Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Runtime error Out of string range when running game setup


  • Please log in to reply

#1
Zaid AbdulHannan

Zaid AbdulHannan

    New Member

  • Member
  • Pip
  • 1 posts

i downloaded Homeworld.Remastered.Collection.2015.SteamRip.LP and now when i run setup it says Runtime error Out of string range.

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:04-03-2016
Ran by ACM (administrator) on ACM-PC (09-03-2016 11:50:19)
Running from C:\Users\ACM\Downloads
Loaded Profiles: ACM (Available Profiles: ACM)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
() C:\ProgramData\Bamcof\Bamcof.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
() C:\Program Files (x86)\Comodo\IceDragon\icedragon_updater.exe
(RayDl) C:\Program Files (x86)\RayDld\ihpmServer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
() C:\Windows\Installer\{9341DEB5-87B8-4DE4-2753-9CAE073A9F2A}\syshost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(BitTorrent Inc.) C:\Users\ACM\AppData\Roaming\uTorrent\uTorrent.exe
(BitTorrent Inc.) C:\Users\ACM\AppData\Roaming\uTorrent\updates\3.4.5_41865\utorrentie.exe
(BitTorrent Inc.) C:\Users\ACM\AppData\Roaming\uTorrent\updates\3.4.5_41865\utorrentie.exe
() C:\Program Files (x86)\Beat Blades Haruka\OpenSaveFolder.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dinotify.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
 
==================== Registry (Whitelisted) ===========================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2787264 2016-01-12] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => "C:\Windows\system32\rundll32.exe" C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [regedit.exe] => C:\Users\ACM\AppData\Roaming\alFSVWJB\regedit.exe [227840 2010-11-21] ()
HKLM\...\RunOnce: [Hard Disk Sync Tool] => C:\ProgramData\Hard Disk Sync Tool\gim19qqwuw.exe [457216 2016-01-18] ()
HKLM\...\Policies\Explorer\Run: [1035228220] => C:\ProgramData\msccttum.exe [183808 2010-11-21] (Mail.Ru)
HKLM\...\Policies\Explorer\Run: [514270637] => C:\ProgramData\msemk.exe [183808 2010-11-21] (Mail.Ru)
HKLM\...\Policies\Explorer\Run: [1286042896] => C:\ProgramData\msrlygqf.exe [171520 2010-11-21] (PortableApps.com)
HKLM\...\Policies\Explorer\Run: [1220024322] => C:\ProgramData\msufsco.exe [171520 2010-11-21] (PortableApps.com)
HKLM\...\Policies\Explorer\Run: [1409098418] => C:\ProgramData\msdhqy.exe [171520 2010-11-21] (PortableApps.com)
HKLM\...\Policies\Explorer\Run: [502870409] => C:\ProgramData\mshixbtiv.exe [171520 2010-11-21] (PortableApps.com)
HKLM\...\Policies\Explorer\Run: [1647974265] => C:\ProgramData\mshbwrif.exe [229376 2010-11-21] (Nullsoft, Inc.)
HKLM\...\Policies\Explorer\Run: [1433235010] => C:\ProgramData\mslstxiru.exe [229376 2010-11-21] (Nullsoft, Inc.)
HKLM\...\Policies\Explorer\Run: [1897442575] => C:\ProgramData\msrucaz.exe [229376 2010-11-21] (Nullsoft, Inc.)
HKLM\...\Policies\Explorer\Run: [1141413839] => C:\ProgramData\msrifcj.exe [176640 2010-11-21] ()
HKLM\...\Policies\Explorer\Run: [50466237] => C:\ProgramData\msnjnyoej.exe [210432 2010-11-21] ()
HKLM\...\Policies\Explorer\Run: [1983861589] => C:\ProgramData\msldiao.exe [176640 2010-11-21] ()
HKLM\...\Policies\Explorer\Run: [780086614] => C:\ProgramData\msbninrx.exe [176640 2010-11-21] ()
HKLM\...\Policies\Explorer\Run: [1750604790] => C:\ProgramData\msuiqzes.exe [181760 2010-11-21] ()
HKLM\...\Policies\Explorer\Run: [748347182] => C:\ProgramData\msqrsz.exe [181760 2010-11-21] ()
HKLM\...\Policies\Explorer\Run: [1729214437] => C:\ProgramData\msairkcp.exe [181760 2010-11-21] ()
HKLM\...\Policies\Explorer\Run: [1814576463] => C:\ProgramData\msuep.exe [237056 2010-11-21] ()
HKLM\...\Policies\Explorer\Run: [2015853321] => C:\ProgramData\mspqjo.exe [267264 2010-11-21] (Sun Microsystems, Inc.)
HKLM\...\Policies\Explorer\Run: [284759384] => C:\ProgramData\mswkaldj.exe [210944 2010-11-21] ()
HKLM\...\Policies\Explorer\Run: [474131080] => C:\ProgramData\mscooif.exe [181248 2010-11-21] ()
HKLM\...\Policies\Explorer\Run: [1298204763] => C:\ProgramData\mseuoiopr.exe [267264 2010-11-21] (Sun Microsystems, Inc.)
HKLM\...\Policies\Explorer\Run: [480798240] => C:\ProgramData\msoud.exe [203264 2016-01-18] ()
HKLM\...\Policies\Explorer\Run: [1773501550] => C:\ProgramData\mssas.exe [264704 2010-11-21] (Vortex Team)
HKLM\...\Policies\Explorer\Run: [1256100755] => C:\ProgramData\msflew.exe [264704 2010-11-21] (Vortex Team)
HKLM\...\Policies\Explorer\Run: [1275627814] => C:\ProgramData\mstmc.exe [203264 2016-01-18] ()
HKLM\...\Policies\Explorer\Run: [756021217] => C:\ProgramData\msvimlzq.exe [203264 2016-01-18] ()
HKLM\...\Policies\Explorer\Run: [933970431] => C:\ProgramData\msaganf.exe [264704 2010-11-21] (Vortex Team)
HKLM\...\Policies\Explorer\Run: [1461924631] => C:\ProgramData\msakmnkbs.exe [203264 2016-01-18] ()
HKLM\...\Policies\Explorer\Run: [1300631362] => C:\ProgramData\msaghnufc.exe [181248 2010-11-21] (toyworld)
HKLM\...\Policies\Explorer\Run: [1049206930] => C:\ProgramData\msswzht.exe [181248 2010-11-21] (toyworld)
HKLM\...\Policies\Explorer\Run: [325572943] => C:\ProgramData\mslgpfkph.exe [181248 2010-11-21] (toyworld)
HKLM\...\Policies\Explorer\Run: [1643409771] => C:\ProgramData\msvvse.exe [120832 2016-02-13] (Newzie)
HKLM\...\Policies\Explorer\Run: [71816879] => C:\ProgramData\msczqdlj.exe [203264 2016-01-18] ()
HKLM\...\Policies\Explorer\Run: [2055314185] => C:\ProgramData\mstpsvjv.exe [182272 2010-11-21] (toyworld)
HKLM\...\Policies\Explorer\Run: [1903671284] => C:\ProgramData\mspqgbd.exe [176128 2010-11-21] ()
HKLM\...\Policies\Explorer\Run: [976243056] => C:\ProgramData\mseefx.exe [267264 2010-11-21] (Sun Microsystems, Inc.)
HKLM\...\Policies\Explorer\Run: [1645215113] => C:\ProgramData\msgiuzrbd.exe [117248 2010-11-21] (The Wireshark developer community, hxxp://www.wireshark.org/)
HKLM\...\Policies\Explorer\Run: [361228002] => C:\ProgramData\msboxg.exe [134144 2016-01-20] (Thomas Schweitzer)
HKLM\...\Policies\Explorer\Run: [2114625105] => C:\ProgramData\msrhuiuu.exe [195072 2010-11-21] ()
HKLM\...\Policies\Explorer\Run: [977298269] => C:\ProgramData\msvgoy.exe [267264 2010-11-21] (Sun Microsystems, Inc.)
HKLM\...\Policies\Explorer\Run: [1120267585] => C:\ProgramData\msrpss.exe [210944 2010-11-21] ()
HKLM\...\Policies\Explorer\Run: [945939712] => C:\ProgramData\msikguvy.exe [184832 2010-11-21] (maymun)
HKLM\...\Policies\Explorer\Run: [505935564] => C:\ProgramData\msbjvfz.exe [181248 2010-11-21] (toyworld)
HKLM\...\Policies\Explorer\Run: [1586513979] => C:\ProgramData\msfzsknrj.exe [114688 2010-11-21] ()
HKLM\...\Policies\Explorer\Run: [537140894] => C:\ProgramData\msjkvdc.exe [210944 2010-11-21] ()
HKLM\...\Policies\Explorer\Run: [2016105411] => C:\ProgramData\msjxmqvoj.exe [264704 2010-11-21] (Vortex Team)
HKLM\...\Policies\Explorer\Run: [1056185179] => C:\ProgramData\msxnkvlkk.exe [264704 2010-11-21] (Vortex Team)
HKLM\...\Policies\Explorer\Run: [1817036189] => C:\ProgramData\msqkfg.exe [134144 2010-11-21] (Thomas Schweitzer)
HKLM\...\Policies\Explorer\Run: [65846339] => C:\ProgramData\msuprysxc.exe [235520 2016-01-21] ()
HKLM\...\Policies\Explorer\Run: [282199271] => C:\ProgramData\msrzu.exe [264704 2010-11-21] (Vortex Team)
HKLM\...\Policies\Explorer: [NoAutorun] 1
HKLM\...\Policies\Explorer: [TaskbarNoNotification] 1
HKLM\...\Policies\Explorer: [HideSCAHealth] 1
HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore: [DisableSR/DisableConfig]  <===== ATTENTION
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [uTorrent] => C:\Users\ACM\AppData\Roaming\uTorrent\uTorrent.exe [2094080 2016-03-03] (BitTorrent Inc.)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [Hard Disk Sync Tool] => C:\ProgramData\Hard Disk Sync Tool\gim19qqwuw.exe [457216 2016-01-18] ()
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [senewsys32] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-186345671\senewsys32.exe [249856 2016-03-05] (Sun Microsystems, Inc.)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [senzwbsys32] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-1363345871\senewzbys32.exe [250880 2016-03-05] (Sun Microsystems, Inc.)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [syszwbsys32] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-13633145871\sysewzbys32.exe [250880 2016-03-05] (Sun Microsystems, Inc.)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [sysazwbsays32] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-13633451\sysaewazbys32.exe [251904 2016-03-05] (Sun Microsystems, Inc.)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [sysazwb6says32] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-136633451\sysae6w6azbys32.exe [250880 2016-03-05] (Sun Microsystems, Inc.)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [sysanitesys132] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-1332612551\sysanitesys132.exe
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [sysanitesys2132] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-1232612551\sysanitesy2132.exe [181248 2016-03-06] ()
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [sysanitesays2132s] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-123268151\sysaniteasy2132s.exe [180224 2016-03-06] ()
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [sysanf132s] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-12326151\sysanifsy2132s.exe [178688 2016-03-06] ()
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [syee132s] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-123261541\seifsy2132s.exe [251904 2016-03-05] (Sun Microsystems, Inc.)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [sye1iaarrs] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-122403216261\seia1ar32.exe [159232 2016-03-04] ()
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [syeik3122s] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-123263113541\seifs12ik32.exe [178688 2016-03-06] ()
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [syeiaz822s] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-1220326261\seiafs1z432.exe [250880 2016-03-05] (Sun Microsystems, Inc.)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [syeiarrs] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-12240326261\seiar32.exe [181760 2016-03-06] ()
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [sye1i3aarrs] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-13403216261\seia1a3r32.exe [211968 2016-02-28] (PortableApps.com)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [syee1r32s] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-1232631541\seifsy2r132s.exe
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [sye1vi3aaarrs] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-13403216261\seiva1a3ar32.exe [180736 2016-03-06] ()
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [sy192i3aaarrs] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-134019216261\se1923ar32.exe [250368 2016-03-05] (Sun Microsystems, Inc.)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [sy192i33s] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-134019361\se1933332.exe [180224 2016-03-06] ()
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3014224 2016-02-05] (Valve Corporation)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\RunOnce: [sy192i33s] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-134019361\se1933332.exe [180224 2016-03-06] ()
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\RunOnce: [sysazwbsays32] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-13633451\sysaewazbys32.exe [251904 2016-03-05] (Sun Microsystems, Inc.)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\RunOnce: [syeik3122s] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-123263113541\seifs12ik32.exe [178688 2016-03-06] ()
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\RunOnce: [senewsys32] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-186345671\senewsys32.exe [249856 2016-03-05] (Sun Microsystems, Inc.)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\RunOnce: [sye1i3aarrs] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-13403216261\seia1a3r32.exe [211968 2016-02-28] (PortableApps.com)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\RunOnce: [syszwbsys32] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-13633145871\sysewzbys32.exe [250880 2016-03-05] (Sun Microsystems, Inc.)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\RunOnce: [syee132s] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-123261541\seifsy2132s.exe [251904 2016-03-05] (Sun Microsystems, Inc.)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\RunOnce: [syeiarrs] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-12240326261\seiar32.exe [181760 2016-03-06] ()
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\RunOnce: [senzwbsys32] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-1363345871\senewzbys32.exe [250880 2016-03-05] (Sun Microsystems, Inc.)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\RunOnce: [sy192i3aaarrs] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-134019216261\se1923ar32.exe [250368 2016-03-05] (Sun Microsystems, Inc.)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\RunOnce: [sysazwb6says32] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-136633451\sysae6w6azbys32.exe [250880 2016-03-05] (Sun Microsystems, Inc.)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\RunOnce: [sye1iaarrs] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-122403216261\seia1ar32.exe [159232 2016-03-04] ()
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\RunOnce: [sye1vi3aaarrs] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-13403216261\seiva1a3ar32.exe [180736 2016-03-06] ()
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\RunOnce: [sysanitesays2132s] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-123268151\sysaniteasy2132s.exe [180224 2016-03-06] ()
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\RunOnce: [syeiaz822s] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-1220326261\seiafs1z432.exe [250880 2016-03-05] (Sun Microsystems, Inc.)
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\RunOnce: [sysanf132s] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-12326151\sysanifsy2132s.exe [178688 2016-03-06] ()
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\RunOnce: [sysanitesys2132] => C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-1232612551\sysanitesy2132.exe [181248 2016-03-06] ()
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\CurrentVersion\Windows: [Load] C:\PROGRA~3\msrzu.exe <===== ATTENTION
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Policies\Explorer: [TaskbarNoNotification] 1
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\Policies\Explorer: [HideSCAHealth] 1
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\MountPoints2: J - J:\setup.exe
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\...\MountPoints2: K - K:\BLEEDUST.EXE
AppInit_DLLs: C:\ProgramData\Bamcof\Villa-Tough.dll => C:\ProgramData\Bamcof\Villa-Tough.dll [805376 2015-12-24] ()
AppInit_DLLs-x32: C:\ProgramData\Bamcof\TopFintop.dll => C:\ProgramData\Bamcof\TopFintop.dll [257536 2015-12-24] ()
IFEO\mbam.exe: [Debugger] tmgpcd.exe
IFEO\mbamgui.exe: [Debugger] bhijbz.exe
IFEO\MRT.exe: [Debugger] wwkhvtpjdmz.exe
IFEO\Mrtstub.exe: [Debugger] qiagxafwdpc.exe
IFEO\rstrui.exe: [Debugger] ddkkocrci.exe
IFEO\winmgr108.exe: [Debugger] hcrjfdhlu.exe
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Hosts: 127.0.0.1 eame2blaze01.ea.com
Tcpip\Parameters: [DhcpNameServer] 202.53.8.8 123.176.37.66
Tcpip\..\Interfaces\{357B11DB-D51E-4481-9D7E-CA0B0FB782C7}: [DhcpNameServer] 202.53.8.8 123.176.37.66
Tcpip\..\Interfaces\{846ee342-7039-11de-9d20-806e6f6e6963}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{B6A3E41E-6E5D-4207-9A0B-9014D8BECE73}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{B6A3E41E-6E5D-4207-9A0B-9014D8BECE73}: [DhcpNameServer] 192.168.42.129
 
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.hao123.com/?tn=94493384_hao_pg
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyuWHlXdoVJWoFEHN5kiym7a7T7yT3A23zXqPLfWiy_kCkicJ67taPfzk7HaM5nkW0kgS8U35RRQOj9ILdnomltDtkD2U8rZWu0lDgSIEPzvJ9jTjAdm-a0tjDSgtmafyDZCrKLqme8RICbi1w,,&q={searchTerms}
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://%66%65%65%64.%73%6E%61%70%64%6F.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyuWHlXdoVJWoFEHN5kiym7a7T7yT3A23zXqPLfWiy_kCkicJ67taPfzk7HaM5nkW0kgS8U35RRQOj9IITsP3a5kZw2wacVGOgGLA6OOfXFnkcOcq8ruB0yE_UoAco3-9LMWQU2zR0aVbrfSQQ,,
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyuWHlXdoVJWoFEHN5kiym7a7T7yT3A23zXqPLfWiy_kCkicJ67taPfzk7HaM5nkW0kgS8U35RRQOj9ILdnomltDtkD2U8rZWu0lDgSIEPzvJ9jTjAdm-a0tjDSgtmafyDZCrKLqme8RICbi1w,,&q={searchTerms}
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\Software\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyuWHlXdoVJWoFEHN5kiym7a7T7yT3A23zXqPLfWiy_kCkicJ67taPfzk7HaM5nkW0kgS8U35RRQOj9ILdnomltDtkD2U8rZWu0lDgSIEPzvJ9jTjAdm-a0tjDSgtmafyDZCrKLqme8RICbi1w,,&q={searchTerms}
HKU\S-1-5-21-2659893166-2311542600-2123722465-1000\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://%66%65%65%64.%73%6E%61%70%64%6F.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyuWHlXdoVJWoFEHN5kiym7a7T7yT3A23zXqPLfWiy_kCkicJ67taPfzk7HaM5nkW0kgS8U35RRQOj9IITsP3a5kZw2wacVGOgGLA6OOfXFnkcOcq8ruB0yE_UoAco3-9LMWQU2zR0aVbrfSQQ,,
SearchScopes: HKLM -> DefaultScope {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = 
SearchScopes: HKLM-x32 -> DefaultScope {ielnksrch} URL = 
SearchScopes: HKLM-x32 -> ielnksrch URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyuWHlXdoVJWoFEHN5kiym7a7T7yT3A23zXqPLfWiy_kCkicJ67taPfzk7HaM5nkW0kgS8U35RRQOj9ILdnomltDtkD2U8rZWu0lDgSIEPzvJ9jTjAdm-a0tjDSgtmafyDZCrKLqme8RICbi1w,,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2659893166-2311542600-2123722465-1000 -> DefaultScope {ielnksrch} URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyuWHlXdoVJWoFEHN5kiym7a7T7yT3A23zXqPLfWiy_kCkicJ67taPfzk7HaM5nkW0kgS8U35RRQOj9ILdnomltDtkD2U8rZWu0lDgSIEPzvJ9jTjAdm-a0tjDSgtmafyDZCrKLqme8RICbi1w,,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2659893166-2311542600-2123722465-1000 -> {4EB53E0D-D019-4D88-8D50-B779D7012DFD} URL = hxxps://in.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=715483&p={searchTerms}
SearchScopes: HKU\S-1-5-21-2659893166-2311542600-2123722465-1000 -> {ielnksrch} URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyuWHlXdoVJWoFEHN5kiym7a7T7yT3A23zXqPLfWiy_kCkicJ67taPfzk7HaM5nkW0kgS8U35RRQOj9ILdnomltDtkD2U8rZWu0lDgSIEPzvJ9jTjAdm-a0tjDSgtmafyDZCrKLqme8RICbi1w,,&q={searchTerms}
BHO-x32: モヲモテアヲメサシ・イラーイ蠑 -> {50F4150A-48B2-417A-BE4C-C83F580FB904} -> C:\Program Files (x86)\Common Files\Tencent\QQPhoneManager\2.0.201.3198\npQQPhoneManagerExt.dll [2014-05-30] (腾讯公司)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2006-10-27] (Microsoft Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\ssv.dll [2015-12-18] (Oracle Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\jp2ssv.dll [2015-12-18] (Oracle Corporation)
Toolbar: HKU\S-1-5-21-2659893166-2311542600-2123722465-1000 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} -  No File
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-21] (Microsoft Corporation)
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
 
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_257.dll [2015-07-29] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll [2013-09-13] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_257.dll [2015-07-29] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll [2013-12-05] (Adobe Systems, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\dtplugin\npDeployJava1.dll [2015-12-18] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\plugin2\npjp2.dll [2015-12-18] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll [2013-09-13] ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-12-16] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-12-16] (NVIDIA Corporation)
FF Plugin-x32: @qq.com/npAndroidAssistant -> C:\Program Files (x86)\Common Files\Tencent\QQPhoneManager\2.0.201.3198\npQQPhoneManagerExt.dll [2014-05-30] (腾讯公司)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-01-31] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-01-31] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2013-12-21] (Adobe Systems Inc.)
 
Chrome: 
=======
CHR HomePage: Default -> hxxps://www.google.com/
CHR RestoreOnStartup: Default -> "hxxp://searchinterneat-a.akamaihd.net/h?eq=U0EeCFZVBB8SRggXcFwJVglFEhgXeF8PTA1HFQQOIgwNWBRBQ1dAJVgLVltCRwYFIk0FA1oDB0VXfV5bFElXTwhwJVxqBEoETUFQCExa"
CHR StartupUrls: Default -> "hxxps://www.google.com/"
CHR Profile: C:\Users\ACM\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\ACM\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-25]
CHR Extension: (Google Search) - C:\Users\ACM\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-28]
CHR Extension: (FBDown Video Downloader) - C:\Users\ACM\AppData\Local\Google\Chrome\User Data\Default\Extensions\fhplmmllnpjjlncfjpbbpjadoeijkogc [2016-02-07]
CHR Extension: (AdBlock) - C:\Users\ACM\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-02-19]
CHR Extension: (Drumpfinator) - C:\Users\ACM\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcimhbfpiofdihhdnofbdlhjcmjopilp [2016-03-03]
CHR Extension: (Google Dictionary (by Google)) - C:\Users\ACM\AppData\Local\Google\Chrome\User Data\Default\Extensions\mgijmajocgfcbeboacabfgobmjgjcoja [2016-02-25]
CHR Extension: (Chrome Web Store Payments) - C:\Users\ACM\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-31]
CHR Extension: (Gmail) - C:\Users\ACM\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-08-23]
CHR Extension: (Polaris) - C:\Users\ACM\AppData\Local\Polaris\Component [2015-11-29]
 
==================== Services (Whitelisted) ========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
"741b0108ce7bd861" => service could not be unlocked. <===== ATTENTION
 
R2 Bamcof; C:\ProgramData\\Bamcof\\Bamcof.exe [466944 2015-11-29] () [File not signed]
S3 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [437880 2015-10-08] (BlueStack Systems, Inc.)
R2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [417400 2015-10-08] (BlueStack Systems, Inc.)
R2 BstHdUpdaterSvc; C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe [855672 2015-10-08] (BlueStack Systems, Inc.)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1163200 2016-01-12] (NVIDIA Corporation)
R2 IceDragonUpdater; C:\Program Files (x86)\Comodo\IceDragon\icedragon_updater.exe [1971888 2015-12-02] ()
R2 ihpmServer; C:\Program Files (x86)\RayDld\ihpmServer.exe [264944 2016-02-03] (RayDl)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1879488 2016-01-12] (NVIDIA Corporation)
R3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [6308288 2016-01-12] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [4812736 2016-01-12] (NVIDIA Corporation)
S3 scan; C:\Program Files (x86)\ParetoLogic\RegCure Pro\scan.dll [602456 2016-01-20] (Bitdefender)
S2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [1042304 2016-03-06] (Enigma Software Group USA, LLC.)
R2 syshost32; C:\Windows\Installer\{9341DEB5-87B8-4DE4-2753-9CAE073A9F2A}\syshost.exe [164352 2016-01-18] () [File not signed]
U4 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [536346624 2016-02-14] () [File not signed]
S2 QQPCRTP; "C:\Program Files (x86)\Tencent\QQPCMgr\10.10.16444.223\QQPCRtp.exe" -r [X]
 
===================== Drivers (Whitelisted) ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
U5 741b0108ce7bd861; C:\Windows\System32\Drivers\741b0108ce7bd861.sys [94144 2016-01-18] () <===== ATTENTION Necurs Rootkit?
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [312480 2016-02-02] ()
R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [146040 2015-10-08] (BlueStack Systems)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-11] (Broadcom Corporation)
S3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [15920 2016-03-06] (Enigma Software Group USA, LLC.)
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2016-03-06] ()
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43168 2016-02-02] ()
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19576 2015-12-09] (NVIDIA Corporation)
S3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [47760 2015-12-18] (NVIDIA Corporation)
S3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [452040 2016-01-20] (BitDefender S.R.L.)
S3 TSSKX64; C:\Windows\System32\drivers\tsskx64.sys [38200 2015-11-29] () [File not signed]
S3 TsUsbFlt; C:\Windows\System32\drivers\tsusbflt.sys [59392 2010-11-21] () [File not signed]
S3 TsUsbGD; C:\Windows\system32\drivers\TsUsbGD.sys [31232 2010-11-21] () [File not signed]
S3 tunnel; C:\Windows\System32\DRIVERS\tunnel.sys [125440 2010-11-21] () [File not signed]
S3 uagp35; C:\Windows\system32\drivers\uagp35.sys [64080 2009-07-14] () [File not signed]
R4 udfs; C:\Windows\System32\DRIVERS\udfs.sys [328192 2010-11-21] () [File not signed]
S3 uliagpkx; C:\Windows\system32\drivers\uliagpkx.sys [64592 2009-07-14] () [File not signed]
R3 umbus; C:\Windows\System32\DRIVERS\umbus.sys [48640 2010-11-21] () [File not signed]
S3 UmPass; C:\Windows\system32\drivers\umpass.sys [9728 2009-07-14] () [File not signed]
R3 usbccgp; C:\Windows\System32\DRIVERS\usbccgp.sys [98816 2010-11-21] () [File not signed]
S3 usbcir; C:\Windows\system32\drivers\usbcir.sys [100352 2009-07-14] () [File not signed]
R3 usbehci; C:\Windows\System32\DRIVERS\usbehci.sys [52224 2010-11-21] () [File not signed]
R3 usbhub; C:\Windows\System32\DRIVERS\usbhub.sys [343040 2010-11-21] () [File not signed]
S3 usbohci; C:\Windows\system32\drivers\usbohci.sys [25600 2009-07-14] () [File not signed]
S3 usbprint; C:\Windows\system32\drivers\usbprint.sys [25088 2009-07-14] () [File not signed]
R3 USBSTOR; C:\Windows\System32\DRIVERS\USBSTOR.SYS [91648 2010-11-21] () [File not signed]
R3 usbuhci; C:\Windows\System32\DRIVERS\usbuhci.sys [30720 2009-07-14] () [File not signed]
S3 usb_rndisx; C:\Windows\System32\DRIVERS\usb8023x.sys [19968 2009-07-14] () [File not signed]
R0 vdrvroot; C:\Windows\System32\drivers\vdrvroot.sys [36432 2009-07-14] () [File not signed]
S3 vga; C:\Windows\System32\DRIVERS\vgapnp.sys [29184 2009-07-14] () [File not signed]
R1 VgaSave; C:\Windows\System32\drivers\vga.sys [29184 2009-07-14] () [File not signed]
S3 vhdmp; C:\Windows\system32\drivers\vhdmp.sys [215936 2010-11-21] () [File not signed]
S3 viaide; C:\Windows\system32\drivers\viaide.sys [17488 2009-07-14] () [File not signed]
S3 vmbus; C:\Windows\system32\drivers\vmbus.sys [199552 2010-11-21] () [File not signed]
S3 VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [21760 2010-11-21] () [File not signed]
R0 volmgr; C:\Windows\System32\drivers\volmgr.sys [71552 2010-11-21] () [File not signed]
R0 volmgrx; C:\Windows\System32\drivers\volmgrx.sys [363392 2010-11-21] () [File not signed]
R0 volsnap; C:\Windows\System32\drivers\volsnap.sys [295808 2010-11-21] () [File not signed]
S3 vsmraid; C:\Windows\system32\drivers\vsmraid.sys [161872 2009-07-14] () [File not signed]
S3 vwifibus; C:\Windows\System32\drivers\vwifibus.sys [24576 2009-07-14] () [File not signed]
S3 WacomPen; C:\Windows\system32\drivers\wacompen.sys [27776 2009-07-14] () [File not signed]
S3 WANARP; C:\Windows\System32\DRIVERS\wanarp.sys [88576 2010-11-21] () [File not signed]
R1 Wanarpv6; C:\Windows\System32\DRIVERS\wanarp.sys [88576 2010-11-21] () [File not signed]
S3 Wd; C:\Windows\system32\drivers\wd.sys [21056 2009-07-14] () [File not signed]
R0 Wdf01000; C:\Windows\System32\drivers\Wdf01000.sys [654928 2009-07-14] () [File not signed]
R1 WfpLwf; C:\Windows\System32\DRIVERS\wfplwf.sys [12800 2009-07-14] () [File not signed]
S3 WIMMount; C:\Windows\System32\drivers\wimmount.sys [22096 2009-07-14] () [File not signed]
U5 741b0108ce7bd861;  <===== ATTENTION: Locked Service
S1 QMUdisk; \??\C:\Program Files (x86)\Tencent\QQPCMgr\10.10.16444.223\QMUdisk64.sys [X]
S1 softaal; \??\C:\Program Files (x86)\Tencent\QQPCMgr\11.1.16908.217\softaal64.sys [X]
S2 TORO; \SystemRoot\System32\drivers\Dallas.SYS [X]
S1 TsDefenseBt; \??\C:\Program Files (x86)\Tencent\QQPCMgr\10.10.16444.223\TsDefenseBT64.sys [X]
S2 {09BB444F-B2E2-4009-BAF2-7B727681223E}; \??\C:\Program Files (x86)\VMLaunch\BuddyVM.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2016-03-08 17:06 - 2016-03-08 17:06 - 00000000 ____D C:\Users\ACM\AppData\LocalLow\SUPERHOT_Team
2016-03-08 17:06 - 2016-03-08 17:06 - 00000000 ____D C:\Users\ACM\AppData\Local\SUPERHOT_Sp_z_o.o
2016-03-08 16:55 - 2016-03-08 16:55 - 00000000 ____D C:\Users\ACM\AppData\LocalLow\SUPERHOT Team
2016-03-08 16:55 - 2016-03-08 16:55 - 00000000 ____D C:\GOG Games
2016-03-06 13:57 - 2016-03-06 13:57 - 00000000 _____ C:\autoexec.bat
2016-03-06 13:56 - 2016-03-06 13:56 - 00003314 _____ C:\Windows\System32\Tasks\SpyHunter4Startup
2016-03-06 13:56 - 2016-03-06 13:56 - 00001087 _____ C:\Users\ACM\Desktop\SpyHunter.lnk
2016-03-06 13:56 - 2016-03-06 13:56 - 00000000 ____D C:\Users\ACM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2016-03-06 13:56 - 2016-03-06 13:56 - 00000000 ____D C:\Users\ACM\AppData\Roaming\Enigma Software Group
2016-03-06 13:51 - 2016-03-06 13:56 - 00000000 ____D C:\sh4ldr
2016-03-06 13:12 - 2016-03-06 13:12 - 00022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys
2016-03-06 13:02 - 2016-03-06 13:02 - 00000000 ____D C:\Program Files\Enigma Software Group
2016-03-06 12:53 - 2016-03-06 12:58 - 03286400 _____ (Enigma Software Group USA, LLC.) C:\Users\ACM\Downloads\SpyHunter-Installer.exe
2016-03-06 12:24 - 2016-03-06 12:26 - 00058973 _____ C:\Users\ACM\Downloads\Addition.txt
2016-03-06 12:22 - 2016-03-09 11:51 - 00034640 _____ C:\Users\ACM\Downloads\FRST.txt
2016-03-06 12:22 - 2016-03-09 11:50 - 00000000 ____D C:\FRST
2016-03-06 12:21 - 2016-03-06 12:22 - 02374144 _____ (Farbar) C:\Users\ACM\Downloads\FRST64.exe
2016-03-06 02:39 - 2016-03-06 02:39 - 00002992 _____ C:\Windows\System32\Tasks\{FEE193E1-28A2-456F-B937-073579A395AD}
2016-03-06 02:09 - 2016-03-06 02:09 - 00000000 ____D C:\Users\ACM\AppData\Local\Steam
2016-03-06 01:35 - 2016-03-06 12:43 - 00000000 ____D C:\Program Files (x86)\Steam
2016-03-06 01:35 - 2016-03-06 01:35 - 00000967 _____ C:\Users\Public\Desktop\Steam.lnk
2016-03-06 01:35 - 2016-03-06 01:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2016-03-06 01:33 - 2016-03-06 01:33 - 01380712 _____ C:\Users\ACM\Downloads\SteamSetup.exe
2016-03-06 01:09 - 2016-03-08 18:00 - 00000464 _____ C:\Windows\Tasks\ParetoLogic Registration3.job
2016-03-06 01:09 - 2016-03-06 01:09 - 00003124 _____ C:\Windows\System32\Tasks\ParetoLogic Registration3
2016-03-06 01:09 - 2016-03-06 01:09 - 00001194 _____ C:\Users\ACM\Desktop\RegCure Pro.lnk
2016-03-06 01:09 - 2016-03-06 01:09 - 00000000 ____D C:\Users\ACM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ParetoLogic
2016-03-06 01:04 - 2016-03-06 01:08 - 08552776 _____ (ParetoLogic, Inc.) C:\Users\ACM\Downloads\RegCureProSetup_310417D7-488F-41E6-8681-FA7676BC49F3_.exe
2016-03-06 00:47 - 2016-03-08 17:12 - 00000000 ____D C:\Users\ACM\AppData\LocalLow\uTorrent
2016-03-05 23:42 - 2016-03-06 01:09 - 00000000 ____D C:\ProgramData\ParetoLogic
2016-03-05 23:42 - 2016-03-05 23:42 - 00000000 ____D C:\Users\ACM\AppData\Roaming\ParetoLogic
2016-03-05 23:42 - 2016-03-05 23:42 - 00000000 ____D C:\Program Files (x86)\ParetoLogic
2016-03-05 23:39 - 2016-03-05 23:40 - 08552776 _____ (ParetoLogic, Inc.) C:\Users\ACM\Downloads\RegCureProSetup_A12B8BC5-061B-4219-A38C-FA15C3908FC3_.exe
2016-03-05 23:34 - 2016-03-05 23:34 - 00003298 _____ C:\Windows\System32\Tasks\{51CCCAA4-97E2-4C51-9B3A-1100A29602D9}
2016-03-05 17:42 - 2016-03-05 17:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Beat Blades Haruka
2016-03-05 17:40 - 2016-03-05 17:44 - 00000000 ____D C:\Program Files (x86)\Beat Blades Haruka
2016-03-03 20:37 - 2016-03-03 20:37 - 03878112 _____ (Husdawg, LLC) C:\Users\ACM\Downloads\Detection (3).exe
2016-03-03 20:34 - 2016-03-03 20:35 - 03878112 _____ (Husdawg, LLC) C:\Users\ACM\Downloads\Detection (2).exe
2016-03-03 18:43 - 2016-03-03 18:43 - 00000000 ____D C:\Users\ACM\AppData\Local\CEF
2016-03-03 15:39 - 2016-03-03 15:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Galactic Civilizations III Mercenaries
2016-03-02 19:52 - 2016-03-02 19:52 - 00001273 _____ C:\Users\ACM\Desktop\MassEffect - Shortcut.lnk
2016-03-02 03:00 - 2015-12-18 11:41 - 00047760 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2016-03-02 03:00 - 2015-12-18 11:40 - 00099472 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
2016-03-02 03:00 - 2015-12-18 11:40 - 00090768 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2016-03-01 22:32 - 2016-03-01 22:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XCOM 2
2016-02-25 13:33 - 2016-02-25 13:33 - 00003392 _____ C:\Windows\System32\Tasks\{48322287-BF48-4870-8EF6-DF1864B08E0F}
2016-02-23 03:02 - 2016-02-23 03:02 - 00000000 ____D C:\Users\ACM\AppData\Roaming\Zeno.saga1
2016-02-22 19:43 - 2016-02-22 19:43 - 00000000 ____D C:\ProgramData\Electronic Arts
2016-02-22 19:16 - 2016-02-22 19:16 - 00000783 _____ C:\Users\Public\Desktop\Mass Effect.lnk
2016-02-22 19:16 - 2016-02-22 19:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mass Effect
2016-02-22 19:16 - 2016-02-22 19:16 - 00000000 ____D C:\ProgramData\Media Center Programs
2016-02-21 21:38 - 2016-02-21 21:38 - 00000000 ____D C:\Users\ACM\AppData\Roaming\TheBannerSaga
2016-02-21 21:37 - 2016-02-21 21:37 - 00000000 ____D C:\Users\ACM\AppData\Roaming\The Banner Saga
2016-02-21 16:39 - 2016-02-21 16:39 - 00000000 ____D C:\Users\ACM\Documents\DyingLight
2016-02-21 15:11 - 2016-02-21 15:11 - 00000657 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dying Light.lnk
2016-02-19 23:04 - 2016-02-19 23:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mass Effect 2
2016-02-16 18:15 - 2016-02-16 18:16 - 02570412 _____ C:\Users\ACM\Downloads\12690840_193095524379086_1732209986_n.mp4
2016-02-15 17:54 - 2016-02-15 17:54 - 00000000 ____D C:\Users\ACM\AppData\Local\SoD_Save
2016-02-15 15:46 - 2016-02-15 15:46 - 00001981 _____ C:\Users\ACM\Desktop\State of Decay Save Manager - Shortcut.lnk
2016-02-15 15:45 - 2016-02-15 15:45 - 00000000 ____D C:\Program Files (x86)\SoD Community
2016-02-15 14:11 - 2016-02-15 14:11 - 00386048 _____ () C:\Users\ACM\AppData\Local\Dallas.sys
2016-02-15 14:11 - 2016-02-15 14:11 - 00057344 _____ C:\Users\ACM\AppData\Local\wdreg.exe
2016-02-15 14:11 - 2016-02-15 14:11 - 00000212 _____ C:\Users\ACM\AppData\Local\TORO.Dallas
2016-02-15 13:52 - 2016-02-15 14:11 - 00386048 _____ () C:\Windows\SysWOW64\Drivers\Dallas.sys
2016-02-15 13:52 - 2016-02-15 14:11 - 00057344 _____ C:\Windows\SysWOW64\Drivers\wdreg.exe
2016-02-15 13:52 - 2016-02-15 14:11 - 00000212 _____ C:\Windows\SysWOW64\TORO.Dallas
2016-02-15 13:47 - 2016-02-15 13:47 - 00000000 ____D C:\Users\ACM\AppData\Roaming\OTI
2016-02-15 13:47 - 2016-02-15 13:47 - 00000000 ____D C:\Users\ACM\AppData\Local\ApplicationHistory
2016-02-15 13:39 - 2016-02-15 13:39 - 00000244 _____ C:\Windows\ODBC.INI
2016-02-15 13:38 - 2016-02-15 13:38 - 00001659 _____ C:\Users\Public\Desktop\ETAP 6.0.0.lnk
2016-02-15 13:38 - 2016-02-15 13:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ETAP 6.0.0
2016-02-15 13:35 - 2016-02-15 13:35 - 00000000 ____D C:\Program Files (x86)\Business Objects
2016-02-14 13:01 - 2016-02-14 13:01 - 00001136 _____ C:\Users\ACM\Desktop\State of Decay Year-One.lnk
2016-02-14 13:01 - 2016-02-14 13:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\State of Decay Year-One
2016-02-14 12:47 - 2016-02-15 15:48 - 00000000 ____D C:\Program Files (x86)\State of Decay Year-One
2016-02-08 14:26 - 2016-02-08 14:26 - 00000000 ____D C:\Users\ACM\Documents\ギャルプリンス
2016-02-08 14:24 - 2016-02-08 14:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ギャルプリンス
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2016-03-09 11:51 - 2015-07-29 01:11 - 00000000 ____D C:\Users\ACM\AppData\Roaming\uTorrent
2016-03-09 11:50 - 2015-11-28 10:32 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-03-09 11:50 - 2015-11-27 23:45 - 00000338 ____H C:\Windows\Tasks\MMNJFQAOLDJBKOYG.job
2016-03-09 11:19 - 2015-11-29 14:02 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-03-09 09:29 - 2015-07-31 17:27 - 00000000 ____D C:\Users\ACM\AppData\LocalLow\Temp
2016-03-08 18:19 - 2015-11-29 14:02 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-03-08 17:05 - 2016-02-06 14:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com
2016-03-08 17:05 - 2009-07-14 11:02 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2016-03-07 04:35 - 2015-08-01 12:02 - 00000000 ____D C:\Users\ACM\AppData\Roaming\vlc
2016-03-07 04:14 - 2015-09-02 20:25 - 00000000 ____D C:\Users\ACM\AppData\Roaming\RenPy
2016-03-06 18:23 - 2016-01-10 16:48 - 00000000 ____D C:\Users\ACM\AppData\Local\CrashDumps
2016-03-06 12:56 - 2009-07-14 10:15 - 00027680 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-03-06 12:56 - 2009-07-14 10:15 - 00027680 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-03-06 12:53 - 2015-07-29 04:08 - 00003112 _____ C:\Windows\System32\Tasks\RDReminder
2016-03-06 12:41 - 2015-11-27 23:45 - 00000350 _____ C:\Windows\Tasks\WQWAHT1.job
2016-03-06 12:41 - 2015-07-29 01:38 - 00000000 ____D C:\ProgramData\NVIDIA
2016-03-06 12:41 - 2009-07-14 10:38 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-03-06 02:40 - 2015-08-08 14:41 - 00000000 ____D C:\Users\ACM\AppData\Local\ElevatedDiagnostics
2016-03-06 00:37 - 2016-01-09 18:26 - 00000000 ____D C:\Windows\SysWOW64\directx
2016-03-05 15:47 - 2015-07-29 04:08 - 00000288 _____ C:\Windows\Tasks\DLL-Files.Com Fixer_Updates.job
2016-03-02 15:48 - 2015-07-29 04:08 - 00000272 _____ C:\Windows\Tasks\DLL-Files.Com Fixer_MONTHLY.job
2016-03-02 03:31 - 2015-07-29 02:39 - 00000000 ____D C:\Users\ACM\AppData\Local\NVIDIA
2016-03-02 03:02 - 2009-07-14 08:50 - 00000000 ____D C:\Windows\inf
2016-03-02 03:01 - 2015-07-29 02:39 - 00001381 _____ C:\Users\Public\Desktop\GeForce Experience.lnk
2016-03-01 23:03 - 2015-12-11 18:25 - 00000000 ____D C:\Users\ACM\AppData\Roaming\FiraxisLive
2016-03-01 23:01 - 2015-08-25 21:40 - 00000000 ____D C:\Users\ACM\Documents\My Games
2016-03-01 21:55 - 2016-01-09 17:14 - 00000000 ____D C:\Games
2016-02-21 21:38 - 2015-08-30 23:43 - 00000000 ____D C:\Users\ACM\AppData\Local\SKIDROW
2016-02-21 21:37 - 2016-01-23 17:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\R.G. Mechanics
2016-02-20 09:56 - 2015-07-29 12:49 - 00000000 ____D C:\Users\ACM\Documents\KoeiTecmo
2016-02-20 04:22 - 2015-11-29 14:15 - 00002512 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-02-20 04:22 - 2015-11-29 14:15 - 00002483 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-02-16 15:31 - 2009-07-14 10:43 - 00794456 _____ C:\Windows\system32\PerfStringBackup.INI
2016-02-15 13:56 - 2009-07-14 10:15 - 00424080 _____ C:\Windows\system32\FNTCACHE.DAT
2016-02-15 13:47 - 2015-07-29 01:38 - 00110808 _____ C:\Users\ACM\AppData\Local\GDIPFONTCACHEV1.DAT
2016-02-15 13:40 - 2015-07-29 01:15 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2016-02-15 13:38 - 2009-07-14 08:04 - 00017486 _____ C:\Windows\system32\Drivers\etc\services
2016-02-13 00:47 - 2010-11-21 08:54 - 00120832 ___SH (Newzie) C:\ProgramData\msvvse.exe
2016-02-09 20:13 - 2009-07-14 08:50 - 00000000 ____D C:\Windows\system32\NDF
 
==================== Files in the root of some directories =======
 
2015-11-28 00:18 - 2015-11-28 00:18 - 3828689 _____ () C:\Program Files\Common Files\hyqp1tg2.exe
2015-11-30 00:14 - 2015-11-30 00:14 - 3828694 _____ () C:\Program Files\Common Files\yyh140q5.exe
2015-11-26 15:04 - 2015-11-28 18:10 - 9545216 _____ () C:\Users\ACM\AppData\Roaming\agent.dat
2015-11-26 15:04 - 2015-11-28 18:10 - 0060000 _____ () C:\Users\ACM\AppData\Roaming\Config.xml
2015-11-28 19:40 - 2015-11-28 19:40 - 0005120 _____ () C:\Users\ACM\AppData\Roaming\GiftBag.db
2015-11-26 23:10 - 2015-11-19 18:57 - 0000428 _____ () C:\Users\ACM\AppData\Roaming\ham.txt
2016-03-05 23:42 - 2016-03-06 01:09 - 0000053 _____ () C:\Users\ACM\AppData\Roaming\LogFile.txt
2015-11-26 15:04 - 2015-11-28 18:10 - 0017920 _____ () C:\Users\ACM\AppData\Roaming\Main.dat
2015-11-26 23:09 - 2015-11-26 23:09 - 0005568 _____ () C:\Users\ACM\AppData\Roaming\md.xml
2015-11-26 23:09 - 2015-11-26 23:09 - 0042496 _____ () C:\Users\ACM\AppData\Roaming\Moses.dat
2015-11-26 23:07 - 2015-11-28 18:10 - 0466944 _____ () C:\Users\ACM\AppData\Roaming\moses.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0151040 ___SH (Jetico, Inc.) C:\Users\ACM\AppData\Roaming\msccttum.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0151040 ___SH (Jetico, Inc.) C:\Users\ACM\AppData\Roaming\msemk.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0123392 ___SH () C:\Users\ACM\AppData\Roaming\msrlygqf.exe
2015-11-26 23:10 - 2015-11-19 18:56 - 0004134 _____ () C:\Users\ACM\AppData\Roaming\shem.jpg
2016-02-15 14:11 - 2016-02-15 14:11 - 0386048 _____ () C:\Users\ACM\AppData\Local\Dallas.sys
2015-11-28 19:28 - 2015-11-28 19:28 - 0000187 _____ () C:\Users\ACM\AppData\Local\donelectronics.exe.config
2015-11-27 23:08 - 2015-11-27 23:08 - 0000187 _____ () C:\Users\ACM\AppData\Local\Statlux.exe.config
2016-02-15 14:11 - 2016-02-15 14:11 - 0000212 _____ () C:\Users\ACM\AppData\Local\TORO.Dallas
2016-02-15 14:11 - 2016-02-15 14:11 - 0057344 _____ () C:\Users\ACM\AppData\Local\wdreg.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0264704 ___SH (Vortex Team) C:\ProgramData\msaganf.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0181248 ___SH (toyworld) C:\ProgramData\msaghnufc.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0181760 ___SH () C:\ProgramData\msairkcp.exe
2010-11-21 08:54 - 2016-01-18 07:31 - 0203264 ___SH () C:\ProgramData\msakmnkbs.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0181248 ___SH (toyworld) C:\ProgramData\msbjvfz.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0176640 ___SH () C:\ProgramData\msbninrx.exe
2010-11-21 08:54 - 2016-01-20 09:22 - 0134144 ___SH (Thomas Schweitzer) C:\ProgramData\msboxg.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0183808 ___SH (Mail.Ru) C:\ProgramData\msccttum.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0181248 ___SH () C:\ProgramData\mscooif.exe
2010-11-21 08:54 - 2016-01-18 07:31 - 0203264 ___SH () C:\ProgramData\msczqdlj.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0171520 ___SH (PortableApps.com) C:\ProgramData\msdhqy.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0267264 ___SH (Sun Microsystems, Inc.) C:\ProgramData\mseefx.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0183808 ___SH (Mail.Ru) C:\ProgramData\msemk.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0267264 ___SH (Sun Microsystems, Inc.) C:\ProgramData\mseuoiopr.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0264704 ___SH (Vortex Team) C:\ProgramData\msflew.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0114688 ___SH () C:\ProgramData\msfzsknrj.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0117248 ___SH (The Wireshark developer community, http://www.wireshark.org/)C:\ProgramData\msgiuzrbd.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0229376 ___SH (Nullsoft, Inc.) C:\ProgramData\mshbwrif.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0171520 ___SH (PortableApps.com) C:\ProgramData\mshixbtiv.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0184832 ___SH (maymun) C:\ProgramData\msikguvy.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0210944 ___SH () C:\ProgramData\msjkvdc.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0264704 ___SH (Vortex Team) C:\ProgramData\msjxmqvoj.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0176640 ___SH () C:\ProgramData\msldiao.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0181248 ___SH (toyworld) C:\ProgramData\mslgpfkph.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0229376 ___SH (Nullsoft, Inc.) C:\ProgramData\mslstxiru.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0210432 ___SH () C:\ProgramData\msnjnyoej.exe
2010-11-21 08:54 - 2016-01-18 07:31 - 0203264 ___SH () C:\ProgramData\msoud.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0176128 ___SH () C:\ProgramData\mspqgbd.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0267264 ___SH (Sun Microsystems, Inc.) C:\ProgramData\mspqjo.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0134144 ___SH (Thomas Schweitzer) C:\ProgramData\msqkfg.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0181760 ___SH () C:\ProgramData\msqrsz.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0195072 ___SH () C:\ProgramData\msrhuiuu.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0176640 ___SH () C:\ProgramData\msrifcj.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0171520 ___SH (PortableApps.com) C:\ProgramData\msrlygqf.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0210944 ___SH () C:\ProgramData\msrpss.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0229376 ___SH (Nullsoft, Inc.) C:\ProgramData\msrucaz.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0264704 ___SH (Vortex Team) C:\ProgramData\msrzu.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0264704 ___SH (Vortex Team) C:\ProgramData\mssas.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0181248 ___SH (toyworld) C:\ProgramData\msswzht.exe
2010-11-21 08:54 - 2016-01-18 07:31 - 0203264 ___SH () C:\ProgramData\mstmc.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0182272 ___SH (toyworld) C:\ProgramData\mstpsvjv.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0237056 ___SH () C:\ProgramData\msuep.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0171520 ___SH (PortableApps.com) C:\ProgramData\msufsco.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0181760 ___SH () C:\ProgramData\msuiqzes.exe
2010-11-21 08:54 - 2016-01-21 14:01 - 0235520 ___SH () C:\ProgramData\msuprysxc.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0267264 ___SH (Sun Microsystems, Inc.) C:\ProgramData\msvgoy.exe
2010-11-21 08:54 - 2016-01-18 07:31 - 0203264 ___SH () C:\ProgramData\msvimlzq.exe
2010-11-21 08:54 - 2016-02-13 00:47 - 0120832 ___SH (Newzie) C:\ProgramData\msvvse.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0210944 ___SH () C:\ProgramData\mswkaldj.exe
2010-11-21 08:54 - 2010-11-21 08:54 - 0264704 ___SH (Vortex Team) C:\ProgramData\msxnkvlkk.exe
2015-09-02 00:44 - 2015-11-29 02:17 - 0000098 _____ () C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
 
Files to move or delete:
====================
C:\ProgramData\msaganf.exe
C:\ProgramData\msaghnufc.exe
C:\ProgramData\msairkcp.exe
C:\ProgramData\msakmnkbs.exe
C:\ProgramData\msbjvfz.exe
C:\ProgramData\msbninrx.exe
C:\ProgramData\msboxg.exe
C:\ProgramData\msccttum.exe
C:\ProgramData\mscooif.exe
C:\ProgramData\msczqdlj.exe
C:\ProgramData\msdhqy.exe
C:\ProgramData\mseefx.exe
C:\ProgramData\msemk.exe
C:\ProgramData\mseuoiopr.exe
C:\ProgramData\msflew.exe
C:\ProgramData\msfzsknrj.exe
C:\ProgramData\msgiuzrbd.exe
C:\ProgramData\mshbwrif.exe
C:\ProgramData\mshixbtiv.exe
C:\ProgramData\msikguvy.exe
C:\ProgramData\msjkvdc.exe
C:\ProgramData\msjxmqvoj.exe
C:\ProgramData\msldiao.exe
C:\ProgramData\mslgpfkph.exe
C:\ProgramData\mslstxiru.exe
C:\ProgramData\msnjnyoej.exe
C:\ProgramData\msoud.exe
C:\ProgramData\mspqgbd.exe
C:\ProgramData\mspqjo.exe
C:\ProgramData\msqkfg.exe
C:\ProgramData\msqrsz.exe
C:\ProgramData\msrhuiuu.exe
C:\ProgramData\msrifcj.exe
C:\ProgramData\msrlygqf.exe
C:\ProgramData\msrpss.exe
C:\ProgramData\msrucaz.exe
C:\ProgramData\msrzu.exe
C:\ProgramData\mssas.exe
C:\ProgramData\msswzht.exe
C:\ProgramData\mstmc.exe
C:\ProgramData\mstpsvjv.exe
C:\ProgramData\msuep.exe
C:\ProgramData\msufsco.exe
C:\ProgramData\msuiqzes.exe
C:\ProgramData\msuprysxc.exe
C:\ProgramData\msvgoy.exe
C:\ProgramData\msvimlzq.exe
C:\ProgramData\msvvse.exe
C:\ProgramData\mswkaldj.exe
C:\ProgramData\msxnkvlkk.exe
C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
 
 
Some files in TEMP:
====================
C:\Users\ACM\AppData\Local\Temp\57975w13s7qyk7s_1.exe
C:\Users\ACM\AppData\Local\Temp\595ca1m7797.exe
C:\Users\ACM\AppData\Local\Temp\is3mkycwowky37.exe
C:\Users\ACM\AppData\Local\Temp\KB00874541.exe
C:\Users\ACM\AppData\Local\Temp\KB00880126.exe
C:\Users\ACM\AppData\Local\Temp\KB00891311.exe
C:\Users\ACM\AppData\Local\Temp\KB00892622.exe
C:\Users\ACM\AppData\Local\Temp\KB00893916.exe
C:\Users\ACM\AppData\Local\Temp\KB00902496.exe
C:\Users\ACM\AppData\Local\Temp\KB00908409.exe
C:\Users\ACM\AppData\Local\Temp\KB00950467.exe
C:\Users\ACM\AppData\Local\Temp\KB00951372.exe
C:\Users\ACM\AppData\Local\Temp\KB00960747.exe
C:\Users\ACM\AppData\Local\Temp\KB01052179.exe
C:\Users\ACM\AppData\Local\Temp\KB01052460.exe
C:\Users\ACM\AppData\Local\Temp\KB109106319.exe
C:\Users\ACM\AppData\Local\Temp\KB109116740.exe
C:\Users\ACM\AppData\Local\Temp\KB109218000.exe
C:\Users\ACM\AppData\Local\Temp\KB109227454.exe
C:\Users\ACM\AppData\Local\Temp\KB109287639.exe
C:\Users\ACM\AppData\Local\Temp\KB109298325.exe
C:\Users\ACM\AppData\Local\Temp\KB109490284.exe
C:\Users\ACM\AppData\Local\Temp\KB109530298.exe
C:\Users\ACM\AppData\Local\Temp\KB263943801.exe
C:\Users\ACM\AppData\Local\Temp\KB29285864.exe
C:\Users\ACM\AppData\Local\Temp\KB29306769.exe
C:\Users\ACM\AppData\Local\Temp\KB293108437.exe
C:\Users\ACM\AppData\Local\Temp\KB29326830.exe
C:\Users\ACM\AppData\Local\Temp\KB29356392.exe
C:\Users\ACM\AppData\Local\Temp\KB293717356.exe
C:\Users\ACM\AppData\Local\Temp\KB29386984.exe
C:\Users\ACM\AppData\Local\Temp\KB29490397.exe
C:\Users\ACM\AppData\Local\Temp\KB29561050.exe
C:\Users\ACM\AppData\Local\Temp\KB347154594.exe
C:\Users\ACM\AppData\Local\Temp\KB386507359.exe
C:\Users\ACM\AppData\Local\Temp\KB399970698.exe
C:\Users\ACM\AppData\Local\Temp\KB432979823.exe
C:\Users\ACM\AppData\Local\Temp\KB482460672.exe
C:\Users\ACM\AppData\Local\Temp\KB83287014.exe
C:\Users\ACM\AppData\Local\Temp\uqoisqowweau.exe
C:\Users\ACM\AppData\Local\Temp\_is8C98.exe
C:\Users\ACM\AppData\Local\Temp\_is9C51.exe
 
 
==================== Bamital & volsnap =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll
[2010-11-21 08:54] - [2010-11-21 08:54] - 0357888 ____A (Microsoft Corporation) 52C6BCE4E3EF07B2F002C65C5EE9B64F
 
C:\Windows\SysWOW64\dnsapi.dll
[2010-11-21 08:54] - [2010-11-21 08:54] - 0270336 ____A (Microsoft Corporation) DBA22B75246D9B29F7A88E0C9F5D55A2
 
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 
 
testsigning: ==> 'testsigning' is set. Check for possible unsigned driver <===== ATTENTION
 
 
LastRegBack: 2016-03-09 01:11
 
==================== End of FRST.txt ============================

Attached Thumbnails

  • prob.JPG

  • 0

Advertisements


#2
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,007 posts
  • MVP
Looks like you have multiple infections and a rootkit.
 
 
Download the attached fixlist.txt to the same location as FRST
 
 
Run FRST and press Fix
A fix log will be generated please post that 
 
 
Use IE and go to http://eset.com/onlinescan and click on ESET online Scanner.  Accept the terms then press Start (If you get a warning from your browser tell it you want to run it).  
 
# Check Scan Archives
# Push the Start button.
# ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
# When the scan completes, push LIST OF THREATS FOUND
# Push EXPORT TO TEXT FILE , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
# Push the BACK button.
# Push Finish
# Once the scan is completed, you may close the window.
# Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
# Copy and paste that log as a reply.
 
 
Run FRST again and check the Addition.txt box before hitting SCAN.  You will get two logs.  Post them both.
 
 
 

  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP