i downloaded Homeworld.Remastered.Collection.2015.SteamRip.LP and now when i run setup it says Runtime error Out of string range.
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:04-03-2016
Ran by ACM (administrator) on ACM-PC (09-03-2016 11:50:19)
Running from C:\Users\ACM\Downloads
Loaded Profiles: ACM (Available Profiles: ACM)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
() C:\ProgramData\Bamcof\Bamcof.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
() C:\Program Files (x86)\Comodo\IceDragon\icedragon_updater.exe
(RayDl) C:\Program Files (x86)\RayDld\ihpmServer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
() C:\Windows\Installer\{9341DEB5-87B8-4DE4-2753-9CAE073A9F2A}\syshost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(BitTorrent Inc.) C:\Users\ACM\AppData\Roaming\uTorrent\uTorrent.exe
(BitTorrent Inc.) C:\Users\ACM\AppData\Roaming\uTorrent\updates\3.4.5_41865\utorrentie.exe
(BitTorrent Inc.) C:\Users\ACM\AppData\Roaming\uTorrent\updates\3.4.5_41865\utorrentie.exe
() C:\Program Files (x86)\Beat Blades Haruka\OpenSaveFolder.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dinotify.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2787264 2016-01-12] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => "C:\Windows\system32\rundll32.exe" C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [regedit.exe] => C:\Users\ACM\AppData\Roaming\alFSVWJB\regedit.exe [227840 2010-11-21] ()
HKLM\...\RunOnce: [Hard Disk Sync Tool] => C:\ProgramData\Hard Disk Sync Tool\gim19qqwuw.exe [457216 2016-01-18] ()
HKLM\...\Policies\Explorer\Run: [1035228220] => C:\ProgramData\msccttum.exe [183808 2010-11-21] (Mail.Ru)
HKLM\...\Policies\Explorer\Run: [514270637] => C:\ProgramData\msemk.exe [183808 2010-11-21] (Mail.Ru)
HKLM\...\Policies\Explorer\Run: [1286042896] => C:\ProgramData\msrlygqf.exe [171520 2010-11-21] (PortableApps.com)
HKLM\...\Policies\Explorer\Run: [1220024322] => C:\ProgramData\msufsco.exe [171520 2010-11-21] (PortableApps.com)
HKLM\...\Policies\Explorer\Run: [1409098418] => C:\ProgramData\msdhqy.exe [171520 2010-11-21] (PortableApps.com)
HKLM\...\Policies\Explorer\Run: [502870409] => C:\ProgramData\mshixbtiv.exe [171520 2010-11-21] (PortableApps.com)
HKLM\...\Policies\Explorer\Run: [1647974265] => C:\ProgramData\mshbwrif.exe [229376 2010-11-21] (Nullsoft, Inc.)
HKLM\...\Policies\Explorer\Run: [1433235010] => C:\ProgramData\mslstxiru.exe [229376 2010-11-21] (Nullsoft, Inc.)
HKLM\...\Policies\Explorer\Run: [1897442575] => C:\ProgramData\msrucaz.exe [229376 2010-11-21] (Nullsoft, Inc.)
HKLM\...\Policies\Explorer\Run: [1141413839] => C:\ProgramData\msrifcj.exe [176640 2010-11-21] ()
HKLM\...\Policies\Explorer\Run: [50466237] => C:\ProgramData\msnjnyoej.exe [210432 2010-11-21] ()
HKLM\...\Policies\Explorer\Run: [1983861589] => C:\ProgramData\msldiao.exe [176640 2010-11-21] ()
HKLM\...\Policies\Explorer\Run: [780086614] => C:\ProgramData\msbninrx.exe [176640 2010-11-21] ()
HKLM\...\Policies\Explorer\Run: [1750604790] => C:\ProgramData\msuiqzes.exe [181760 2010-11-21] ()
HKLM\...\Policies\Explorer\Run: [748347182] => C:\ProgramData\msqrsz.exe [181760 2010-11-21] ()
HKLM\...\Policies\Explorer\Run: [1729214437] => C:\ProgramData\msairkcp.exe [181760 2010-11-21] ()
HKLM\...\Policies\Explorer\Run: [1814576463] => C:\ProgramData\msuep.exe [237056 2010-11-21] ()
HKLM\...\Policies\Explorer\Run: [2015853321] => C:\ProgramData\mspqjo.exe [267264 2010-11-21] (Sun Microsystems, Inc.)
HKLM\...\Policies\Explorer\Run: [284759384] => C:\ProgramData\mswkaldj.exe [210944 2010-11-21] ()
HKLM\...\Policies\Explorer\Run: [474131080] => C:\ProgramData\mscooif.exe [181248 2010-11-21] ()
HKLM\...\Policies\Explorer\Run: [1298204763] => C:\ProgramData\mseuoiopr.exe [267264 2010-11-21] (Sun Microsystems, Inc.)
HKLM\...\Policies\Explorer\Run: [480798240] => C:\ProgramData\msoud.exe [203264 2016-01-18] ()
HKLM\...\Policies\Explorer\Run: [1773501550] => C:\ProgramData\mssas.exe [264704 2010-11-21] (Vortex Team)
HKLM\...\Policies\Explorer\Run: [1256100755] => C:\ProgramData\msflew.exe [264704 2010-11-21] (Vortex Team)
HKLM\...\Policies\Explorer\Run: [1275627814] => C:\ProgramData\mstmc.exe [203264 2016-01-18] ()
HKLM\...\Policies\Explorer\Run: [756021217] => C:\ProgramData\msvimlzq.exe [203264 2016-01-18] ()
HKLM\...\Policies\Explorer\Run: [933970431] => C:\ProgramData\msaganf.exe [264704 2010-11-21] (Vortex Team)
HKLM\...\Policies\Explorer\Run: [1461924631] => C:\ProgramData\msakmnkbs.exe [203264 2016-01-18] ()
HKLM\...\Policies\Explorer\Run: [1300631362] => C:\ProgramData\msaghnufc.exe [181248 2010-11-21] (toyworld)
HKLM\...\Policies\Explorer\Run: [1049206930] => C:\ProgramData\msswzht.exe [181248 2010-11-21] (toyworld)
HKLM\...\Policies\Explorer\Run: [325572943] => C:\ProgramData\mslgpfkph.exe [181248 2010-11-21] (toyworld)
HKLM\...\Policies\Explorer\Run: [1643409771] => C:\ProgramData\msvvse.exe [120832 2016-02-13] (Newzie)
HKLM\...\Policies\Explorer\Run: [71816879] => C:\ProgramData\msczqdlj.exe [203264 2016-01-18] ()
HKLM\...\Policies\Explorer\Run: [2055314185] => C:\ProgramData\mstpsvjv.exe [182272 2010-11-21] (toyworld)
HKLM\...\Policies\Explorer\Run: [1903671284] => C:\ProgramData\mspqgbd.exe [176128 2010-11-21] ()
HKLM\...\Policies\Explorer\Run: [976243056] => C:\ProgramData\mseefx.exe [267264 2010-11-21] (Sun Microsystems, Inc.)
HKLM\...\Policies\Explorer\Run: [1645215113] => C:\ProgramData\msgiuzrbd.exe [117248 2010-11-21] (The Wireshark developer community, hxxp://www.wireshark.org/)
HKLM\...\Policies\Explorer\Run: [361228002] => C:\ProgramData\msboxg.exe [134144 2016-01-20] (Thomas Schweitzer)
HKLM\...\Policies\Explorer\Run: [2114625105] => C:\ProgramData\msrhuiuu.exe [195072 2010-11-21] ()
HKLM\...\Policies\Explorer\Run: [977298269] => C:\ProgramData\msvgoy.exe [267264 2010-11-21] (Sun Microsystems, Inc.)
HKLM\...\Policies\Explorer\Run: [1120267585] => C:\ProgramData\msrpss.exe [210944 2010-11-21] ()
HKLM\...\Policies\Explorer\Run: [945939712] => C:\ProgramData\msikguvy.exe [184832 2010-11-21] (maymun)
HKLM\...\Policies\Explorer\Run: [505935564] => C:\ProgramData\msbjvfz.exe [181248 2010-11-21] (toyworld)
HKLM\...\Policies\Explorer\Run: [1586513979] => C:\ProgramData\msfzsknrj.exe [114688 2010-11-21] ()
HKLM\...\Policies\Explorer\Run: [537140894] => C:\ProgramData\msjkvdc.exe [210944 2010-11-21] ()
HKLM\...\Policies\Explorer\Run: [2016105411] => C:\ProgramData\msjxmqvoj.exe [264704 2010-11-21] (Vortex Team)
HKLM\...\Policies\Explorer\Run: [1056185179] => C:\ProgramData\msxnkvlkk.exe [264704 2010-11-21] (Vortex Team)
HKLM\...\Policies\Explorer\Run: [1817036189] => C:\ProgramData\msqkfg.exe [134144 2010-11-21] (Thomas Schweitzer)
HKLM\...\Policies\Explorer\Run: [65846339] => C:\ProgramData\msuprysxc.exe [235520 2016-01-21] ()
HKLM\...\Policies\Explorer\Run: [282199271] => C:\ProgramData\msrzu.exe [264704 2010-11-21] (Vortex Team)
HKLM\...\Policies\Explorer: [NoAutorun] 1
HKLM\...\Policies\Explorer: [TaskbarNoNotification] 1
HKLM\...\Policies\Explorer: [HideSCAHealth] 1
HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore: [DisableSR/DisableConfig] <===== ATTENTION
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [uTorrent] => C:\Users\ACM\AppData\Roaming\uTorrent\uTorrent.exe [2094080 2016-03-03] (BitTorrent Inc.)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [Hard Disk Sync Tool] => C:\ProgramData\Hard Disk Sync Tool\gim19qqwuw.exe [457216 2016-01-18] ()
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [senewsys32] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-186345671\senewsys32.exe [249856 2016-03-05] (Sun Microsystems, Inc.)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [senzwbsys32] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-1363345871\senewzbys32.exe [250880 2016-03-05] (Sun Microsystems, Inc.)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [syszwbsys32] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-13633145871\sysewzbys32.exe [250880 2016-03-05] (Sun Microsystems, Inc.)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [sysazwbsays32] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-13633451\sysaewazbys32.exe [251904 2016-03-05] (Sun Microsystems, Inc.)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [sysazwb6says32] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-136633451\sysae6w6azbys32.exe [250880 2016-03-05] (Sun Microsystems, Inc.)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [sysanitesys132] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-1332612551\sysanitesys132.exe
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [sysanitesys2132] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-1232612551\sysanitesy2132.exe [181248 2016-03-06] ()
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [sysanitesays2132s] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-123268151\sysaniteasy2132s.exe [180224 2016-03-06] ()
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [sysanf132s] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-12326151\sysanifsy2132s.exe [178688 2016-03-06] ()
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [syee132s] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-123261541\seifsy2132s.exe [251904 2016-03-05] (Sun Microsystems, Inc.)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [sye1iaarrs] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-122403216261\seia1ar32.exe [159232 2016-03-04] ()
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [syeik3122s] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-123263113541\seifs12ik32.exe [178688 2016-03-06] ()
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [syeiaz822s] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-1220326261\seiafs1z432.exe [250880 2016-03-05] (Sun Microsystems, Inc.)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [syeiarrs] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-12240326261\seiar32.exe [181760 2016-03-06] ()
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [sye1i3aarrs] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-13403216261\seia1a3r32.exe [211968 2016-02-28] (PortableApps.com)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [syee1r32s] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-1232631541\seifsy2r132s.exe
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [sye1vi3aaarrs] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-13403216261\seiva1a3ar32.exe [180736 2016-03-06] ()
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [sy192i3aaarrs] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-134019216261\se1923ar32.exe [250368 2016-03-05] (Sun Microsystems, Inc.)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [sy192i33s] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-134019361\se1933332.exe [180224 2016-03-06] ()
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3014224 2016-02-05] (Valve Corporation)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\RunOnce: [sy192i33s] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-134019361\se1933332.exe [180224 2016-03-06] ()
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\RunOnce: [sysazwbsays32] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-13633451\sysaewazbys32.exe [251904 2016-03-05] (Sun Microsystems, Inc.)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\RunOnce: [syeik3122s] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-123263113541\seifs12ik32.exe [178688 2016-03-06] ()
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\RunOnce: [senewsys32] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-186345671\senewsys32.exe [249856 2016-03-05] (Sun Microsystems, Inc.)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\RunOnce: [sye1i3aarrs] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-13403216261\seia1a3r32.exe [211968 2016-02-28] (PortableApps.com)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\RunOnce: [syszwbsys32] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-13633145871\sysewzbys32.exe [250880 2016-03-05] (Sun Microsystems, Inc.)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\RunOnce: [syee132s] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-123261541\seifsy2132s.exe [251904 2016-03-05] (Sun Microsystems, Inc.)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\RunOnce: [syeiarrs] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-12240326261\seiar32.exe [181760 2016-03-06] ()
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\RunOnce: [senzwbsys32] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-1363345871\senewzbys32.exe [250880 2016-03-05] (Sun Microsystems, Inc.)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\RunOnce: [sy192i3aaarrs] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-134019216261\se1923ar32.exe [250368 2016-03-05] (Sun Microsystems, Inc.)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\RunOnce: [sysazwb6says32] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-136633451\sysae6w6azbys32.exe [250880 2016-03-05] (Sun Microsystems, Inc.)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\RunOnce: [sye1iaarrs] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-122403216261\seia1ar32.exe [159232 2016-03-04] ()
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\RunOnce: [sye1vi3aaarrs] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-13403216261\seiva1a3ar32.exe [180736 2016-03-06] ()
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\RunOnce: [sysanitesays2132s] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-123268151\sysaniteasy2132s.exe [180224 2016-03-06] ()
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\RunOnce: [syeiaz822s] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-1220326261\seiafs1z432.exe [250880 2016-03-05] (Sun Microsystems, Inc.)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\RunOnce: [sysanf132s] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-12326151\sysanifsy2132s.exe [178688 2016-03-06] ()
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\RunOnce: [sysanitesys2132] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-1232612551\sysanitesy2132.exe [181248 2016-03-06] ()
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\CurrentVersion\Windows: [Load] C:\PROGRA~3\msrzu.exe <===== ATTENTION
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Policies\Explorer: [TaskbarNoNotification] 1
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Policies\Explorer: [HideSCAHealth] 1
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\MountPoints2: J - J:\setup.exe
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\MountPoints2: K - K:\BLEEDUST.EXE
AppInit_DLLs: C:\ProgramData\Bamcof\Villa-Tough.dll => C:\ProgramData\Bamcof\Villa-Tough.dll [805376 2015-12-24] ()
AppInit_DLLs-x32: C:\ProgramData\Bamcof\TopFintop.dll => C:\ProgramData\Bamcof\TopFintop.dll [257536 2015-12-24] ()
IFEO\mbam.exe: [Debugger] tmgpcd.exe
IFEO\mbamgui.exe: [Debugger] bhijbz.exe
IFEO\MRT.exe: [Debugger] wwkhvtpjdmz.exe
IFEO\Mrtstub.exe: [Debugger] qiagxafwdpc.exe
IFEO\rstrui.exe: [Debugger] ddkkocrci.exe
IFEO\winmgr108.exe: [Debugger] hcrjfdhlu.exe
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Hosts: 127.0.0.1 eame2blaze01.ea.com
Tcpip\Parameters: [DhcpNameServer] 202.53.8.8 123.176.37.66
Tcpip\..\Interfaces\{357B11DB-D51E-4481-9D7E-CA0B0FB782C7}: [DhcpNameServer] 202.53.8.8 123.176.37.66
Tcpip\..\Interfaces\{846ee342-7039-11de-9d20-806e6f6e6963}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{B6A3E41E-6E5D-4207-9A0B-9014D8BECE73}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{B6A3E41E-6E5D-4207-9A0B-9014D8BECE73}: [DhcpNameServer] 192.168.42.129
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.hao123.com/?tn=94493384_hao_pg
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyuWHlXdoVJWoFEHN5kiym7a7T7yT3A23zXqPLfWiy_kCkicJ67taPfzk7HaM5nkW0kgS8U35RRQOj9ILdnomltDtkD2U8rZWu0lDgSIEPzvJ9jTjAdm-a0tjDSgtmafyDZCrKLqme8RICbi1w,,&q={searchTerms}
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://%66%65%65%64.%73%6E%61%70%64%6F.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyuWHlXdoVJWoFEHN5kiym7a7T7yT3A23zXqPLfWiy_kCkicJ67taPfzk7HaM5nkW0kgS8U35RRQOj9IITsP3a5kZw2wacVGOgGLA6OOfXFnkcOcq8ruB0yE_UoAco3-9LMWQU2zR0aVbrfSQQ,,
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyuWHlXdoVJWoFEHN5kiym7a7T7yT3A23zXqPLfWiy_kCkicJ67taPfzk7HaM5nkW0kgS8U35RRQOj9ILdnomltDtkD2U8rZWu0lDgSIEPzvJ9jTjAdm-a0tjDSgtmafyDZCrKLqme8RICbi1w,,&q={searchTerms}
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\Software\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyuWHlXdoVJWoFEHN5kiym7a7T7yT3A23zXqPLfWiy_kCkicJ67taPfzk7HaM5nkW0kgS8U35RRQOj9ILdnomltDtkD2U8rZWu0lDgSIEPzvJ9jTjAdm-a0tjDSgtmafyDZCrKLqme8RICbi1w,,&q={searchTerms}
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://%66%65%65%64.%73%6E%61%70%64%6F.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyuWHlXdoVJWoFEHN5kiym7a7T7yT3A23zXqPLfWiy_kCkicJ67taPfzk7HaM5nkW0kgS8U35RRQOj9IITsP3a5kZw2wacVGOgGLA6OOfXFnkcOcq8ruB0yE_UoAco3-9LMWQU2zR0aVbrfSQQ,,
SearchScopes: HKLM -> DefaultScope {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL =
SearchScopes: HKLM-x32 -> DefaultScope {ielnksrch} URL =
SearchScopes: HKLM-x32 -> ielnksrch URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyuWHlXdoVJWoFEHN5kiym7a7T7yT3A23zXqPLfWiy_kCkicJ67taPfzk7HaM5nkW0kgS8U35RRQOj9ILdnomltDtkD2U8rZWu0lDgSIEPzvJ9jTjAdm-a0tjDSgtmafyDZCrKLqme8RICbi1w,,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2659893166-2311542600-2123722465-1000 -> DefaultScope {ielnksrch} URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyuWHlXdoVJWoFEHN5kiym7a7T7yT3A23zXqPLfWiy_kCkicJ67taPfzk7HaM5nkW0kgS8U35RRQOj9ILdnomltDtkD2U8rZWu0lDgSIEPzvJ9jTjAdm-a0tjDSgtmafyDZCrKLqme8RICbi1w,,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2659893166-2311542600-2123722465-1000 -> {4EB53E0D-D019-4D88-8D50-B779D7012DFD} URL = hxxps://in.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=715483&p={searchTerms}
SearchScopes: HKU\S-1-5-21-2659893166-2311542600-2123722465-1000 -> {ielnksrch} URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyuWHlXdoVJWoFEHN5kiym7a7T7yT3A23zXqPLfWiy_kCkicJ67taPfzk7HaM5nkW0kgS8U35RRQOj9ILdnomltDtkD2U8rZWu0lDgSIEPzvJ9jTjAdm-a0tjDSgtmafyDZCrKLqme8RICbi1w,,&q={searchTerms}
BHO-x32: ﾓｦﾓﾃｱｦﾒｻｼ・ｲﾗｰｲ蠑 -> {50F4150A-48B2-417A-BE4C-C83F580FB904} -> C:\Program Files (x86)\Common Files\Tencent\QQPhoneManager\2.0.201.3198\npQQPhoneManagerExt.dll [2014-05-30] (腾讯公司)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2006-10-27] (Microsoft Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\ssv.dll [2015-12-18] (Oracle Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\jp2ssv.dll [2015-12-18] (Oracle Corporation)
Toolbar: HKU\S-1-5-21-2659893166-2311542600-2123722465-1000 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-21] (Microsoft Corporation)
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_257.dll [2015-07-29] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll [2013-09-13] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_257.dll [2015-07-29] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll [2013-12-05] (Adobe Systems, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\dtplugin\npDeployJava1.dll [2015-12-18] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\plugin2\npjp2.dll [2015-12-18] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll [2013-09-13] ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-12-16] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-12-16] (NVIDIA Corporation)
FF Plugin-x32: @qq.com/npAndroidAssistant -> C:\Program Files (x86)\Common Files\Tencent\QQPhoneManager\2.0.201.3198\npQQPhoneManagerExt.dll [2014-05-30] (腾讯公司)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-01-31] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-01-31] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2013-12-21] (Adobe Systems Inc.)
Chrome:
=======
CHR HomePage: Default -> hxxps://www.google.com/
CHR RestoreOnStartup: Default -> "hxxp://searchinterneat-a.akamaihd.net/h?eq=U0EeCFZVBB8SRggXcFwJVglFEhgXeF8PTA1HFQQOIgwNWBRBQ1dAJVgLVltCRwYFIk0FA1oDB0VXfV5bFElXTwhwJVxqBEoETUFQCExa"
CHR StartupUrls: Default -> "hxxps://www.google.com/"
CHR Profile: C:\Users\ACM\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\ACM\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-25]
CHR Extension: (Google Search) - C:\Users\ACM\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-28]
CHR Extension: (FBDown Video Downloader) - C:\Users\ACM\AppData\Local\Google\Chrome\User Data\Default\Extensions\fhplmmllnpjjlncfjpbbpjadoeijkogc [2016-02-07]
CHR Extension: (AdBlock) - C:\Users\ACM\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-02-19]
CHR Extension: (Drumpfinator) - C:\Users\ACM\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcimhbfpiofdihhdnofbdlhjcmjopilp [2016-03-03]
CHR Extension: (Google Dictionary (by Google)) - C:\Users\ACM\AppData\Local\Google\Chrome\User Data\Default\Extensions\mgijmajocgfcbeboacabfgobmjgjcoja [2016-02-25]
CHR Extension: (Chrome Web Store Payments) - C:\Users\ACM\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-31]
CHR Extension: (Gmail) - C:\Users\ACM\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-08-23]
CHR Extension: (Polaris) - C:\Users\ACM\AppData\Local\Polaris\Component [2015-11-29]
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
"741b0108ce7bd861" => service could not be unlocked. <===== ATTENTION
R2 Bamcof; C:\ProgramData\\Bamcof\\Bamcof.exe [466944 2015-11-29] () [File not signed]
S3 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [437880 2015-10-08] (BlueStack Systems, Inc.)
R2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [417400 2015-10-08] (BlueStack Systems, Inc.)
R2 BstHdUpdaterSvc; C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe [855672 2015-10-08] (BlueStack Systems, Inc.)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1163200 2016-01-12] (NVIDIA Corporation)
R2 IceDragonUpdater; C:\Program Files (x86)\Comodo\IceDragon\icedragon_updater.exe [1971888 2015-12-02] ()
R2 ihpmServer; C:\Program Files (x86)\RayDld\ihpmServer.exe [264944 2016-02-03] (RayDl)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1879488 2016-01-12] (NVIDIA Corporation)
R3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [6308288 2016-01-12] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [4812736 2016-01-12] (NVIDIA Corporation)
S3 scan; C:\Program Files (x86)\ParetoLogic\RegCure Pro\scan.dll [602456 2016-01-20] (Bitdefender)
S2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [1042304 2016-03-06] (Enigma Software Group USA, LLC.)
R2 syshost32; C:\Windows\Installer\{9341DEB5-87B8-4DE4-2753-9CAE073A9F2A}\syshost.exe [164352 2016-01-18] () [File not signed]
U4 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [536346624 2016-02-14] () [File not signed]
S2 QQPCRTP; "C:\Program Files (x86)\Tencent\QQPCMgr\10.10.16444.223\QQPCRtp.exe" -r [X]
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
U5 741b0108ce7bd861; C:\Windows\System32\Drivers\741b0108ce7bd861.sys [94144 2016-01-18] () <===== ATTENTION Necurs Rootkit?
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [312480 2016-02-02] ()
R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [146040 2015-10-08] (BlueStack Systems)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-11] (Broadcom Corporation)
S3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [15920 2016-03-06] (Enigma Software Group USA, LLC.)
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2016-03-06] ()
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43168 2016-02-02] ()
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19576 2015-12-09] (NVIDIA Corporation)
S3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [47760 2015-12-18] (NVIDIA Corporation)
S3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [452040 2016-01-20] (BitDefender S.R.L.)
S3 TSSKX64; C:\Windows\System32\drivers\tsskx64.sys [38200 2015-11-29] () [File not signed]
S3 TsUsbFlt; C:\Windows\System32\drivers\tsusbflt.sys [59392 2010-11-21] () [File not signed]
S3 TsUsbGD; C:\Windows\system32\drivers\TsUsbGD.sys [31232 2010-11-21] () [File not signed]
S3 tunnel; C:\Windows\System32\DRIVERS\tunnel.sys [125440 2010-11-21] () [File not signed]
S3 uagp35; C:\Windows\system32\drivers\uagp35.sys [64080 2009-07-14] () [File not signed]
R4 udfs; C:\Windows\System32\DRIVERS\udfs.sys [328192 2010-11-21] () [File not signed]
S3 uliagpkx; C:\Windows\system32\drivers\uliagpkx.sys [64592 2009-07-14] () [File not signed]
R3 umbus; C:\Windows\System32\DRIVERS\umbus.sys [48640 2010-11-21] () [File not signed]
S3 UmPass; C:\Windows\system32\drivers\umpass.sys [9728 2009-07-14] () [File not signed]
R3 usbccgp; C:\Windows\System32\DRIVERS\usbccgp.sys [98816 2010-11-21] () [File not signed]
S3 usbcir; C:\Windows\system32\drivers\usbcir.sys [100352 2009-07-14] () [File not signed]
R3 usbehci; C:\Windows\System32\DRIVERS\usbehci.sys [52224 2010-11-21] () [File not signed]
R3 usbhub; C:\Windows\System32\DRIVERS\usbhub.sys [343040 2010-11-21] () [File not signed]
S3 usbohci; C:\Windows\system32\drivers\usbohci.sys [25600 2009-07-14] () [File not signed]
S3 usbprint; C:\Windows\system32\drivers\usbprint.sys [25088 2009-07-14] () [File not signed]
R3 USBSTOR; C:\Windows\System32\DRIVERS\USBSTOR.SYS [91648 2010-11-21] () [File not signed]
R3 usbuhci; C:\Windows\System32\DRIVERS\usbuhci.sys [30720 2009-07-14] () [File not signed]
S3 usb_rndisx; C:\Windows\System32\DRIVERS\usb8023x.sys [19968 2009-07-14] () [File not signed]
R0 vdrvroot; C:\Windows\System32\drivers\vdrvroot.sys [36432 2009-07-14] () [File not signed]
S3 vga; C:\Windows\System32\DRIVERS\vgapnp.sys [29184 2009-07-14] () [File not signed]
R1 VgaSave; C:\Windows\System32\drivers\vga.sys [29184 2009-07-14] () [File not signed]
S3 vhdmp; C:\Windows\system32\drivers\vhdmp.sys [215936 2010-11-21] () [File not signed]
S3 viaide; C:\Windows\system32\drivers\viaide.sys [17488 2009-07-14] () [File not signed]
S3 vmbus; C:\Windows\system32\drivers\vmbus.sys [199552 2010-11-21] () [File not signed]
S3 VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [21760 2010-11-21] () [File not signed]
R0 volmgr; C:\Windows\System32\drivers\volmgr.sys [71552 2010-11-21] () [File not signed]
R0 volmgrx; C:\Windows\System32\drivers\volmgrx.sys [363392 2010-11-21] () [File not signed]
R0 volsnap; C:\Windows\System32\drivers\volsnap.sys [295808 2010-11-21] () [File not signed]
S3 vsmraid; C:\Windows\system32\drivers\vsmraid.sys [161872 2009-07-14] () [File not signed]
S3 vwifibus; C:\Windows\System32\drivers\vwifibus.sys [24576 2009-07-14] () [File not signed]
S3 WacomPen; C:\Windows\system32\drivers\wacompen.sys [27776 2009-07-14] () [File not signed]
S3 WANARP; C:\Windows\System32\DRIVERS\wanarp.sys [88576 2010-11-21] () [File not signed]
R1 Wanarpv6; C:\Windows\System32\DRIVERS\wanarp.sys [88576 2010-11-21] () [File not signed]
S3 Wd; C:\Windows\system32\drivers\wd.sys [21056 2009-07-14] () [File not signed]
R0 Wdf01000; C:\Windows\System32\drivers\Wdf01000.sys [654928 2009-07-14] () [File not signed]
R1 WfpLwf; C:\Windows\System32\DRIVERS\wfplwf.sys [12800 2009-07-14] () [File not signed]
S3 WIMMount; C:\Windows\System32\drivers\wimmount.sys [22096 2009-07-14] () [File not signed]
U5 741b0108ce7bd861; <===== ATTENTION: Locked Service
S1 QMUdisk; \??\C:\Program Files (x86)\Tencent\QQPCMgr\10.10.16444.223\QMUdisk64.sys [X]
S1 softaal; \??\C:\Program Files (x86)\Tencent\QQPCMgr\11.1.16908.217\softaal64.sys [X]
S2 TORO; \SystemRoot\System32\drivers\Dallas.SYS [X]
S1 TsDefenseBt; \??\C:\Program Files (x86)\Tencent\QQPCMgr\10.10.16444.223\TsDefenseBT64.sys [X]
S2 {09BB444F-B2E2-4009-BAF2-7B727681223E}; \??\C:\Program Files (x86)\VMLaunch\BuddyVM.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-03-08 17:06 - 2016-03-08 17:06 - 00000000 ____D C:\Users\ACM\AppData\LocalLow\SUPERHOT_Team
2016-03-08 17:06 - 2016-03-08 17:06 - 00000000 ____D C:\Users\ACM\AppData\Local\SUPERHOT_Sp_z_o.o
2016-03-08 16:55 - 2016-03-08 16:55 - 00000000 ____D C:\Users\ACM\AppData\LocalLow\SUPERHOT Team
2016-03-08 16:55 - 2016-03-08 16:55 - 00000000 ____D C:\GOG Games
2016-03-06 13:57 - 2016-03-06 13:57 - 00000000 _____ C:\autoexec.bat
2016-03-06 13:56 - 2016-03-06 13:56 - 00003314 _____ C:\Windows\System32\Tasks\SpyHunter4Startup
2016-03-06 13:56 - 2016-03-06 13:56 - 00001087 _____ C:\Users\ACM\Desktop\SpyHunter.lnk
2016-03-06 13:56 - 2016-03-06 13:56 - 00000000 ____D C:\Users\ACM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2016-03-06 13:56 - 2016-03-06 13:56 - 00000000 ____D C:\Users\ACM\AppData\Roaming\Enigma Software Group
2016-03-06 13:51 - 2016-03-06 13:56 - 00000000 ____D C:\sh4ldr
2016-03-06 13:12 - 2016-03-06 13:12 - 00022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys
2016-03-06 13:02 - 2016-03-06 13:02 - 00000000 ____D C:\Program Files\Enigma Software Group
2016-03-06 12:53 - 2016-03-06 12:58 - 03286400 _____ (Enigma Software Group USA, LLC.) C:\Users\ACM\Downloads\SpyHunter-Installer.exe
2016-03-06 12:24 - 2016-03-06 12:26 - 00058973 _____ C:\Users\ACM\Downloads\Addition.txt
2016-03-06 12:22 - 2016-03-09 11:51 - 00034640 _____ C:\Users\ACM\Downloads\FRST.txt
2016-03-06 12:22 - 2016-03-09 11:50 - 00000000 ____D C:\FRST
2016-03-06 12:21 - 2016-03-06 12:22 - 02374144 _____ (Farbar) C:\Users\ACM\Downloads\FRST64.exe
2016-03-06 02:39 - 2016-03-06 02:39 - 00002992 _____ C:\Windows\System32\Tasks\{FEE193E1-28A2-456F-B937-073579A395AD}
2016-03-06 02:09 - 2016-03-06 02:09 - 00000000 ____D C:\Users\ACM\AppData\Local\Steam
2016-03-06 01:35 - 2016-03-06 12:43 - 00000000 ____D C:\Program Files (x86)\Steam
2016-03-06 01:35 - 2016-03-06 01:35 - 00000967 _____ C:\Users\Public\Desktop\Steam.lnk
2016-03-06 01:35 - 2016-03-06 01:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2016-03-06 01:33 - 2016-03-06 01:33 - 01380712 _____ C:\Users\ACM\Downloads\SteamSetup.exe
2016-03-06 01:09 - 2016-03-08 18:00 - 00000464 _____ C:\Windows\Tasks\ParetoLogic Registration3.job
2016-03-06 01:09 - 2016-03-06 01:09 - 00003124 _____ C:\Windows\System32\Tasks\ParetoLogic Registration3
2016-03-06 01:09 - 2016-03-06 01:09 - 00001194 _____ C:\Users\ACM\Desktop\RegCure Pro.lnk
2016-03-06 01:09 - 2016-03-06 01:09 - 00000000 ____D C:\Users\ACM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ParetoLogic
2016-03-06 01:04 - 2016-03-06 01:08 - 08552776 _____ (ParetoLogic, Inc.) C:\Users\ACM\Downloads\RegCureProSetup_310417D7-488F-41E6-8681-FA7676BC49F3_.exe
2016-03-06 00:47 - 2016-03-08 17:12 - 00000000 ____D C:\Users\ACM\AppData\LocalLow\uTorrent
2016-03-05 23:42 - 2016-03-06 01:09 - 00000000 ____D C:\ProgramData\ParetoLogic
2016-03-05 23:42 - 2016-03-05 23:42 - 00000000 ____D C:\Users\ACM\AppData\Roaming\ParetoLogic
2016-03-05 23:42 - 2016-03-05 23:42 - 00000000 ____D C:\Program Files (x86)\ParetoLogic
2016-03-05 23:39 - 2016-03-05 23:40 - 08552776 _____ (ParetoLogic, Inc.) C:\Users\ACM\Downloads\RegCureProSetup_A12B8BC5-061B-4219-A38C-FA15C3908FC3_.exe
2016-03-05 23:34 - 2016-03-05 23:34 - 00003298 _____ C:\Windows\System32\Tasks\{51CCCAA4-97E2-4C51-9B3A-1100A29602D9}
2016-03-05 17:42 - 2016-03-05 17:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Beat Blades Haruka
2016-03-05 17:40 - 2016-03-05 17:44 - 00000000 ____D C:\Program Files (x86)\Beat Blades Haruka
2016-03-03 20:37 - 2016-03-03 20:37 - 03878112 _____ (Husdawg, LLC) C:\Users\ACM\Downloads\Detection (3).exe
2016-03-03 20:34 - 2016-03-03 20:35 - 03878112 _____ (Husdawg, LLC) C:\Users\ACM\Downloads\Detection (2).exe
2016-03-03 18:43 - 2016-03-03 18:43 - 00000000 ____D C:\Users\ACM\AppData\Local\CEF
2016-03-03 15:39 - 2016-03-03 15:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Galactic Civilizations III Mercenaries
2016-03-02 19:52 - 2016-03-02 19:52 - 00001273 _____ C:\Users\ACM\Desktop\MassEffect - Shortcut.lnk
2016-03-02 03:00 - 2015-12-18 11:41 - 00047760 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2016-03-02 03:00 - 2015-12-18 11:40 - 00099472 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
2016-03-02 03:00 - 2015-12-18 11:40 - 00090768 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2016-03-01 22:32 - 2016-03-01 22:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XCOM 2
2016-02-25 13:33 - 2016-02-25 13:33 - 00003392 _____ C:\Windows\System32\Tasks\{48322287-BF48-4870-8EF6-DF1864B08E0F}
2016-02-23 03:02 - 2016-02-23 03:02 - 00000000 ____D C:\Users\ACM\AppData\Roaming\Zeno.saga1
2016-02-22 19:43 - 2016-02-22 19:43 - 00000000 ____D C:\ProgramData\Electronic Arts
2016-02-22 19:16 - 2016-02-22 19:16 - 00000783 _____ C:\Users\Public\Desktop\Mass Effect.lnk
2016-02-22 19:16 - 2016-02-22 19:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mass Effect
2016-02-22 19:16 - 2016-02-22 19:16 - 00000000 ____D C:\ProgramData\Media Center Programs
2016-02-21 21:38 - 2016-02-21 21:38 - 00000000 ____D C:\Users\ACM\AppData\Roaming\TheBannerSaga
2016-02-21 21:37 - 2016-02-21 21:37 - 00000000 ____D C:\Users\ACM\AppData\Roaming\The Banner Saga
2016-02-21 16:39 - 2016-02-21 16:39 - 00000000 ____D C:\Users\ACM\Documents\DyingLight
2016-02-21 15:11 - 2016-02-21 15:11 - 00000657 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dying Light.lnk
2016-02-19 23:04 - 2016-02-19 23:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mass Effect 2
2016-02-16 18:15 - 2016-02-16 18:16 - 02570412 _____ C:\Users\ACM\Downloads\12690840_193095524379086_1732209986_n.mp4
2016-02-15 17:54 - 2016-02-15 17:54 - 00000000 ____D C:\Users\ACM\AppData\Local\SoD_Save
2016-02-15 15:46 - 2016-02-15 15:46 - 00001981 _____ C:\Users\ACM\Desktop\State of Decay Save Manager - Shortcut.lnk
2016-02-15 15:45 - 2016-02-15 15:45 - 00000000 ____D C:\Program Files (x86)\SoD Community
2016-02-15 14:11 - 2016-02-15 14:11 - 00386048 _____ () C:\Users\ACM\AppData\Local\Dallas.sys
2016-02-15 14:11 - 2016-02-15 14:11 - 00057344 _____ C:\Users\ACM\AppData\Local\wdreg.exe
2016-02-15 14:11 - 2016-02-15 14:11 - 00000212 _____ C:\Users\ACM\AppData\Local\TORO.Dallas
2016-02-15 13:52 - 2016-02-15 14:11 - 00386048 _____ () C:\Windows\SysWOW64\Drivers\Dallas.sys
2016-02-15 13:52 - 2016-02-15 14:11 - 00057344 _____ C:\Windows\SysWOW64\Drivers\wdreg.exe
2016-02-15 13:52 - 2016-02-15 14:11 - 00000212 _____ C:\Windows\SysWOW64\TORO.Dallas
2016-02-15 13:47 - 2016-02-15 13:47 - 00000000 ____D C:\Users\ACM\AppData\Roaming\OTI
2016-02-15 13:47 - 2016-02-15 13:47 - 00000000 ____D C:\Users\ACM\AppData\Local\ApplicationHistory
2016-02-15 13:39 - 2016-02-15 13:39 - 00000244 _____ C:\Windows\ODBC.INI
2016-02-15 13:38 - 2016-02-15 13:38 - 00001659 _____ C:\Users\Public\Desktop\ETAP 6.0.0.lnk
2016-02-15 13:38 - 2016-02-15 13:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ETAP 6.0.0
2016-02-15 13:35 - 2016-02-15 13:35 - 00000000 ____D C:\Program Files (x86)\Business Objects
2016-02-14 13:01 - 2016-02-14 13:01 - 00001136 _____ C:\Users\ACM\Desktop\State of Decay Year-One.lnk
2016-02-14 13:01 - 2016-02-14 13:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\State of Decay Year-One
2016-02-14 12:47 - 2016-02-15 15:48 - 00000000 ____D C:\Program Files (x86)\State of Decay Year-One
2016-02-08 14:26 - 2016-02-08 14:26 - 00000000 ____D C:\Users\ACM\Documents\ギャルプリンス
2016-02-08 14:24 - 2016-02-08 14:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ギャルプリンス
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-03-09 11:51 - 2015-07-29 01:11 - 00000000 ____D C:\Users\ACM\AppData\Roaming\uTorrent
2016-03-09 11:50 - 2015-11-28 10:32 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-03-09 11:50 - 2015-11-27 23:45 - 00000338 ____H C:\Windows\Tasks\MMNJFQAOLDJBKOYG.job
2016-03-09 11:19 - 2015-11-29 14:02 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-03-09 09:29 - 2015-07-31 17:27 - 00000000 ____D C:\Users\ACM\AppData\LocalLow\Temp
2016-03-08 18:19 - 2015-11-29 14:02 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-03-08 17:05 - 2016-02-06 14:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com
2016-03-08 17:05 - 2009-07-14 11:02 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2016-03-07 04:35 - 2015-08-01 12:02 - 00000000 ____D C:\Users\ACM\AppData\Roaming\vlc
2016-03-07 04:14 - 2015-09-02 20:25 - 00000000 ____D C:\Users\ACM\AppData\Roaming\RenPy
2016-03-06 18:23 - 2016-01-10 16:48 - 00000000 ____D C:\Users\ACM\AppData\Local\CrashDumps
2016-03-06 12:56 - 2009-07-14 10:15 - 00027680 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-03-06 12:56 - 2009-07-14 10:15 - 00027680 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-03-06 12:53 - 2015-07-29 04:08 - 00003112 _____ C:\Windows\System32\Tasks\RDReminder
2016-03-06 12:41 - 2015-11-27 23:45 - 00000350 _____ C:\Windows\Tasks\WQWAHT1.job
2016-03-06 12:41 - 2015-07-29 01:38 - 00000000 ____D C:\ProgramData\NVIDIA
2016-03-06 12:41 - 2009-07-14 10:38 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-03-06 02:40 - 2015-08-08 14:41 - 00000000 ____D C:\Users\ACM\AppData\Local\ElevatedDiagnostics
2016-03-06 00:37 - 2016-01-09 18:26 - 00000000 ____D C:\Windows\SysWOW64\directx
2016-03-05 15:47 - 2015-07-29 04:08 - 00000288 _____ C:\Windows\Tasks\DLL-Files.Com Fixer_Updates.job
2016-03-02 15:48 - 2015-07-29 04:08 - 00000272 _____ C:\Windows\Tasks\DLL-Files.Com Fixer_MONTHLY.job
2016-03-02 03:31 - 2015-07-29 02:39 - 00000000 ____D C:\Users\ACM\AppData\Local\NVIDIA
2016-03-02 03:02 - 2009-07-14 08:50 - 00000000 ____D C:\Windows\inf
2016-03-02 03:01 - 2015-07-29 02:39 - 00001381 _____ C:\Users\Public\Desktop\GeForce Experience.lnk
2016-03-01 23:03 - 2015-12-11 18:25 - 00000000 ____D C:\Users\ACM\AppData\Roaming\FiraxisLive
2016-03-01 23:01 - 2015-08-25 21:40 - 00000000 ____D C:\Users\ACM\Documents\My Games
2016-03-01 21:55 - 2016-01-09 17:14 - 00000000 ____D C:\Games
2016-02-21 21:38 - 2015-08-30 23:43 - 00000000 ____D C:\Users\ACM\AppData\Local\SKIDROW
2016-02-21 21:37 - 2016-01-23 17:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\R.G. Mechanics
2016-02-20 09:56 - 2015-07-29 12:49 - 00000000 ____D C:\Users\ACM\Documents\KoeiTecmo
2016-02-20 04:22 - 2015-11-29 14:15 - 00002512 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-02-20 04:22 - 2015-11-29 14:15 - 00002483 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-02-16 15:31 - 2009-07-14 10:43 - 00794456 _____ C:\Windows\system32\PerfStringBackup.INI
2016-02-15 13:56 - 2009-07-14 10:15 - 00424080 _____ C:\Windows\system32\FNTCACHE.DAT
2016-02-15 13:47 - 2015-07-29 01:38 - 00110808 _____ C:\Users\ACM\AppData\Local\GDIPFONTCACHEV1.DAT
2016-02-15 13:40 - 2015-07-29 01:15 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2016-02-15 13:38 - 2009-07-14 08:04 - 00017486 _____ C:\Windows\system32\Drivers\etc\services
2016-02-13 00:47 - 2010-11-21 08:54 - 00120832 ___SH (Newzie) C:\ProgramData\msvvse.exe
2016-02-09 20:13 - 2009-07-14 08:50 - 00000000 ____D C:\Windows\system32\NDF
==================== Files in the root of some directories =======
2015-11-28 00:18 - 2015-11-28 00:18 - 3828689 _____ () C:\Program Files\Common Files\hyqp1tg2.exe
2015-11-30 00:14 - 2015-11-30 00:14 - 3828694 _____ () C:\Program Files\Common Files\yyh140q5.exe
2015-11-26 15:04 - 2015-11-28 18:10 - 9545216 _____ () C:\Users\ACM\AppData\Roaming\agent.dat
2015-11-26 15:04 - 2015-11-28 18:10 - 0060000 _____ () C:\Users\ACM\AppData\Roaming\Config.xml
2015-11-28 19:40 - 2015-11-28 19:40 - 0005120 _____ () C:\Users\ACM\AppData\Roaming\GiftBag.db
2015-11-26 23:10 - 2015-11-19 18:57 - 0000428 _____ () C:\Users\ACM\AppData\Roaming\ham.txt
2016-03-05 23:42 - 2016-03-06 01:09 - 0000053 _____ () C:\Users\ACM\AppData\Roaming\LogFile.txt
2015-11-26 15:04 - 2015-11-28 18:10 - 0017920 _____ () C:\Users\ACM\AppData\Roaming\Main.dat
2015-11-26 23:09 - 2015-11-26 23:09 - 0005568 _____ () C:\Users\ACM\AppData\Roaming\md.xml
2015-11-26 23:09 - 2015-11-26 23:09 - 0042496 _____ () C:\Users\ACM\AppData\Roaming\Moses.dat
2015-11-26 23:07 - 2015-11-28 18:10 - 0466944 _____ () C:\Users\ACM\AppData\Roaming\moses.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0151040 ___SH (Jetico, Inc.) C:\Users\ACM\AppData\Roaming\msccttum.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0151040 ___SH (Jetico, Inc.) C:\Users\ACM\AppData\Roaming\msemk.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0123392 ___SH () C:\Users\ACM\AppData\Roaming\msrlygqf.exe
2015-11-26 23:10 - 2015-11-19 18:56 - 0004134 _____ () C:\Users\ACM\AppData\Roaming\shem.jpg
2016-02-15 14:11 - 2016-02-15 14:11 - 0386048 _____ () C:\Users\ACM\AppData\Local\Dallas.sys
2015-11-28 19:28 - 2015-11-28 19:28 - 0000187 _____ () C:\Users\ACM\AppData\Local\donelectronics.exe.config
2015-11-27 23:08 - 2015-11-27 23:08 - 0000187 _____ () C:\Users\ACM\AppData\Local\Statlux.exe.config
2016-02-15 14:11 - 2016-02-15 14:11 - 0000212 _____ () C:\Users\ACM\AppData\Local\TORO.Dallas
2016-02-15 14:11 - 2016-02-15 14:11 - 0057344 _____ () C:\Users\ACM\AppData\Local\wdreg.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0264704 ___SH (Vortex Team) C:\ProgramData\msaganf.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0181248 ___SH (toyworld) C:\ProgramData\msaghnufc.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0181760 ___SH () C:\ProgramData\msairkcp.exe
2010-11-21 08:54 - 2016-01-18 07:31 - 0203264 ___SH () C:\ProgramData\msakmnkbs.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0181248 ___SH (toyworld) C:\ProgramData\msbjvfz.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0176640 ___SH () C:\ProgramData\msbninrx.exe
2010-11-21 08:54 - 2016-01-20 09:22 - 0134144 ___SH (Thomas Schweitzer) C:\ProgramData\msboxg.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0183808 ___SH (Mail.Ru) C:\ProgramData\msccttum.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0181248 ___SH () C:\ProgramData\mscooif.exe
2010-11-21 08:54 - 2016-01-18 07:31 - 0203264 ___SH () C:\ProgramData\msczqdlj.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0171520 ___SH (PortableApps.com) C:\ProgramData\msdhqy.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0267264 ___SH (Sun Microsystems, Inc.) C:\ProgramData\mseefx.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0183808 ___SH (Mail.Ru) C:\ProgramData\msemk.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0267264 ___SH (Sun Microsystems, Inc.) C:\ProgramData\mseuoiopr.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0264704 ___SH (Vortex Team) C:\ProgramData\msflew.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0114688 ___SH () C:\ProgramData\msfzsknrj.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0117248 ___SH (The Wireshark developer community, http://www.wireshark.org/)C:\ProgramData\msgiuzrbd.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0229376 ___SH (Nullsoft, Inc.) C:\ProgramData\mshbwrif.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0171520 ___SH (PortableApps.com) C:\ProgramData\mshixbtiv.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0184832 ___SH (maymun) C:\ProgramData\msikguvy.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0210944 ___SH () C:\ProgramData\msjkvdc.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0264704 ___SH (Vortex Team) C:\ProgramData\msjxmqvoj.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0176640 ___SH () C:\ProgramData\msldiao.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0181248 ___SH (toyworld) C:\ProgramData\mslgpfkph.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0229376 ___SH (Nullsoft, Inc.) C:\ProgramData\mslstxiru.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0210432 ___SH () C:\ProgramData\msnjnyoej.exe
2010-11-21 08:54 - 2016-01-18 07:31 - 0203264 ___SH () C:\ProgramData\msoud.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0176128 ___SH () C:\ProgramData\mspqgbd.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0267264 ___SH (Sun Microsystems, Inc.) C:\ProgramData\mspqjo.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0134144 ___SH (Thomas Schweitzer) C:\ProgramData\msqkfg.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0181760 ___SH () C:\ProgramData\msqrsz.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0195072 ___SH () C:\ProgramData\msrhuiuu.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0176640 ___SH () C:\ProgramData\msrifcj.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0171520 ___SH (PortableApps.com) C:\ProgramData\msrlygqf.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0210944 ___SH () C:\ProgramData\msrpss.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0229376 ___SH (Nullsoft, Inc.) C:\ProgramData\msrucaz.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0264704 ___SH (Vortex Team) C:\ProgramData\msrzu.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0264704 ___SH (Vortex Team) C:\ProgramData\mssas.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0181248 ___SH (toyworld) C:\ProgramData\msswzht.exe
2010-11-21 08:54 - 2016-01-18 07:31 - 0203264 ___SH () C:\ProgramData\mstmc.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0182272 ___SH (toyworld) C:\ProgramData\mstpsvjv.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0237056 ___SH () C:\ProgramData\msuep.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0171520 ___SH (PortableApps.com) C:\ProgramData\msufsco.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0181760 ___SH () C:\ProgramData\msuiqzes.exe
2010-11-21 08:54 - 2016-01-21 14:01 - 0235520 ___SH () C:\ProgramData\msuprysxc.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0267264 ___SH (Sun Microsystems, Inc.) C:\ProgramData\msvgoy.exe
2010-11-21 08:54 - 2016-01-18 07:31 - 0203264 ___SH () C:\ProgramData\msvimlzq.exe
2010-11-21 08:54 - 2016-02-13 00:47 - 0120832 ___SH (Newzie) C:\ProgramData\msvvse.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0210944 ___SH () C:\ProgramData\mswkaldj.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0264704 ___SH (Vortex Team) C:\ProgramData\msxnkvlkk.exe
2015-09-02 00:44 - 2015-11-29 02:17 - 0000098 _____ () C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
Files to move or delete:
====================
C:\ProgramData\msaganf.exe
C:\ProgramData\msaghnufc.exe
C:\ProgramData\msairkcp.exe
C:\ProgramData\msakmnkbs.exe
C:\ProgramData\msbjvfz.exe
C:\ProgramData\msbninrx.exe
C:\ProgramData\msboxg.exe
C:\ProgramData\msccttum.exe
C:\ProgramData\mscooif.exe
C:\ProgramData\msczqdlj.exe
C:\ProgramData\msdhqy.exe
C:\ProgramData\mseefx.exe
C:\ProgramData\msemk.exe
C:\ProgramData\mseuoiopr.exe
C:\ProgramData\msflew.exe
C:\ProgramData\msfzsknrj.exe
C:\ProgramData\msgiuzrbd.exe
C:\ProgramData\mshbwrif.exe
C:\ProgramData\mshixbtiv.exe
C:\ProgramData\msikguvy.exe
C:\ProgramData\msjkvdc.exe
C:\ProgramData\msjxmqvoj.exe
C:\ProgramData\msldiao.exe
C:\ProgramData\mslgpfkph.exe
C:\ProgramData\mslstxiru.exe
C:\ProgramData\msnjnyoej.exe
C:\ProgramData\msoud.exe
C:\ProgramData\mspqgbd.exe
C:\ProgramData\mspqjo.exe
C:\ProgramData\msqkfg.exe
C:\ProgramData\msqrsz.exe
C:\ProgramData\msrhuiuu.exe
C:\ProgramData\msrifcj.exe
C:\ProgramData\msrlygqf.exe
C:\ProgramData\msrpss.exe
C:\ProgramData\msrucaz.exe
C:\ProgramData\msrzu.exe
C:\ProgramData\mssas.exe
C:\ProgramData\msswzht.exe
C:\ProgramData\mstmc.exe
C:\ProgramData\mstpsvjv.exe
C:\ProgramData\msuep.exe
C:\ProgramData\msufsco.exe
C:\ProgramData\msuiqzes.exe
C:\ProgramData\msuprysxc.exe
C:\ProgramData\msvgoy.exe
C:\ProgramData\msvimlzq.exe
C:\ProgramData\msvvse.exe
C:\ProgramData\mswkaldj.exe
C:\ProgramData\msxnkvlkk.exe
C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
Some files in TEMP:
====================
C:\Users\ACM\AppData\Local\Temp\57975w13s7qyk7s_1.exe
C:\Users\ACM\AppData\Local\Temp\595ca1m7797.exe
C:\Users\ACM\AppData\Local\Temp\is3mkycwowky37.exe
C:\Users\ACM\AppData\Local\Temp\KB00874541.exe
C:\Users\ACM\AppData\Local\Temp\KB00880126.exe
C:\Users\ACM\AppData\Local\Temp\KB00891311.exe
C:\Users\ACM\AppData\Local\Temp\KB00892622.exe
C:\Users\ACM\AppData\Local\Temp\KB00893916.exe
C:\Users\ACM\AppData\Local\Temp\KB00902496.exe
C:\Users\ACM\AppData\Local\Temp\KB00908409.exe
C:\Users\ACM\AppData\Local\Temp\KB00950467.exe
C:\Users\ACM\AppData\Local\Temp\KB00951372.exe
C:\Users\ACM\AppData\Local\Temp\KB00960747.exe
C:\Users\ACM\AppData\Local\Temp\KB01052179.exe
C:\Users\ACM\AppData\Local\Temp\KB01052460.exe
C:\Users\ACM\AppData\Local\Temp\KB109106319.exe
C:\Users\ACM\AppData\Local\Temp\KB109116740.exe
C:\Users\ACM\AppData\Local\Temp\KB109218000.exe
C:\Users\ACM\AppData\Local\Temp\KB109227454.exe
C:\Users\ACM\AppData\Local\Temp\KB109287639.exe
C:\Users\ACM\AppData\Local\Temp\KB109298325.exe
C:\Users\ACM\AppData\Local\Temp\KB109490284.exe
C:\Users\ACM\AppData\Local\Temp\KB109530298.exe
C:\Users\ACM\AppData\Local\Temp\KB263943801.exe
C:\Users\ACM\AppData\Local\Temp\KB29285864.exe
C:\Users\ACM\AppData\Local\Temp\KB29306769.exe
C:\Users\ACM\AppData\Local\Temp\KB293108437.exe
C:\Users\ACM\AppData\Local\Temp\KB29326830.exe
C:\Users\ACM\AppData\Local\Temp\KB29356392.exe
C:\Users\ACM\AppData\Local\Temp\KB293717356.exe
C:\Users\ACM\AppData\Local\Temp\KB29386984.exe
C:\Users\ACM\AppData\Local\Temp\KB29490397.exe
C:\Users\ACM\AppData\Local\Temp\KB29561050.exe
C:\Users\ACM\AppData\Local\Temp\KB347154594.exe
C:\Users\ACM\AppData\Local\Temp\KB386507359.exe
C:\Users\ACM\AppData\Local\Temp\KB399970698.exe
C:\Users\ACM\AppData\Local\Temp\KB432979823.exe
C:\Users\ACM\AppData\Local\Temp\KB482460672.exe
C:\Users\ACM\AppData\Local\Temp\KB83287014.exe
C:\Users\ACM\AppData\Local\Temp\uqoisqowweau.exe
C:\Users\ACM\AppData\Local\Temp\_is8C98.exe
C:\Users\ACM\AppData\Local\Temp\_is9C51.exe
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll
[2010-11-21 08:54] - [2010-11-21 08:54] - 0357888 ____A (Microsoft Corporation) 52C6BCE4E3EF07B2F002C65C5EE9B64F
C:\Windows\SysWOW64\dnsapi.dll
[2010-11-21 08:54] - [2010-11-21 08:54] - 0270336 ____A (Microsoft Corporation) DBA22B75246D9B29F7A88E0C9F5D55A2
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
testsigning: ==> 'testsigning' is set. Check for possible unsigned driver <===== ATTENTION
LastRegBack: 2016-03-09 01:11
==================== End of FRST.txt ============================
Sign In
Create Account
