpot.exe" systray
HKU\S-1-5-21-296150329-2951745003-2715392215-1000\...\Run: [Spotify Web Helper] => C:\Users\Owner\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1446000 2017-04-23] (Spotify Ltd)
HKU\S-1-5-21-296150329-2951745003-2715392215-1000\...\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe
HKU\S-1-5-21-296150329-2951745003-2715392215-1000\...\Run: [iCloudPhotos] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe
HKU\S-1-5-21-296150329-2951745003-2715392215-1000\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [23819304 2017-03-21] (Google)
HKU\S-1-5-21-296150329-2951745003-2715392215-1000\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-13] (Microsoft Corporation)
HKU\S-1-5-18\...\Run: [] => [X]
ShellIconOverlayIdentifiers: [  GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google)
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-10-25] ()
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-10-25] ()
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-10-25] ()
Startup: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oshima.lnk [2017-01-04]
ShortcutTarget: oshima.lnk -> C:\Program Files (x86)\Populations\nauman.exe (No File)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyServer: [S-1-5-21-296150329-2951745003-2715392215-1000] => http=127.0.0.1:64550;https=127.0.0.1:64550
Hosts: 127.0.0.1 platform.wondershare.com
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{09FE14A8-3A72-4004-9D0A-97E239BA0B96}: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{8FB3DE79-A91F-4234-A63C-0CC8FD7FC995}: [DhcpNameServer] 8.8.8.8 8.8.4.4 8.8.8.8 8.8.4.4

Internet Explorer:
==================
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_111\bin\ssv.dll [2016-12-13] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_111\bin\jp2ssv.dll [2016-12-13] (Oracle Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2006-10-27] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\ssv.dll [2016-12-13] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\jp2ssv.dll [2016-12-13] (Oracle Corporation)
Handler: WSWSVCUchrome - No CLSID Value

FireFox:
========
FF DefaultProfile: bmtkp7b2.default
FF ProfilePath: C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\bmtkp7b2.default [2017-01-04]
FF Extension: (No Name) - C:\ProgramData\Wondershare\Video Converter Ultimate\WSVCU@Wondershare.com_xpi\ [not found]
FF Plugin: @java.com/DTPlugin,version=11.111.2 -> C:\Program Files\Java\jre1.8.0_111\bin\dtplugin\npDeployJava1.dll [2016-12-13] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.111.2 -> C:\Program Files\Java\jre1.8.0_111\bin\plugin2\npjp2.dll [2016-12-13] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.2.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2016-12-09] (Adobe Systems)
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1225195.dll [2016-09-20] (Adobe Systems, Inc.)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-12-08] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-12-08] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-12-08] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-12-08] (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.111.2 -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\dtplugin\npDeployJava1.dll [2016-12-13] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.111.2 -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\plugin2\npjp2.dll [2016-12-13] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-29] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-29] (Google Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2016-12-09] (Adobe Systems)

Chrome: 
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> hxxps://www.google.com/
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR Profile: C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default [2017-06-15]
CHR Extension: (Google Slides) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-12-13]
CHR Extension: (Video Downloader professional) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\aeeajafchghccbnppaimjhhfpejabole [2017-03-20]
CHR Extension: (Open Screenshot) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\akgpcdalpfphjmfifkmfbpdmgdmeeaeo [2017-01-03]
CHR Extension: (Google Docs) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-12-25]
CHR Extension: (Google Drive) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-12-25]
CHR Extension: (Bitmoji) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfgdeiadkckfbkeigkoncpdieiiefpig [2016-12-28]
CHR Extension: (YouTube) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-12-25]
CHR Extension: (Stella's Dress Up) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\bmgjaohkdkcimbbmlmikjklllkbjjgaf [2016-12-25]
CHR Extension: (The Avengers) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\ckfllifdbmfjehnombllbaojfdkmnpdm [2017-01-05]
CHR Extension: (Netflix) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\deceagebecbceejblnlcjooeohmmeldh [2016-12-25]
CHR Extension: (Polarr Photo Editor) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\djonnbgfieijldcieafgjcnhmpcfpmgg [2017-01-22]
CHR Extension: (Stardoll) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\dknkaepijclibocpmckgabmkoglbgmlk [2016-12-25]
CHR Extension: (Android Application) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\dmmncpgjaaloalbpijeaphmmpmdpcjkf [2016-12-25]
CHR Extension: (Billiards Games) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\ebhnmlfgcmcahgidhcdbhpnbnljplheh [2016-12-25]
CHR Extension: (Google Sheets) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-12-13]
CHR Extension: (Word Online) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\fiombgjlkfpdpkbhfioofeeinbehmajg [2016-12-25]
CHR Extension: (Screen Recorder) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\gdamcnkmddbfhaadidkhahllkabienpk [2016-12-27]
CHR Extension: (Google Docs Offline) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-12-25]
CHR Extension: (Cartoon Yourself) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghklbglohploihmahcjmklmmilmlhaeg [2016-12-25]
CHR Extension: (Pixlr Express) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\hojmjpdlmjopaeginhldhiokeidchjid [2016-12-25]
CHR Extension: (Dropbox) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\ioekoebejdcmnlefjiknokhhafglcjdl [2016-12-25]
CHR Extension: (Font Changer with Google Web Fonts™) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgjhhoglgjdklldfgoffdiaceffijeke [2016-12-25]
CHR Extension: (flowkey - Learn piano) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\jlmilmpimaepjkihnncinbaooibgelhm [2016-12-27]
CHR Extension: (Tools for Instagram™) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\khnadcdfjbjgojiilfdebbpiepokangj [2016-12-27]
CHR Extension: (Sketchpad 3.5) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\kkghjbajgkcialbbimbifdcjilhcgoim [2016-12-25]
CHR Extension: (Any Arcade Game Ad) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\knopcflkddnghobdpalpbgcecjanhgjp [2017-06-13]
CHR Extension: (Google Play) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\komhbcfkdcgmcdoenjcjheifdiabikfi [2016-12-25]
CHR Extension: (Webcam Toy) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfbgimoladefibpklnfmkpknadbklade [2016-12-25]
CHR Extension: (Solitaire) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkbhppfbabandkdmgjmifahoabeodiep [2016-12-26]
CHR Extension: (Planner 5D - Interior Design) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcafejemebbngbglfoinpoaannbihjna [2016-12-25]
CHR Extension: (Take Webpage Screenshots Entirely - FireShot) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbpblocgmgfnpjjppndjkmgjaogfceg [2017-05-24]
CHR Extension: (FotoJet) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\medejhbgmfcehgfpinhgnhlnljnpghge [2017-01-03]
CHR Extension: (Flat - Music scores and guitar tabs editor) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\mgfkpiieempkmppimblkblmlcmbdkbcg [2017-01-22]
CHR Extension: (drumbit) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\mplpmdejoamenolpcojgegminhcnmibo [2017-03-29]
CHR Extension: (TextNow) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\nkjdngkmnogclafejjgbgjjegoaahihg [2016-12-25]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-09]
CHR Extension: (Video Downloader Pro) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofcgiflmicieegobmapobiohjeokdbcd [2016-12-27]
CHR Extension: (Gmail) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-12-25]
CHR Extension: (Chrome Media Router) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-05-24]
CHR Profile: C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Guest Profile [2017-03-20]
CHR HKU\S-1-5-21-296150329-2951745003-2715392215-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [753240 2016-12-09] (Adobe Systems Incorporated)
R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2246256 2017-05-18] (Adobe Systems, Incorporated)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2017-04-03] (Apple Inc.)
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [50336 2010-07-09] (Atheros Commnucations) [File not signed]
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2836296 2017-02-14] (ESET)
R2 FoxitReaderService; C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitConnectedPDFService.exe [1659592 2016-11-15] (Foxit Software Inc.)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4470736 2017-05-09] (Malwarebytes)
R2 postgresql-x64-9.2; C:\Program Files\PostgreSQL\9.2\bin\pg_ctl.exe [89600 2013-04-01] (PostgreSQL Global Development Group) [File not signed]
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [10216688 2016-11-28] (TeamViewer GmbH)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 360WifiNAT; C:\Windows\System32\Drivers\360WiFiNAT64.sys [56320 2016-10-18] (360.cn)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [132272 2017-02-14] (ESET)
R0 edevmon; C:\Windows\System32\DRIVERS\edevmon.sys [106768 2017-02-14] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [180544 2017-02-14] (ESET)
S4 ekbdflt; C:\Windows\System32\DRIVERS\ekbdflt.sys [49672 2017-02-14] (ESET)
R1 epfw; C:\Windows\System32\DRIVERS\epfw.sys [77616 2017-02-14] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [60536 2017-02-14] (ESET)
R1 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [96856 2017-02-14] (ESET)
R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [77376 2017-05-25] ()
S3 fspad_wlh64; C:\Windows\System32\DRIVERS\fspad_wlh64.sys [54272 2016-12-13] (Sentelic Corporation) [File not signed]
R2 MBAMChameleon; C:\Windows\system32\drivers\MBAMChameleon.sys [188312 2017-06-14] (Malwarebytes)
R3 MBAMFarflt; C:\Windows\system32\drivers\farflt.sys [113592 2017-06-15] (Malwarebytes)
R3 MBAMProtection; C:\Windows\system32\drivers\mbam.sys [44960 2017-06-15] (Malwarebytes)
R0 MBAMSwissArmy; C:\Windows\System32\drivers\MBAMSwissArmy.sys [252832 2017-06-15] (Malwarebytes)
R3 MBAMWebProtection; C:\Windows\system32\drivers\mwac.sys [84256 2017-06-15] (Malwarebytes)
S3 RSUSBSTOR; C:\Windows\SysWOW64\Drivers\RtsUStor.sys [225280 2016-12-13] (Realtek Semiconductor Corp.)
S3 VMnetAdapter; system32\DRIVERS\vmnetadapter.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-06-15 14:19 - 2017-06-15 14:19 - 00023885 _____ C:\Users\Owner\Downloads\FRST.txt
2017-06-15 14:19 - 2017-06-15 14:19 - 00000000 ____D C:\FRST
2017-06-15 14:18 - 2017-06-15 14:18 - 02438656 _____ (Farbar) C:\Users\Owner\Downloads\FRST64.exe
2017-06-15 14:05 - 2017-06-15 14:05 - 00011059 _____ C:\Users\Owner\Desktop\JRT.txt
2017-06-15 13:58 - 2017-06-15 13:58 - 01663672 _____ (Malwarebytes) C:\Users\Owner\Downloads\JRT.exe
2017-06-15 00:04 - 2017-06-15 13:50 - 00000000 ____D C:\AdwCleaner
2017-06-15 00:02 - 2017-06-15 00:03 - 04110280 _____ C:\Users\Owner\Downloads\adwcleaner_6.047.exe
2017-06-14 23:53 - 2017-06-14 23:53 - 00390532 _____ C:\Users\Owner\Downloads\scanlog.txt
2017-06-14 23:36 - 2017-06-14 23:36 - 00390532 _____ C:\Users\Owner\Desktop\scanlog.txt
2017-06-14 22:53 - 2017-06-15 13:52 - 00113592 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
2017-06-14 22:53 - 2017-06-15 13:52 - 00084256 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
2017-06-14 22:53 - 2017-06-15 13:52 - 00044960 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2017-06-14 22:53 - 2017-06-14 22:53 - 00188312 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMChameleon.sys
2017-06-14 22:52 - 2017-06-14 22:52 - 00001867 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-06-14 22:52 - 2017-06-14 22:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-06-14 22:52 - 2017-06-14 22:52 - 00000000 ____D C:\Program Files\Malwarebytes
2017-06-14 22:52 - 2017-05-25 11:58 - 00077376 _____ C:\Windows\system32\Drivers\mbae64.sys
2017-06-14 22:48 - 2017-06-14 22:51 - 64232976 _____ (Malwarebytes ) C:\Users\Owner\Downloads\mb3-setup-consumer-3.1.2.1733-1.0.141-1.0.2092.exe
2017-06-14 20:40 - 2017-06-15 13:52 - 00252832 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-06-14 20:40 - 2017-06-14 22:52 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-06-14 20:40 - 2017-06-14 22:45 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2017-06-14 20:37 - 2017-06-14 22:11 - 00000000 ____D C:\Users\Owner\Desktop\mbar
2017-06-14 20:33 - 2017-06-14 20:33 - 19044562 _____ C:\Users\Owner\Desktop\mbar-1.09.3.1001.zip
2017-06-14 20:32 - 2017-06-14 20:33 - 19044562 _____ C:\Users\Owner\Downloads\mbar-1.09.3.1001.zip
2017-06-14 20:06 - 2017-06-14 20:06 - 00912452 _____ C:\Users\Owner\Downloads\rkill.zip
2017-06-14 19:41 - 2017-06-14 19:44 - 03135104 _____ (ESET) C:\Users\Owner\Downloads\eset_smart_security_live_installer_us.exe
2017-06-12 12:32 - 2017-06-15 13:59 - 00000000 ___HD C:\Users\Public\Documents\AdobeGC
2017-06-07 23:06 - 2017-06-14 22:07 - 00000000 ____D C:\Users\Owner\AppData\Local\japwfjz
2017-06-07 23:06 - 2017-06-07 23:06 - 00000000 ____D C:\Users\Owner\AppData\Roaming\c
2017-06-07 23:06 - 2017-06-07 23:06 - 00000000 ____D C:\Users\Owner\AppData\Local\mqpapot
2017-05-28 10:27 - 2017-05-28 10:27 - 00000000 ____D C:\Users\Owner\AppData\Roaming\PDAppFlex
2017-05-28 10:27 - 2017-05-28 10:27 - 00000000 ____D C:\Users\Owner\AppData\Local\Tempzxpsignf437f47c4d3a54c1
2017-05-28 10:27 - 2017-05-28 10:27 - 00000000 ____D C:\Users\Owner\AppData\Local\Tempzxpsign668d30809aad8108
2017-05-27 14:15 - 2017-05-27 14:15 - 00001753 _____ C:\Users\Public\Desktop\iTunes.lnk
2017-05-27 14:15 - 2017-05-27 14:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2017-05-27 14:14 - 2017-05-27 14:15 - 00000000 ____D C:\Program Files\iTunes
2017-05-27 14:14 - 2017-05-27 14:14 - 00000000 ____D C:\Program Files\iPod
2017-05-27 13:40 - 2017-06-15 13:54 - 00004342 _____ C:\Windows\System32\Tasks\SmartAppLiveUpdater
2017-05-27 13:40 - 2017-06-15 13:53 - 00003298 _____ C:\Windows\System32\Tasks\SmartAppMonitor
2017-05-27 13:38 - 2017-05-28 10:22 - 00000000 ____D C:\Users\Owner\AppData\Local\Verto Analytics
2017-05-27 13:38 - 2017-05-27 13:38 - 00000000 ____D C:\Program Files (x86)\SmartApp
2017-05-24 14:24 - 2017-05-24 14:24 - 00001034 _____ C:\Users\Public\Desktop\Wondershare Filmora.lnk
2017-05-24 14:24 - 2017-05-24 14:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare
2017-05-24 14:22 - 2017-05-24 14:22 - 00000000 ____D C:\Program Files\Wondershare
2017-05-24 14:22 - 2017-03-17 11:43 - 01250304 _____ (CineForm Inc.) C:\Windows\system32\CFDecode64.ax
2017-05-24 13:24 - 2017-05-24 13:24 - 00378328 _____ C:\Users\Owner\Downloads\20170522_050644_9268_992159.jpeg
2017-05-24 13:10 - 2017-05-24 13:10 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Google
2017-05-17 11:32 - 2017-05-17 11:32 - 00125952 _____ C:\Users\Owner\AppData\Local\report

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-06-15 14:00 - 2009-07-13 23:45 - 00022512 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-06-15 14:00 - 2009-07-13 23:45 - 00022512 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-06-15 13:59 - 2009-07-14 00:13 - 00006166 _____ C:\Windows\system32\PerfStringBackup.INI
2017-06-15 13:55 - 2017-04-29 17:43 - 00000000 ___RD C:\Users\Owner\Google Drive
2017-06-15 13:53 - 2017-01-04 23:47 - 00000035 _____ C:\Users\Public\Documents\AtherosServiceConfig.ini
2017-06-15 13:53 - 2016-12-13 17:13 - 00000000 ____D C:\Users\Owner\AppData\Local\Adobe
2017-06-15 13:52 - 2017-01-02 18:24 - 00000000 ____D C:\Users\postgres
2017-06-15 13:52 - 2009-07-14 00:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-06-15 00:05 - 2016-12-13 18:46 - 00000000 ____D C:\Users\Owner\AppData\Local\ClassicShell
2017-06-14 23:06 - 2016-12-13 18:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-06-14 22:24 - 2017-03-08 10:35 - 00000000 ____D C:\Program Files (x86)\360AP
2017-06-14 22:11 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\Help
2017-06-14 19:45 - 2016-12-13 17:14 - 00803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-06-14 19:45 - 2016-12-13 17:14 - 00144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-06-14 19:45 - 2016-12-13 17:14 - 00004312 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2017-06-14 19:45 - 2016-12-13 17:14 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2017-06-14 19:45 - 2016-12-13 17:14 - 00000000 ____D C:\Windows\system32\Macromed
2017-06-14 19:37 - 2017-04-29 11:44 - 00000000 ____D C:\ProgramData\TechSmith
2017-06-14 19:37 - 2017-03-08 13:40 - 00000000 ____D C:\ProgramData\Package Cache
2017-06-12 22:21 - 2017-01-22 22:14 - 00000000 ____D C:\Users\Owner\Downloads\FireShot
2017-06-10 15:59 - 2017-02-01 23:12 - 00000000 ____D C:\Users\Guest\AppData\Local\Google
2017-06-05 14:13 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\system32\NDF
2017-05-25 03:04 - 2017-04-29 11:24 - 00000000 ____D C:\Windows\system32\MRT
2017-05-25 03:00 - 2017-04-29 11:24 - 132223576 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-05-24 23:06 - 2017-01-02 19:36 - 00001422 _____ C:\Users\Owner\.youtube-upload-credentials.json
2017-05-24 14:22 - 2017-01-02 18:35 - 00000000 ____D C:\Users\Public\Documents\Wondershare
2017-05-24 13:29 - 2009-07-13 23:45 - 00422256 _____ C:\Windows\system32\FNTCACHE.DAT
2017-05-24 13:28 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\PolicyDefinitions

==================== Files in the root of some directories =======

2016-12-25 09:09 - 2016-12-25 09:09 - 0018526 _____ () C:\Users\Owner\AppData\Roaming\UserTile.png
2017-05-17 11:32 - 2017-05-17 11:32 - 0125952 _____ () C:\Users\Owner\AppData\Local\report
2016-12-02 22:29 - 2016-12-02 22:29 - 0007602 _____ () C:\Users\Owner\AppData\Local\Resmon.ResmonCfg

Some files in TEMP:
====================
2017-02-05 01:03 - 2017-01-19 09:31 - 1342792 _____ (Andy OS, inc.) C:\Users\Owner\AppData\Local\Temp\RemoveTemp.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-01-03 02:35

==================== End of FRST.txt ============================