Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Chrome Browser infected

Started by Django2009 , Jun 30 2017 03:46 PM

  • Please log in to reply

#16
RKinner
Posted 02 July 2017 - 04:18 PM

RKinner

    Malware Expert

  • Expert
  • 24,625 posts
  • MVP

Still looking for the FRST.txt file.


  • 0

Advertisements

#17
Django2009
Posted 03 July 2017 - 05:22 AM

Django2009

    Member

  • Topic Starter
  • Member
  • PipPip
  • 56 posts
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 02-07-2017
Ran by User (administrator) on USER-PC (03-07-2017 12:09:31)
Running from C:\Users\User\Downloads
Loaded Profiles: User (Available Profiles: User)
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.33.5\GoogleCrashHandler.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\RPDS\Bin\rpdsvc.exe
(DEVGURU Co., LTD.) C:\Program Files\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe
(AVAST Software s.r.o.) C:\Program Files\AVAST Software\Avast\aswidsagent.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Google Inc.) C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [213832 2017-06-26] (AVAST Software)
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-3088101763-2072606618-2741787397-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:52874;https=127.0.0.1:52874
AutoConfigURL: [.DEFAULT] => http=127.0.0.1:52874;https=127.0.0.1:52874
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704 2011-08-31] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{84134957-FE4A-4422-A37C-E142E6B0BA2E}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://uk.yahoo.com/?fr=hp-avast&type=avastbcl
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files\Real\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2016-11-11] (RealDownloader)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_131\bin\ssv.dll [2017-05-08] (Oracle Corporation)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-24] (Google Inc.)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_131\bin\jp2ssv.dll [2017-05-08] (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-24] (Google Inc.)
Toolbar: HKU\.DEFAULT -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-24] (Google Inc.)
Toolbar: HKU\S-1-5-21-3088101763-2072606618-2741787397-1000 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-24] (Google Inc.)
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll [2009-02-26] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\rq6fi83i.default-1476290873126 [2017-07-03]
FF Homepage: Mozilla\Firefox\Profiles\rq6fi83i.default-1476290873126 -> hxxp://www.google.co.uk/
FF Extension: (Grammarly for Firefox) - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\rq6fi83i.default-1476290873126\Extensions\[email protected] [2017-06-22]
FF Extension: (Video DownloadHelper) - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\rq6fi83i.default-1476290873126\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2017-05-09]
FF Extension: (Adblock Plus) - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\rq6fi83i.default-1476290873126\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2017-06-08]
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext => not found
FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\ProgramData\iSkysoft\Video Converter Ultimate\[email protected]
FF Extension: (iSkysoft Video Converter Ultimate) - C:\ProgramData\iSkysoft\Video Converter Ultimate\[email protected] [2016-12-21] [not signed]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_26_0_0_131.dll [2017-06-16] ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1229199.dll [2017-03-31] (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2014-05-06] ()
FF Plugin: @java.com/DTPlugin,version=11.131.2 -> C:\Program Files\Java\jre1.8.0_131\bin\dtplugin\npDeployJava1.dll [2017-05-08] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.131.2 -> C:\Program Files\Java\jre1.8.0_131\bin\plugin2\npjp2.dll [2017-05-08] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=18.1.6.161 -> C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll [2017-01-15] (RealNetworks, Inc.)
FF Plugin: @real.com/nprpplugin;version=18.1.6.161 -> C:\Program Files\Real\RealPlayer\Netscape6\nprpplugin.dll [2017-01-15] (RealPlayer)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-04-05] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3088101763-2072606618-2741787397-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\User\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-06-08] (Unity Technologies ApS)

Chrome:
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> hxxp://www.igoogle.com/
CHR DefaultSearchURL: Default -> hxxps://search.yahoo.com/search?p={searchTerms}&fr=yset_chr_cnewtab&type=default
CHR DefaultSearchKeyword: Default -> Yahoo
CHR DefaultSuggestURL: Default -> hxxps://search.yahoo.com/sugg/ie?output=fxjson&command={searchTerms}&nResults=10
CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default [2017-07-02]
CHR Extension: (Yahoo Partner) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjicifbhnpakmaekfnphojjehhnifkmc [2017-07-02]
CHR Extension: (Adblock Plus) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2017-07-02]
CHR Extension: (Adobe Acrobat) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2017-07-02]
CHR Extension: (Avast SafePrice) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2017-07-02]
CHR Extension: (Unlimited Free VPN - Hola) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio [2017-07-02]
CHR Extension: (Fiery Music) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnmfeiddljnkcdgcfcfhpenipgmaocon [2017-07-02]
CHR Extension: (Chrome Web Store Payments) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-07-02]
CHR Extension: (iSkysoft Video Converter Ultimate) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nomnoaehhnmbolpapbjeopogjfefdpnl [2017-07-02]
CHR Extension: (Chrome Media Router) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-07-02]
CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\System Profile [2015-12-08]
CHR Extension: (Google Slides) - C:\Users\User\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-05-26]
CHR Extension: (Google Docs) - C:\Users\User\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\aohghmighlieiainnegkcijnfilokake [2015-05-26]
CHR Extension: (Google Drive) - C:\Users\User\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-05-26]
CHR Extension: (YouTube) - C:\Users\User\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-05-26]
CHR Extension: (Google Search) - C:\Users\User\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-05-26]
CHR Extension: (Google Sheets) - C:\Users\User\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-05-26]
CHR Extension: (Bookmark Manager) - C:\Users\User\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-05-26]
CHR Extension: (Avast Online Security) - C:\Users\User\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-05-26]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\User\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-05-26]
CHR Extension: (Google Wallet) - C:\Users\User\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-05-26]
CHR Extension: (Gmail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-05-26]
CHR HKLM\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <not found>
CHR HKLM\...\Chrome\Extension: [nomnoaehhnmbolpapbjeopogjfefdpnl] - C:\ProgramData\iSkysoft\Video Converter Ultimate\[email protected] [2016-12-21]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\aswidsagent.exe [5815840 2017-06-26] (AVAST Software s.r.o.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [263312 2017-06-26] (AVAST Software)
S3 NAUpdate; C:\Program Files\Nero\Update\NASvc.exe [762192 2013-07-18] (Nero AG)
S3 RealPlayerUpdateSvc; C:\Program Files\Real\UpdateService\RealPlayerUpdateSvc.exe [35104 2016-11-11] ()
R2 RealTimes Desktop Service; C:\Program Files\Real\RealPlayer\RPDS\Bin\rpdsvc.exe [987408 2017-01-15] (RealNetworks, Inc.)
S3 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [167936 2005-08-08] () [File not signed]
R2 ss_conn_service; C:\Program Files\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [754784 2016-07-22] (DEVGURU Co., LTD.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 aswbidsdriver; C:\Windows\system32\drivers\aswbidsdriverx.sys [266976 2017-06-26] (AVAST Software s.r.o.)
R0 aswbidsh; C:\Windows\system32\drivers\aswbidshx.sys [157384 2017-06-26] (AVAST Software s.r.o.)
R0 aswblog; C:\Windows\system32\drivers\aswblogx.sys [276704 2017-06-26] (AVAST Software s.r.o.)
R0 aswbuniv; C:\Windows\system32\drivers\aswbunivx.sys [50352 2017-06-26] (AVAST Software s.r.o.)
S3 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [42824 2017-06-26] (AVAST Software)
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [39752 2017-06-26] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [123896 2017-06-26] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [99536 2017-06-26] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\drivers\aswRvrt.sys [70840 2017-06-26] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [774288 2017-06-26] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [496976 2017-06-26] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [147688 2017-06-26] (AVAST Software)
R0 aswVmm; C:\Windows\system32\drivers\aswVmm.sys [296312 2017-06-30] (AVAST Software)
S3 dg_ssudbus; C:\Windows\System32\DRIVERS\ssudbus.sys [109456 2017-05-18] (Samsung Electronics Co., Ltd.)
R1 HWiNFO32; C:\Windows\system32\drivers\HWiNFO32.SYS [23840 2014-12-24] (REALiX™)
S3 igfx; C:\Windows\System32\DRIVERS\igdkmd32.sys [4808192 2009-09-23] (Intel Corporation) [File not signed]
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [170200 2017-06-29] (Malwarebytes)
S3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtKHDMI.sys [4078400 2010-07-15] (Realtek Semiconductor Corp.) [File not signed]
S3 ssudmdm; C:\Windows\System32\DRIVERS\ssudmdm.sys [147344 2017-05-18] (Samsung Electronics Co., Ltd.)
S3 wdm_usb; C:\Windows\System32\DRIVERS\usb2ser.sys [128704 2016-08-16] (MBB)
S3 WsAudio_Device; C:\Windows\System32\drivers\VirtualAudio.sys [27496 2014-07-28] (Wondershare)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-07-02 22:15 - 2017-07-02 22:15 - 00000000 ____D C:\Users\User\Downloads\FRST-OlderVersion
2017-07-02 13:55 - 2017-07-02 13:57 - 00012337 _____ C:\Users\User\Downloads\Fixlog.txt
2017-07-01 16:52 - 2017-07-01 16:53 - 00000000 ____D C:\ProgramData\ProductData
2017-07-01 12:53 - 2017-07-02 22:46 - 00000000 ____D C:\Users\User\Desktop\Files
2017-07-01 12:40 - 2017-07-02 22:17 - 00045021 _____ C:\Users\User\Downloads\Addition.txt
2017-07-01 12:38 - 2017-07-03 12:14 - 00016727 _____ C:\Users\User\Downloads\FRST.txt
2017-07-01 12:38 - 2017-07-03 12:09 - 00000000 ____D C:\FRST
2017-07-01 12:28 - 2017-07-02 22:15 - 01781248 _____ (Farbar) C:\Users\User\Downloads\FRST.exe
2017-07-01 12:27 - 2017-07-01 12:27 - 01663672 _____ (Malwarebytes) C:\Users\User\Downloads\JRT (1).exe
2017-06-29 23:35 - 2017-07-02 16:09 - 00000000 ____D C:\AdwCleaner
2017-06-29 23:34 - 2017-06-29 23:35 - 04110280 _____ C:\Users\User\Downloads\adwcleaner_6.047.exe
2017-06-28 13:19 - 2017-06-28 13:19 - 00619021 _____ C:\Users\User\Documents\universal-credit-and-you-march-2017.pdf
2017-06-26 16:10 - 2017-06-26 16:09 - 00303280 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2017-06-25 16:08 - 2017-06-25 16:08 - 00001879 _____ C:\Users\Public\Desktop\Samsung Kies 3.lnk
2017-06-25 16:06 - 2014-05-07 17:42 - 00144664 _____ (MAPILab Ltd. & Add-in Express Ltd.) C:\Windows\system32\secman.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 39712768 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\amdocl.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 25052160 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atioglxx.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 22318592 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\amdocl12cl.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 19581440 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\atikmdag.sys
2017-06-25 13:06 - 2017-06-25 13:06 - 14302208 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticaldd.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 07898704 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiumdva.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 07167416 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiumdag.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 05129728 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\amdmantle32.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 03471376 _____ C:\Windows\system32\atiumdva.cap
2017-06-25 13:06 - 2017-06-25 13:06 - 00934400 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atiadlxx.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 00842001 _____ C:\Windows\system32\amdicdxx.dat
2017-06-25 13:06 - 2017-06-25 13:06 - 00662456 _____ C:\Windows\system32\atiapfxx.blb
2017-06-25 13:06 - 2017-06-25 13:06 - 00442368 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atidemgy.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 00385536 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atiapfxx.exe
2017-06-25 13:06 - 2017-06-25 13:06 - 00370688 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\atikmpag.sys
2017-06-25 13:06 - 2017-06-25 13:06 - 00203776 _____ C:\Windows\system32\clinfo.exe
2017-06-25 13:06 - 2017-06-25 13:06 - 00201216 _____ C:\Windows\system32\amdgfxinfo32.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 00189440 _____ C:\Windows\system32\atieah32.exe
2017-06-25 13:06 - 2017-06-25 13:06 - 00177344 _____ C:\Windows\system32\ativce03.dat
2017-06-25 13:06 - 2017-06-25 13:06 - 00175648 _____ C:\Windows\system32\amde31a.dat
2017-06-25 13:06 - 2017-06-25 13:06 - 00164352 _____ (AMD) C:\Windows\system32\atitmmxx.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 00158208 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atigktxx.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 00142848 _____ C:\Windows\system32\hsa-thunk.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 00123240 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiu9pag.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 00117760 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\mantle32.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 00100816 _____ C:\Windows\system32\ativce02.dat
2017-06-25 13:06 - 2017-06-25 13:06 - 00092328 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atimpc32.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 00092328 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\amdpcom32.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 00090624 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiglpxx.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 00089600 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\mantleaxl32.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 00059392 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 00052224 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticalrt.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 00049152 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticalcl.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 00043520 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\ati2erec.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 00038400 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\amdmmcl.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 00029184 _____ (AMD) C:\Windows\system32\atimuixx.dll
2017-06-24 16:07 - 2017-06-24 16:07 - 00000000 ____D C:\Users\User\.QtWebEngineProcess
2017-06-24 16:07 - 2017-06-24 16:07 - 00000000 ____D C:\Users\User\.Plays.tv
2017-06-24 14:22 - 2017-06-24 14:22 - 00000000 ____D C:\Users\Public\Documents\NativeFus_Log
2017-06-23 22:32 - 2017-06-24 12:17 - 00000000 ____D C:\Program Files\Mozilla Thunderbird
2017-06-19 15:00 - 2017-06-19 15:00 - 00000000 ____D C:\Users\User\AppData\Local\Facebook
2017-06-14 12:41 - 2017-06-02 09:09 - 01549824 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll
2017-06-14 12:41 - 2017-06-02 09:09 - 01400320 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll
2017-06-14 12:41 - 2017-06-02 09:09 - 00666624 _____ (Microsoft Corporation) C:\Windows\system32\mssvp.dll
2017-06-14 12:41 - 2017-06-02 09:09 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\mssph.dll
2017-06-14 12:41 - 2017-06-02 09:09 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\mssphtb.dll
2017-06-14 12:41 - 2017-06-02 09:09 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\mssitlb.dll
2017-06-14 12:41 - 2017-06-02 09:09 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\msscntrs.dll
2017-06-14 12:41 - 2017-06-02 09:09 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\mssprxy.dll
2017-06-14 12:41 - 2017-06-02 08:58 - 00427520 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe
2017-06-14 12:41 - 2017-06-02 08:58 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\SearchProtocolHost.exe
2017-06-14 12:41 - 2017-06-02 08:57 - 00497152 _____ (Microsoft Corporation) C:\Windows\HelpPane.exe
2017-06-14 12:41 - 2017-06-02 08:57 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\SearchFilterHost.exe
2017-06-14 12:41 - 2017-06-02 08:57 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\msshooks.dll
2017-06-14 12:41 - 2017-05-21 05:10 - 00137960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2017-06-14 12:41 - 2017-05-21 05:10 - 00067304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2017-06-14 12:41 - 2017-05-21 05:06 - 01062912 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2017-06-14 12:41 - 2017-05-21 05:06 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2017-06-14 12:41 - 2017-05-21 05:06 - 00655360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2017-06-14 12:41 - 2017-05-21 05:06 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2017-06-14 12:41 - 2017-05-21 05:06 - 00261120 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2017-06-14 12:41 - 2017-05-21 05:06 - 00254464 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2017-06-14 12:41 - 2017-05-21 05:06 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2017-06-14 12:41 - 2017-05-21 05:06 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2017-06-14 12:41 - 2017-05-21 05:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2017-06-14 12:41 - 2017-05-21 05:06 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2017-06-14 12:41 - 2017-05-21 05:06 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2017-06-14 12:41 - 2017-05-21 05:06 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2017-06-14 12:41 - 2017-05-21 05:06 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2017-06-14 12:41 - 2017-05-21 05:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2017-06-14 12:41 - 2017-05-21 05:06 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2017-06-14 12:41 - 2017-05-21 05:06 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2017-06-14 12:41 - 2017-05-21 04:46 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2017-06-14 12:41 - 2017-05-21 04:43 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2017-06-14 12:41 - 2017-05-21 04:42 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2017-06-14 12:41 - 2017-05-21 04:42 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2017-06-14 12:41 - 2017-05-21 04:42 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2017-06-14 12:41 - 2017-05-21 04:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2017-06-14 12:41 - 2017-05-21 04:42 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2017-06-14 12:41 - 2017-05-16 18:35 - 00346320 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2017-06-14 12:41 - 2017-05-14 20:37 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2017-06-14 12:41 - 2017-05-14 20:37 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2017-06-14 12:41 - 2017-05-14 20:23 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2017-06-14 12:41 - 2017-05-14 20:22 - 00499200 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2017-06-14 12:41 - 2017-05-14 20:22 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2017-06-14 12:41 - 2017-05-14 20:22 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2017-06-14 12:41 - 2017-05-14 20:21 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2017-06-14 12:41 - 2017-05-14 20:16 - 02290176 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2017-06-14 12:41 - 2017-05-14 20:15 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2017-06-14 12:41 - 2017-05-14 20:14 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2017-06-14 12:41 - 2017-05-14 20:12 - 00476160 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2017-06-14 12:41 - 2017-05-14 20:11 - 20274688 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2017-06-14 12:41 - 2017-05-14 20:11 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2017-06-14 12:41 - 2017-05-14 20:11 - 00104960 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2017-06-14 12:41 - 2017-05-14 20:10 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2017-06-14 12:41 - 2017-05-14 20:10 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2017-06-14 12:41 - 2017-05-14 20:05 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2017-06-14 12:41 - 2017-05-14 20:02 - 00416256 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2017-06-14 12:41 - 2017-05-14 19:57 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2017-06-14 12:41 - 2017-05-14 19:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-06-14 12:41 - 2017-05-14 19:56 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2017-06-14 12:41 - 2017-05-14 19:53 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2017-06-14 12:41 - 2017-05-14 19:52 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2017-06-14 12:41 - 2017-05-14 19:50 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2017-06-14 12:41 - 2017-05-14 19:49 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2017-06-14 12:41 - 2017-05-14 19:44 - 04549120 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2017-06-14 12:41 - 2017-05-14 19:42 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2017-06-14 12:41 - 2017-05-14 19:40 - 00693248 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2017-06-14 12:41 - 2017-05-14 19:40 - 00689664 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2017-06-14 12:41 - 2017-05-14 19:39 - 02057216 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2017-06-14 12:41 - 2017-05-14 19:38 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2017-06-14 12:41 - 2017-05-14 19:30 - 13664768 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2017-06-14 12:41 - 2017-05-14 19:15 - 02767872 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2017-06-14 12:41 - 2017-05-14 19:11 - 01314816 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2017-06-14 12:41 - 2017-05-14 19:11 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2017-06-14 12:41 - 2017-05-12 19:07 - 04001000 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2017-06-14 12:41 - 2017-05-12 19:07 - 03945704 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2017-06-14 12:41 - 2017-05-12 19:07 - 00308456 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2017-06-14 12:41 - 2017-05-12 19:04 - 01310528 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2017-06-14 12:41 - 2017-05-12 19:03 - 00644096 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2017-06-14 12:41 - 2017-05-12 19:03 - 00629760 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2017-06-14 12:41 - 2017-05-12 19:03 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2017-06-14 12:41 - 2017-05-12 19:03 - 00306688 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2017-06-14 12:41 - 2017-05-12 19:03 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2017-06-14 12:41 - 2017-05-12 19:03 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2017-06-14 12:41 - 2017-05-12 19:03 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2017-06-14 12:41 - 2017-05-12 19:03 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2017-06-14 12:41 - 2017-05-12 19:03 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2017-06-14 12:41 - 2017-05-12 19:03 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2017-06-14 12:41 - 2017-05-12 19:03 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2017-06-14 12:41 - 2017-05-12 19:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2017-06-14 12:41 - 2017-05-12 18:45 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2017-06-14 12:41 - 2017-05-12 18:45 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2017-06-14 12:41 - 2017-05-12 18:45 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2017-06-14 12:41 - 2017-05-12 18:45 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2017-06-14 12:41 - 2017-05-12 18:44 - 02401792 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2017-06-14 12:41 - 2017-05-12 18:43 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2017-06-14 12:41 - 2017-05-12 18:43 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2017-06-14 12:41 - 2017-05-12 18:41 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2017-06-14 12:41 - 2017-05-12 17:25 - 01251328 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2017-06-14 12:41 - 2017-05-12 17:25 - 00909824 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2017-06-14 12:41 - 2017-05-10 16:16 - 00091368 _____ (Microsoft Corporation) C:\Windows\system32\MigAutoPlay.exe
2017-06-14 12:41 - 2017-05-10 16:12 - 12880896 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2017-06-14 12:41 - 2017-05-10 16:12 - 02953216 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2017-06-14 12:41 - 2017-05-10 16:12 - 01499648 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2017-06-14 12:41 - 2017-05-10 16:12 - 00174080 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2017-06-14 12:41 - 2017-05-10 16:10 - 00073728 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2017-06-14 12:41 - 2017-05-10 16:01 - 02092032 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2017-06-14 12:41 - 2017-05-10 16:00 - 00573440 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2017-06-14 12:41 - 2017-05-10 16:00 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2017-06-14 12:41 - 2017-05-10 16:00 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2017-06-14 12:41 - 2017-05-10 16:00 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2017-06-14 12:41 - 2017-05-10 16:00 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2017-06-14 12:41 - 2017-05-10 16:00 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2017-06-14 12:41 - 2017-05-10 16:00 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2017-06-14 12:41 - 2017-05-10 15:47 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2017-06-14 12:41 - 2017-05-09 16:11 - 00779776 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2017-06-14 12:41 - 2017-05-09 16:11 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2017-06-14 12:41 - 2017-05-09 16:01 - 00066048 _____ C:\Windows\system32\PrintBrmUi.exe
2017-06-14 12:41 - 2017-05-07 16:14 - 00078568 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2017-06-14 12:41 - 2017-05-07 15:53 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2017-06-14 12:41 - 2017-03-30 15:58 - 00045056 _____ (Microsoft Corporation) C:\Windows\system32\rundll32.exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-07-03 12:13 - 2009-07-14 05:34 - 00035504 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-07-03 12:13 - 2009-07-14 05:34 - 00035504 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-07-03 12:04 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-07-03 00:00 - 2016-11-18 20:03 - 00000000 ____D C:\Users\User\AppData\LocalLow\Mozilla
2017-07-02 22:08 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2017-07-02 01:01 - 2014-01-03 14:19 - 00000000 ____D C:\Windows\system32\Macromed
2017-07-02 00:58 - 2013-12-16 14:48 - 00000000 ____D C:\Users\User\AppData\Roaming\vlc
2017-07-01 23:25 - 2015-01-28 15:39 - 00000000 ____D C:\Users\User\AppData\Local\CrashDumps
2017-07-01 22:53 - 2015-11-04 17:55 - 00000000 ____D C:\Users\User\Desktop\lol
2017-07-01 22:11 - 2016-03-06 19:58 - 00000000 ____D C:\Users\User\AppData\Roaming\Skype
2017-07-01 22:11 - 2014-09-15 12:18 - 00000000 ____D C:\Windows\pss
2017-07-01 17:26 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\NDF
2017-07-01 16:57 - 2014-08-09 16:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2017-07-01 16:57 - 2013-12-16 14:38 - 00000000 ____D C:\Program Files\Java
2017-07-01 16:17 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\inf
2017-07-01 16:08 - 2015-10-06 16:01 - 00000008 __RSH C:\ProgramData\ntuser.pol
2017-07-01 12:23 - 2014-04-11 13:14 - 00000000 __SHD C:\Users\User\AppData\LocalLow\EmieUserList
2017-07-01 12:23 - 2014-04-11 13:10 - 00000000 __SHD C:\Users\User\AppData\LocalLow\EmieSiteList
2017-07-01 12:03 - 2013-12-16 19:54 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2017-06-30 22:18 - 2016-12-15 23:25 - 00000000 ____D C:\Program Files\Mozilla Firefox
2017-06-30 18:09 - 2013-12-16 14:42 - 00296312 _____ (AVAST Software) C:\Windows\system32\Drivers\aswvmm.sys
2017-06-29 23:22 - 2014-04-29 17:33 - 00170200 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-06-28 23:56 - 2014-08-25 22:35 - 00000000 ____D C:\Users\User\AppData\Local\Adobe
2017-06-28 23:56 - 2014-01-03 14:19 - 00803328 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2017-06-28 23:56 - 2014-01-03 14:19 - 00144896 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2017-06-28 16:51 - 2014-10-21 23:26 - 00157696 ___SH C:\Users\User\Documents\Thumbs.db
2017-06-27 22:46 - 2013-12-16 14:38 - 00002020 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-06-27 12:37 - 2013-12-16 14:38 - 00000000 ____D C:\Program Files\Common Files\Adobe AIR
2017-06-26 16:09 - 2017-02-07 13:03 - 00276704 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswblogx.sys
2017-06-26 16:09 - 2017-02-07 13:03 - 00266976 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbidsdriverx.sys
2017-06-26 16:09 - 2017-02-07 13:03 - 00157384 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbidshx.sys
2017-06-26 16:09 - 2017-02-07 13:03 - 00050352 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbunivx.sys
2017-06-26 16:09 - 2016-03-22 23:05 - 00039752 _____ (AVAST Software) C:\Windows\system32\Drivers\aswKbd.sys
2017-06-26 16:09 - 2014-05-01 16:51 - 00042824 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2017-06-26 16:09 - 2014-01-03 14:19 - 00147688 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2017-06-26 16:09 - 2013-12-16 14:42 - 00774288 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2017-06-26 16:09 - 2013-12-16 14:42 - 00496976 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2017-06-26 16:09 - 2013-12-16 14:42 - 00123896 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2017-06-26 16:09 - 2013-12-16 14:42 - 00099536 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2017-06-26 16:09 - 2013-12-16 14:42 - 00070840 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2017-06-26 16:09 - 2013-12-16 14:42 - 00000000 ____D C:\ProgramData\AVAST Software
2017-06-25 22:41 - 2017-03-25 16:15 - 00000000 ___RD C:\Program Files\Skype
2017-06-25 22:41 - 2016-03-06 19:57 - 00000000 ____D C:\ProgramData\Skype
2017-06-25 19:15 - 2010-11-20 22:01 - 00781790 _____ C:\Windows\system32\PerfStringBackup.INI
2017-06-25 16:08 - 2014-01-03 18:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2017-06-25 16:06 - 2014-01-03 18:17 - 00000000 ____D C:\Users\User\AppData\Roaming\Samsung
2017-06-25 16:06 - 2014-01-03 18:15 - 00000000 ____D C:\Program Files\Samsung
2017-06-25 16:06 - 2013-12-16 15:04 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2017-06-25 13:06 - 2015-08-04 07:28 - 09468448 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atidxx32.dll
2017-06-25 13:06 - 2015-08-04 07:28 - 01194928 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\aticfx32.dll
2017-06-25 13:06 - 2015-08-04 07:28 - 00136624 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiuxpag.dll
2017-06-25 13:06 - 2015-08-04 03:06 - 00564224 _____ (AMD) C:\Windows\system32\atieclxx.exe
2017-06-25 13:06 - 2015-08-04 03:06 - 00259072 _____ (AMD) C:\Windows\system32\atiesrxx.exe
2017-06-25 13:06 - 2015-08-04 02:48 - 00669696 _____ (AMD) C:\Windows\system32\coinst_15.20.dll
2017-06-25 00:42 - 2014-12-10 15:24 - 00000000 ____D C:\Windows\system32\appraiser
2017-06-25 00:42 - 2010-11-21 01:47 - 00000000 ___RD C:\Users\Public\Recorded TV
2017-06-25 00:42 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\registration
2017-06-24 23:13 - 2013-12-23 12:24 - 00000000 ____D C:\AMD
2017-06-24 15:53 - 2009-07-14 05:53 - 00032620 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2017-06-14 16:50 - 2015-12-08 17:41 - 00502976 _____ C:\Windows\system32\FNTCACHE.DAT
2017-06-14 16:50 - 2014-11-06 13:36 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2017-06-14 16:02 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\migwiz
2017-06-14 14:12 - 2013-12-16 15:44 - 00000000 ____D C:\Windows\system32\MRT
2017-06-14 14:07 - 2013-12-16 15:44 - 130903960 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-06-14 14:04 - 2014-11-06 13:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2017-06-03 22:52 - 2015-04-02 18:21 - 00000116 _____ C:\Windows\NeroDigital.ini

==================== Files in the root of some directories =======

2015-09-16 17:04 - 2016-11-22 17:03 - 0000518 _____ () C:\Users\User\AppData\Roaming\burnaware.ini
2014-06-29 16:41 - 2014-10-15 13:30 - 0000097 _____ () C:\Users\User\AppData\Roaming\default.pls
2015-02-09 16:09 - 2015-02-09 16:11 - 0022328 _____ () C:\Users\User\AppData\Roaming\PnkBstrK.sys
2015-04-11 14:44 - 2015-04-11 14:44 - 0000020 ___SH () C:\Users\User\AppData\Roaming\Sys11965 DataCollection.dat
2015-04-11 14:44 - 2015-04-11 14:44 - 0000020 ___SH () C:\Users\User\AppData\Roaming\System413_DataDB.ind
2017-03-26 18:12 - 2017-03-26 18:12 - 1058101 _____ () C:\Users\User\AppData\Local\ars.cache
2017-03-26 18:12 - 2017-03-26 18:12 - 0384255 _____ () C:\Users\User\AppData\Local\census.cache
2015-07-12 23:19 - 2016-09-09 23:24 - 0003584 _____ () C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2017-03-26 17:50 - 2017-03-26 17:50 - 0000036 _____ () C:\Users\User\AppData\Local\housecall.guid.cache
2015-08-11 16:42 - 2015-08-11 16:42 - 0000017 _____ () C:\Users\User\AppData\Local\resmon.resmoncfg
2017-03-26 18:03 - 2017-03-26 18:03 - 0000010 _____ () C:\Users\User\AppData\Local\sponge.last.runtime.cache
2017-02-26 18:03 - 2017-02-26 18:03 - 0000116 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-07-02 19:44

==================== End of FRST.txt ============================
  • 0

#18
RKinner
Posted 03 July 2017 - 05:33 AM

RKinner

    Malware Expert

  • Expert
  • 24,625 posts
  • MVP

For some reason this:

 

ProxyEnable: [.DEFAULT] => Proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:52874;https=127.0.0.1:52874
AutoConfigURL: [.DEFAULT] => http=127.0.0.1:52874;https=127.0.0.1:52874

 

 

Keeps coming back.  If I understand it correctly it just applies to new users but I don't like to see a Proxy unless I know why it is there.  Let's try RogueKiller

 

 

 
Portable 32 bits <==Use this one
 
 
Download and Save.
 
 
 
Right click on the downloaded file (RogueKillerX64.exe or RogueKiller.exe)  and Run As admin
 
Start Scan
Start Scan
 
Will take about 20 minutes to complete.
 
Open Report
Export TXT (save it to your desktop as rk) Save
 
Do not let Rogue Killer remove anything until you hear from me.  Leave Rogue Killer up (but minimized) so you won't have to rescan.
 
Open rk.txt and copy and paste it to your next Reply. 

  • 0

#19
Django2009
Posted 03 July 2017 - 07:36 AM

Django2009

    Member

  • Topic Starter
  • Member
  • PipPip
  • 56 posts
RogueKiller V12.11.5.0 [Jul 3 2017] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : https://forum.adlice.com
Website : http://www.adlice.co...ad/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Normal mode
User : User [Administrator]
Started from : C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3T74QX20\RogueKiller_portable32.exe
Mode : Scan -- Date : 07/03/2017 12:44:14 (Duration : 01:47:19)

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 11 ¤¤¤
[PUP.Gen0] HKEY_CLASSES_ROOT\CLSID\{1663C10B-0D55-438D-8496-19A3DBAEC0E4} (C:\Program Files\iSkysoft\Video Converter Ultimate\ScreenCaptureFilter.ax) -> Found
[PUP.Gen0] HKEY_CLASSES_ROOT\CLSID\{A43DE495-3D00-47d4-9D2C-303115707939} ("C:\Program Files\iSkysoft\Video Converter Ultimate\URLReqService.exe") -> Found
[PUP.Gen1] HKEY_USERS\S-1-5-21-3088101763-2072606618-2741787397-1000\Software\IM -> Found
[PUP.Gen1] HKEY_USERS\S-1-5-21-3088101763-2072606618-2741787397-1000\Software\OCS -> Found
[PUM.Proxy] HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Found
[PUM.Proxy] HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Found
[PUM.Proxy] HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:52874;https=127.0.0.1:52874 -> Found
[PUM.Proxy] HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:52874;https=127.0.0.1:52874 -> Found
[PUM.Policies] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Found
[PUM.StartMenu] HKEY_USERS\S-1-5-21-3088101763-2072606618-2741787397-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0 -> Found
[PUM.StartMenu] HKEY_USERS\S-1-5-21-3088101763-2072606618-2741787397-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowRecentDocs : 0 -> Found

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 2 ¤¤¤
[PUP.Gen1][Folder] C:\ProgramData\Free YouTube Downloader -> Found
[PUP.Gen1][Folder] C:\ProgramData\Free YouTube Downloader -> Found

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

¤¤¤ Web browsers : 1 ¤¤¤
[PUM.HomePage][Chrome:Config] Default [SecurePrefs] : homepage [http://www.igoogle.com/]-> Found

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: +++++
--- User ---
[MBR] db406436d74c3ae2002efbbe77a874e8
[BSP] 60aa98ccbc9d46d41619d508828a20a7 : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 152485 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1: +++++
--- User ---
[MBR] 531f855d2a50407103885eafe38112f4
[BSP] 16a702ca5348d74463114c945113a83b : Windows XP|VT.Unknown MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 953867 MB [Windows XP Bootstrap | Windows XP Bootloader]
User = LL1 ... OK
User = LL2 ... OK
  • 0

#20
RKinner
Posted 03 July 2017 - 07:40 AM

RKinner

    Malware Expert

  • Expert
  • 24,625 posts
  • MVP
Let RK remove these:
 
¤¤¤ Registry : 11 ¤¤¤
[PUP.Gen0] HKEY_CLASSES_ROOT\CLSID\{1663C10B-0D55-438D-8496-19A3DBAEC0E4} (C:\Program Files\iSkysoft\Video Converter Ultimate\ScreenCaptureFilter.ax) -> Found
[PUP.Gen0] HKEY_CLASSES_ROOT\CLSID\{A43DE495-3D00-47d4-9D2C-303115707939} ("C:\Program Files\iSkysoft\Video Converter Ultimate\URLReqService.exe") -> Found
[PUP.Gen1] HKEY_USERS\S-1-5-21-3088101763-2072606618-2741787397-1000\Software\IM -> Found
[PUP.Gen1] HKEY_USERS\S-1-5-21-3088101763-2072606618-2741787397-1000\Software\OCS -> Found
[PUM.Proxy] HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Found
[PUM.Proxy] HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Found
[PUM.Proxy] HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:52874;https=127.0.0.1:52874 -> Found
[PUM.Proxy] HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:52874;https=127.0.0.1:52874 -> Found
[PUM.Policies] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Found
[PUM.StartMenu] HKEY_USERS\S-1-5-21-3088101763-2072606618-2741787397-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0 -> Found
[PUM.StartMenu] HKEY_USERS\S-1-5-21-3088101763-2072606618-2741787397-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowRecentDocs : 0 -> Found
 
¤¤¤ Tasks : 0 ¤¤¤
 
¤¤¤ Files : 2 ¤¤¤
[PUP.Gen1][Folder] C:\ProgramData\Free YouTube Downloader -> Found
[PUP.Gen1][Folder] C:\ProgramData\Free YouTube Downloader -> Found

  • 0

#21
Django2009
Posted 03 July 2017 - 08:03 AM

Django2009

    Member

  • Topic Starter
  • Member
  • PipPip
  • 56 posts
All done apart from the Homepage one at the end. Which wasn't mentioned to remove
  • 0

#22
RKinner
Posted 03 July 2017 - 08:05 AM

RKinner

    Malware Expert

  • Expert
  • 24,625 posts
  • MVP

Nothing wrong with igoogle as far as I know.

 

Can you do a new FRST scan?  You can uncheck Addition.txt so you will only get the one log.


  • 0

#23
Django2009
Posted 03 July 2017 - 08:21 AM

Django2009

    Member

  • Topic Starter
  • Member
  • PipPip
  • 56 posts
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 02-07-2017
Ran by User (administrator) on USER-PC (03-07-2017 15:15:04)
Running from C:\Users\User\Downloads
Loaded Profiles: User (Available Profiles: User)
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.33.5\GoogleCrashHandler.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\RPDS\Bin\rpdsvc.exe
(DEVGURU Co., LTD.) C:\Program Files\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe
(AVAST Software s.r.o.) C:\Program Files\AVAST Software\Avast\aswidsagent.exe
() C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3T74QX20\RogueKiller_portable32.exe
(Microsoft Corporation) C:\Windows\System32\rdrleakdiag.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_26_0_0_131.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_26_0_0_131.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [213832 2017-06-26] (AVAST Software)
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-3088101763-2072606618-2741787397-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704 2011-08-31] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{84134957-FE4A-4422-A37C-E142E6B0BA2E}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://uk.yahoo.com/?fr=hp-avast&type=avastbcl
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files\Real\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2016-11-11] (RealDownloader)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_131\bin\ssv.dll [2017-05-08] (Oracle Corporation)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-24] (Google Inc.)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_131\bin\jp2ssv.dll [2017-05-08] (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-24] (Google Inc.)
Toolbar: HKU\.DEFAULT -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-24] (Google Inc.)
Toolbar: HKU\S-1-5-21-3088101763-2072606618-2741787397-1000 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-24] (Google Inc.)
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll [2009-02-26] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\rq6fi83i.default-1476290873126 [2017-07-03]
FF Homepage: Mozilla\Firefox\Profiles\rq6fi83i.default-1476290873126 -> hxxp://www.google.co.uk/
FF Extension: (Grammarly for Firefox) - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\rq6fi83i.default-1476290873126\Extensions\[email protected] [2017-06-22]
FF Extension: (Video DownloadHelper) - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\rq6fi83i.default-1476290873126\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2017-05-09]
FF Extension: (Adblock Plus) - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\rq6fi83i.default-1476290873126\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2017-06-08]
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext => not found
FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\ProgramData\iSkysoft\Video Converter Ultimate\[email protected]
FF Extension: (iSkysoft Video Converter Ultimate) - C:\ProgramData\iSkysoft\Video Converter Ultimate\[email protected] [2016-12-21] [not signed]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_26_0_0_131.dll [2017-06-16] ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1229199.dll [2017-03-31] (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2014-05-06] ()
FF Plugin: @java.com/DTPlugin,version=11.131.2 -> C:\Program Files\Java\jre1.8.0_131\bin\dtplugin\npDeployJava1.dll [2017-05-08] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.131.2 -> C:\Program Files\Java\jre1.8.0_131\bin\plugin2\npjp2.dll [2017-05-08] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=18.1.6.161 -> C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll [2017-01-15] (RealNetworks, Inc.)
FF Plugin: @real.com/nprpplugin;version=18.1.6.161 -> C:\Program Files\Real\RealPlayer\Netscape6\nprpplugin.dll [2017-01-15] (RealPlayer)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-04-05] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3088101763-2072606618-2741787397-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\User\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-06-08] (Unity Technologies ApS)

Chrome:
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> hxxp://www.igoogle.com/
CHR DefaultSearchURL: Default -> hxxps://search.yahoo.com/search?p={searchTerms}&fr=yset_chr_cnewtab&type=default
CHR DefaultSearchKeyword: Default -> Yahoo
CHR DefaultSuggestURL: Default -> hxxps://search.yahoo.com/sugg/ie?output=fxjson&command={searchTerms}&nResults=10
CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default [2017-07-03]
CHR Extension: (Yahoo Partner) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjicifbhnpakmaekfnphojjehhnifkmc [2017-07-02]
CHR Extension: (Adblock Plus) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2017-07-02]
CHR Extension: (Adobe Acrobat) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2017-07-02]
CHR Extension: (Avast SafePrice) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2017-07-02]
CHR Extension: (Unlimited Free VPN - Hola) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio [2017-07-02]
CHR Extension: (Fiery Music) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnmfeiddljnkcdgcfcfhpenipgmaocon [2017-07-02]
CHR Extension: (Chrome Web Store Payments) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-07-02]
CHR Extension: (iSkysoft Video Converter Ultimate) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nomnoaehhnmbolpapbjeopogjfefdpnl [2017-07-02]
CHR Extension: (Chrome Media Router) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-07-02]
CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\System Profile [2015-12-08]
CHR Extension: (Google Slides) - C:\Users\User\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-05-26]
CHR Extension: (Google Docs) - C:\Users\User\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\aohghmighlieiainnegkcijnfilokake [2015-05-26]
CHR Extension: (Google Drive) - C:\Users\User\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-05-26]
CHR Extension: (YouTube) - C:\Users\User\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-05-26]
CHR Extension: (Google Search) - C:\Users\User\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-05-26]
CHR Extension: (Google Sheets) - C:\Users\User\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-05-26]
CHR Extension: (Bookmark Manager) - C:\Users\User\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-05-26]
CHR Extension: (Avast Online Security) - C:\Users\User\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-05-26]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\User\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-05-26]
CHR Extension: (Google Wallet) - C:\Users\User\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-05-26]
CHR Extension: (Gmail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-05-26]
CHR HKLM\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <not found>
CHR HKLM\...\Chrome\Extension: [nomnoaehhnmbolpapbjeopogjfefdpnl] - C:\ProgramData\iSkysoft\Video Converter Ultimate\[email protected] [2016-12-21]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\aswidsagent.exe [5815840 2017-06-26] (AVAST Software s.r.o.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [263312 2017-06-26] (AVAST Software)
S3 NAUpdate; C:\Program Files\Nero\Update\NASvc.exe [762192 2013-07-18] (Nero AG)
S3 RealPlayerUpdateSvc; C:\Program Files\Real\UpdateService\RealPlayerUpdateSvc.exe [35104 2016-11-11] ()
R2 RealTimes Desktop Service; C:\Program Files\Real\RealPlayer\RPDS\Bin\rpdsvc.exe [987408 2017-01-15] (RealNetworks, Inc.)
S3 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [167936 2005-08-08] () [File not signed]
R2 ss_conn_service; C:\Program Files\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [754784 2016-07-22] (DEVGURU Co., LTD.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 aswbidsdriver; C:\Windows\system32\drivers\aswbidsdriverx.sys [266976 2017-06-26] (AVAST Software s.r.o.)
R0 aswbidsh; C:\Windows\system32\drivers\aswbidshx.sys [157384 2017-06-26] (AVAST Software s.r.o.)
R0 aswblog; C:\Windows\system32\drivers\aswblogx.sys [276704 2017-06-26] (AVAST Software s.r.o.)
R0 aswbuniv; C:\Windows\system32\drivers\aswbunivx.sys [50352 2017-06-26] (AVAST Software s.r.o.)
S3 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [42824 2017-06-26] (AVAST Software)
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [39752 2017-06-26] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [123896 2017-06-26] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [99536 2017-06-26] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\drivers\aswRvrt.sys [70840 2017-06-26] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [774288 2017-06-26] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [496976 2017-06-26] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [147688 2017-06-26] (AVAST Software)
R0 aswVmm; C:\Windows\system32\drivers\aswVmm.sys [296312 2017-06-30] (AVAST Software)
S3 dg_ssudbus; C:\Windows\System32\DRIVERS\ssudbus.sys [109456 2017-05-18] (Samsung Electronics Co., Ltd.)
R1 HWiNFO32; C:\Windows\system32\drivers\HWiNFO32.SYS [23840 2014-12-24] (REALiX™)
S3 igfx; C:\Windows\System32\DRIVERS\igdkmd32.sys [4808192 2009-09-23] (Intel Corporation) [File not signed]
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [170200 2017-06-29] (Malwarebytes)
S3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtKHDMI.sys [4078400 2010-07-15] (Realtek Semiconductor Corp.) [File not signed]
S3 ssudmdm; C:\Windows\System32\DRIVERS\ssudmdm.sys [147344 2017-05-18] (Samsung Electronics Co., Ltd.)
S3 wdm_usb; C:\Windows\System32\DRIVERS\usb2ser.sys [128704 2016-08-16] (MBB)
S3 WsAudio_Device; C:\Windows\System32\drivers\VirtualAudio.sys [27496 2014-07-28] (Wondershare)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-07-03 14:33 - 2017-07-03 14:33 - 00006790 _____ C:\Users\User\Desktop\rk.txt
2017-07-03 12:44 - 2017-07-03 12:44 - 00024688 _____ C:\Windows\system32\Drivers\TrueSight.sys
2017-07-03 12:43 - 2017-07-03 15:16 - 00000000 ____D C:\ProgramData\RogueKiller
2017-07-03 12:43 - 2017-07-03 12:43 - 00000000 ____D C:\ProgramData\SWCUTemp
2017-07-02 22:15 - 2017-07-02 22:15 - 00000000 ____D C:\Users\User\Downloads\FRST-OlderVersion
2017-07-02 13:55 - 2017-07-02 13:57 - 00012337 _____ C:\Users\User\Downloads\Fixlog.txt
2017-07-01 16:52 - 2017-07-01 16:53 - 00000000 ____D C:\ProgramData\ProductData
2017-07-01 12:53 - 2017-07-02 22:46 - 00000000 ____D C:\Users\User\Desktop\Files
2017-07-01 12:40 - 2017-07-03 12:16 - 00047033 _____ C:\Users\User\Downloads\Addition.txt
2017-07-01 12:38 - 2017-07-03 15:15 - 00016772 _____ C:\Users\User\Downloads\FRST.txt
2017-07-01 12:38 - 2017-07-03 15:15 - 00000000 ____D C:\FRST
2017-07-01 12:28 - 2017-07-02 22:15 - 01781248 _____ (Farbar) C:\Users\User\Downloads\FRST.exe
2017-07-01 12:27 - 2017-07-01 12:27 - 01663672 _____ (Malwarebytes) C:\Users\User\Downloads\JRT (1).exe
2017-06-29 23:35 - 2017-07-02 16:09 - 00000000 ____D C:\AdwCleaner
2017-06-29 23:34 - 2017-06-29 23:35 - 04110280 _____ C:\Users\User\Downloads\adwcleaner_6.047.exe
2017-06-28 13:19 - 2017-06-28 13:19 - 00619021 _____ C:\Users\User\Documents\universal-credit-and-you-march-2017.pdf
2017-06-26 16:10 - 2017-06-26 16:09 - 00303280 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2017-06-25 16:08 - 2017-06-25 16:08 - 00001879 _____ C:\Users\Public\Desktop\Samsung Kies 3.lnk
2017-06-25 16:06 - 2014-05-07 17:42 - 00144664 _____ (MAPILab Ltd. & Add-in Express Ltd.) C:\Windows\system32\secman.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 39712768 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\amdocl.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 25052160 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atioglxx.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 22318592 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\amdocl12cl.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 19581440 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\atikmdag.sys
2017-06-25 13:06 - 2017-06-25 13:06 - 14302208 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticaldd.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 07898704 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiumdva.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 07167416 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiumdag.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 05129728 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\amdmantle32.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 03471376 _____ C:\Windows\system32\atiumdva.cap
2017-06-25 13:06 - 2017-06-25 13:06 - 00934400 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atiadlxx.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 00842001 _____ C:\Windows\system32\amdicdxx.dat
2017-06-25 13:06 - 2017-06-25 13:06 - 00662456 _____ C:\Windows\system32\atiapfxx.blb
2017-06-25 13:06 - 2017-06-25 13:06 - 00442368 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atidemgy.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 00385536 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atiapfxx.exe
2017-06-25 13:06 - 2017-06-25 13:06 - 00370688 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\atikmpag.sys
2017-06-25 13:06 - 2017-06-25 13:06 - 00203776 _____ C:\Windows\system32\clinfo.exe
2017-06-25 13:06 - 2017-06-25 13:06 - 00201216 _____ C:\Windows\system32\amdgfxinfo32.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 00189440 _____ C:\Windows\system32\atieah32.exe
2017-06-25 13:06 - 2017-06-25 13:06 - 00177344 _____ C:\Windows\system32\ativce03.dat
2017-06-25 13:06 - 2017-06-25 13:06 - 00175648 _____ C:\Windows\system32\amde31a.dat
2017-06-25 13:06 - 2017-06-25 13:06 - 00164352 _____ (AMD) C:\Windows\system32\atitmmxx.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 00158208 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atigktxx.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 00142848 _____ C:\Windows\system32\hsa-thunk.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 00123240 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiu9pag.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 00117760 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\mantle32.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 00100816 _____ C:\Windows\system32\ativce02.dat
2017-06-25 13:06 - 2017-06-25 13:06 - 00092328 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atimpc32.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 00092328 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\amdpcom32.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 00090624 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiglpxx.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 00089600 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\mantleaxl32.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 00059392 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 00052224 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticalrt.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 00049152 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticalcl.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 00043520 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\ati2erec.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 00038400 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\amdmmcl.dll
2017-06-25 13:06 - 2017-06-25 13:06 - 00029184 _____ (AMD) C:\Windows\system32\atimuixx.dll
2017-06-24 16:07 - 2017-06-24 16:07 - 00000000 ____D C:\Users\User\.QtWebEngineProcess
2017-06-24 16:07 - 2017-06-24 16:07 - 00000000 ____D C:\Users\User\.Plays.tv
2017-06-24 14:22 - 2017-06-24 14:22 - 00000000 ____D C:\Users\Public\Documents\NativeFus_Log
2017-06-23 22:32 - 2017-06-24 12:17 - 00000000 ____D C:\Program Files\Mozilla Thunderbird
2017-06-19 15:00 - 2017-06-19 15:00 - 00000000 ____D C:\Users\User\AppData\Local\Facebook
2017-06-14 12:41 - 2017-06-02 09:09 - 01549824 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll
2017-06-14 12:41 - 2017-06-02 09:09 - 01400320 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll
2017-06-14 12:41 - 2017-06-02 09:09 - 00666624 _____ (Microsoft Corporation) C:\Windows\system32\mssvp.dll
2017-06-14 12:41 - 2017-06-02 09:09 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\mssph.dll
2017-06-14 12:41 - 2017-06-02 09:09 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\mssphtb.dll
2017-06-14 12:41 - 2017-06-02 09:09 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\mssitlb.dll
2017-06-14 12:41 - 2017-06-02 09:09 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\msscntrs.dll
2017-06-14 12:41 - 2017-06-02 09:09 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\mssprxy.dll
2017-06-14 12:41 - 2017-06-02 08:58 - 00427520 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe
2017-06-14 12:41 - 2017-06-02 08:58 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\SearchProtocolHost.exe
2017-06-14 12:41 - 2017-06-02 08:57 - 00497152 _____ (Microsoft Corporation) C:\Windows\HelpPane.exe
2017-06-14 12:41 - 2017-06-02 08:57 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\SearchFilterHost.exe
2017-06-14 12:41 - 2017-06-02 08:57 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\msshooks.dll
2017-06-14 12:41 - 2017-05-21 05:10 - 00137960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2017-06-14 12:41 - 2017-05-21 05:10 - 00067304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2017-06-14 12:41 - 2017-05-21 05:06 - 01062912 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2017-06-14 12:41 - 2017-05-21 05:06 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2017-06-14 12:41 - 2017-05-21 05:06 - 00655360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2017-06-14 12:41 - 2017-05-21 05:06 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2017-06-14 12:41 - 2017-05-21 05:06 - 00261120 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2017-06-14 12:41 - 2017-05-21 05:06 - 00254464 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2017-06-14 12:41 - 2017-05-21 05:06 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2017-06-14 12:41 - 2017-05-21 05:06 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2017-06-14 12:41 - 2017-05-21 05:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2017-06-14 12:41 - 2017-05-21 05:06 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2017-06-14 12:41 - 2017-05-21 05:06 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2017-06-14 12:41 - 2017-05-21 05:06 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2017-06-14 12:41 - 2017-05-21 05:06 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2017-06-14 12:41 - 2017-05-21 05:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2017-06-14 12:41 - 2017-05-21 05:06 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2017-06-14 12:41 - 2017-05-21 05:06 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2017-06-14 12:41 - 2017-05-21 04:46 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2017-06-14 12:41 - 2017-05-21 04:43 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2017-06-14 12:41 - 2017-05-21 04:42 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2017-06-14 12:41 - 2017-05-21 04:42 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2017-06-14 12:41 - 2017-05-21 04:42 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2017-06-14 12:41 - 2017-05-21 04:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2017-06-14 12:41 - 2017-05-21 04:42 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2017-06-14 12:41 - 2017-05-16 18:35 - 00346320 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2017-06-14 12:41 - 2017-05-14 20:37 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2017-06-14 12:41 - 2017-05-14 20:37 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2017-06-14 12:41 - 2017-05-14 20:23 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2017-06-14 12:41 - 2017-05-14 20:22 - 00499200 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2017-06-14 12:41 - 2017-05-14 20:22 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2017-06-14 12:41 - 2017-05-14 20:22 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2017-06-14 12:41 - 2017-05-14 20:21 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2017-06-14 12:41 - 2017-05-14 20:16 - 02290176 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2017-06-14 12:41 - 2017-05-14 20:15 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2017-06-14 12:41 - 2017-05-14 20:14 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2017-06-14 12:41 - 2017-05-14 20:12 - 00476160 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2017-06-14 12:41 - 2017-05-14 20:11 - 20274688 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2017-06-14 12:41 - 2017-05-14 20:11 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2017-06-14 12:41 - 2017-05-14 20:11 - 00104960 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2017-06-14 12:41 - 2017-05-14 20:10 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2017-06-14 12:41 - 2017-05-14 20:10 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2017-06-14 12:41 - 2017-05-14 20:05 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2017-06-14 12:41 - 2017-05-14 20:02 - 00416256 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2017-06-14 12:41 - 2017-05-14 19:57 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2017-06-14 12:41 - 2017-05-14 19:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-06-14 12:41 - 2017-05-14 19:56 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2017-06-14 12:41 - 2017-05-14 19:53 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2017-06-14 12:41 - 2017-05-14 19:52 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2017-06-14 12:41 - 2017-05-14 19:50 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2017-06-14 12:41 - 2017-05-14 19:49 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2017-06-14 12:41 - 2017-05-14 19:44 - 04549120 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2017-06-14 12:41 - 2017-05-14 19:42 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2017-06-14 12:41 - 2017-05-14 19:40 - 00693248 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2017-06-14 12:41 - 2017-05-14 19:40 - 00689664 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2017-06-14 12:41 - 2017-05-14 19:39 - 02057216 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2017-06-14 12:41 - 2017-05-14 19:38 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2017-06-14 12:41 - 2017-05-14 19:30 - 13664768 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2017-06-14 12:41 - 2017-05-14 19:15 - 02767872 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2017-06-14 12:41 - 2017-05-14 19:11 - 01314816 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2017-06-14 12:41 - 2017-05-14 19:11 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2017-06-14 12:41 - 2017-05-12 19:07 - 04001000 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2017-06-14 12:41 - 2017-05-12 19:07 - 03945704 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2017-06-14 12:41 - 2017-05-12 19:07 - 00308456 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2017-06-14 12:41 - 2017-05-12 19:04 - 01310528 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2017-06-14 12:41 - 2017-05-12 19:03 - 00644096 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2017-06-14 12:41 - 2017-05-12 19:03 - 00629760 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2017-06-14 12:41 - 2017-05-12 19:03 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2017-06-14 12:41 - 2017-05-12 19:03 - 00306688 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2017-06-14 12:41 - 2017-05-12 19:03 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2017-06-14 12:41 - 2017-05-12 19:03 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2017-06-14 12:41 - 2017-05-12 19:03 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2017-06-14 12:41 - 2017-05-12 19:03 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2017-06-14 12:41 - 2017-05-12 19:03 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2017-06-14 12:41 - 2017-05-12 19:03 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2017-06-14 12:41 - 2017-05-12 19:03 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2017-06-14 12:41 - 2017-05-12 19:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2017-06-14 12:41 - 2017-05-12 18:45 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2017-06-14 12:41 - 2017-05-12 18:45 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2017-06-14 12:41 - 2017-05-12 18:45 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2017-06-14 12:41 - 2017-05-12 18:45 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2017-06-14 12:41 - 2017-05-12 18:44 - 02401792 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2017-06-14 12:41 - 2017-05-12 18:43 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2017-06-14 12:41 - 2017-05-12 18:43 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2017-06-14 12:41 - 2017-05-12 18:41 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2017-06-14 12:41 - 2017-05-12 17:25 - 01251328 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2017-06-14 12:41 - 2017-05-12 17:25 - 00909824 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2017-06-14 12:41 - 2017-05-10 16:16 - 00091368 _____ (Microsoft Corporation) C:\Windows\system32\MigAutoPlay.exe
2017-06-14 12:41 - 2017-05-10 16:12 - 12880896 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2017-06-14 12:41 - 2017-05-10 16:12 - 02953216 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2017-06-14 12:41 - 2017-05-10 16:12 - 01499648 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2017-06-14 12:41 - 2017-05-10 16:12 - 00174080 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2017-06-14 12:41 - 2017-05-10 16:10 - 00073728 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2017-06-14 12:41 - 2017-05-10 16:01 - 02092032 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2017-06-14 12:41 - 2017-05-10 16:00 - 00573440 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2017-06-14 12:41 - 2017-05-10 16:00 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2017-06-14 12:41 - 2017-05-10 16:00 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2017-06-14 12:41 - 2017-05-10 16:00 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2017-06-14 12:41 - 2017-05-10 16:00 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2017-06-14 12:41 - 2017-05-10 16:00 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2017-06-14 12:41 - 2017-05-10 16:00 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2017-06-14 12:41 - 2017-05-10 15:47 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2017-06-14 12:41 - 2017-05-09 16:11 - 00779776 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2017-06-14 12:41 - 2017-05-09 16:11 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2017-06-14 12:41 - 2017-05-09 16:01 - 00066048 _____ C:\Windows\system32\PrintBrmUi.exe
2017-06-14 12:41 - 2017-05-07 16:14 - 00078568 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2017-06-14 12:41 - 2017-05-07 15:53 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2017-06-14 12:41 - 2017-03-30 15:58 - 00045056 _____ (Microsoft Corporation) C:\Windows\system32\rundll32.exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-07-03 13:52 - 2016-11-18 20:03 - 00000000 ____D C:\Users\User\AppData\LocalLow\Mozilla
2017-07-03 12:21 - 2009-07-14 05:34 - 00035504 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-07-03 12:21 - 2009-07-14 05:34 - 00035504 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-07-03 12:04 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-07-02 22:08 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2017-07-02 01:01 - 2014-01-03 14:19 - 00000000 ____D C:\Windows\system32\Macromed
2017-07-02 00:58 - 2013-12-16 14:48 - 00000000 ____D C:\Users\User\AppData\Roaming\vlc
2017-07-01 23:25 - 2015-01-28 15:39 - 00000000 ____D C:\Users\User\AppData\Local\CrashDumps
2017-07-01 22:53 - 2015-11-04 17:55 - 00000000 ____D C:\Users\User\Desktop\lol
2017-07-01 22:11 - 2016-03-06 19:58 - 00000000 ____D C:\Users\User\AppData\Roaming\Skype
2017-07-01 22:11 - 2014-09-15 12:18 - 00000000 ____D C:\Windows\pss
2017-07-01 17:26 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\NDF
2017-07-01 16:57 - 2014-08-09 16:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2017-07-01 16:57 - 2013-12-16 14:38 - 00000000 ____D C:\Program Files\Java
2017-07-01 16:17 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\inf
2017-07-01 16:08 - 2015-10-06 16:01 - 00000008 __RSH C:\ProgramData\ntuser.pol
2017-07-01 12:23 - 2014-04-11 13:14 - 00000000 __SHD C:\Users\User\AppData\LocalLow\EmieUserList
2017-07-01 12:23 - 2014-04-11 13:10 - 00000000 __SHD C:\Users\User\AppData\LocalLow\EmieSiteList
2017-07-01 12:03 - 2013-12-16 19:54 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2017-06-30 22:18 - 2016-12-15 23:25 - 00000000 ____D C:\Program Files\Mozilla Firefox
2017-06-30 18:09 - 2013-12-16 14:42 - 00296312 _____ (AVAST Software) C:\Windows\system32\Drivers\aswvmm.sys
2017-06-29 23:22 - 2014-04-29 17:33 - 00170200 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-06-28 23:56 - 2014-08-25 22:35 - 00000000 ____D C:\Users\User\AppData\Local\Adobe
2017-06-28 23:56 - 2014-01-03 14:19 - 00803328 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2017-06-28 23:56 - 2014-01-03 14:19 - 00144896 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2017-06-28 16:51 - 2014-10-21 23:26 - 00157696 ___SH C:\Users\User\Documents\Thumbs.db
2017-06-27 22:46 - 2013-12-16 14:38 - 00002020 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-06-27 12:37 - 2013-12-16 14:38 - 00000000 ____D C:\Program Files\Common Files\Adobe AIR
2017-06-26 16:09 - 2017-02-07 13:03 - 00276704 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswblogx.sys
2017-06-26 16:09 - 2017-02-07 13:03 - 00266976 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbidsdriverx.sys
2017-06-26 16:09 - 2017-02-07 13:03 - 00157384 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbidshx.sys
2017-06-26 16:09 - 2017-02-07 13:03 - 00050352 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbunivx.sys
2017-06-26 16:09 - 2016-03-22 23:05 - 00039752 _____ (AVAST Software) C:\Windows\system32\Drivers\aswKbd.sys
2017-06-26 16:09 - 2014-05-01 16:51 - 00042824 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2017-06-26 16:09 - 2014-01-03 14:19 - 00147688 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2017-06-26 16:09 - 2013-12-16 14:42 - 00774288 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2017-06-26 16:09 - 2013-12-16 14:42 - 00496976 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2017-06-26 16:09 - 2013-12-16 14:42 - 00123896 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2017-06-26 16:09 - 2013-12-16 14:42 - 00099536 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2017-06-26 16:09 - 2013-12-16 14:42 - 00070840 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2017-06-26 16:09 - 2013-12-16 14:42 - 00000000 ____D C:\ProgramData\AVAST Software
2017-06-25 22:41 - 2017-03-25 16:15 - 00000000 ___RD C:\Program Files\Skype
2017-06-25 22:41 - 2016-03-06 19:57 - 00000000 ____D C:\ProgramData\Skype
2017-06-25 19:15 - 2010-11-20 22:01 - 00781790 _____ C:\Windows\system32\PerfStringBackup.INI
2017-06-25 16:08 - 2014-01-03 18:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2017-06-25 16:06 - 2014-01-03 18:17 - 00000000 ____D C:\Users\User\AppData\Roaming\Samsung
2017-06-25 16:06 - 2014-01-03 18:15 - 00000000 ____D C:\Program Files\Samsung
2017-06-25 16:06 - 2013-12-16 15:04 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2017-06-25 13:06 - 2015-08-04 07:28 - 09468448 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atidxx32.dll
2017-06-25 13:06 - 2015-08-04 07:28 - 01194928 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\aticfx32.dll
2017-06-25 13:06 - 2015-08-04 07:28 - 00136624 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiuxpag.dll
2017-06-25 13:06 - 2015-08-04 03:06 - 00564224 _____ (AMD) C:\Windows\system32\atieclxx.exe
2017-06-25 13:06 - 2015-08-04 03:06 - 00259072 _____ (AMD) C:\Windows\system32\atiesrxx.exe
2017-06-25 13:06 - 2015-08-04 02:48 - 00669696 _____ (AMD) C:\Windows\system32\coinst_15.20.dll
2017-06-25 00:42 - 2014-12-10 15:24 - 00000000 ____D C:\Windows\system32\appraiser
2017-06-25 00:42 - 2010-11-21 01:47 - 00000000 ___RD C:\Users\Public\Recorded TV
2017-06-25 00:42 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\registration
2017-06-24 23:13 - 2013-12-23 12:24 - 00000000 ____D C:\AMD
2017-06-24 15:53 - 2009-07-14 05:53 - 00032620 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2017-06-14 16:50 - 2015-12-08 17:41 - 00502976 _____ C:\Windows\system32\FNTCACHE.DAT
2017-06-14 16:50 - 2014-11-06 13:36 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2017-06-14 16:02 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\migwiz
2017-06-14 14:12 - 2013-12-16 15:44 - 00000000 ____D C:\Windows\system32\MRT
2017-06-14 14:07 - 2013-12-16 15:44 - 130903960 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-06-14 14:04 - 2014-11-06 13:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2017-06-03 22:52 - 2015-04-02 18:21 - 00000116 _____ C:\Windows\NeroDigital.ini

==================== Files in the root of some directories =======

2015-09-16 17:04 - 2016-11-22 17:03 - 0000518 _____ () C:\Users\User\AppData\Roaming\burnaware.ini
2014-06-29 16:41 - 2014-10-15 13:30 - 0000097 _____ () C:\Users\User\AppData\Roaming\default.pls
2015-02-09 16:09 - 2015-02-09 16:11 - 0022328 _____ () C:\Users\User\AppData\Roaming\PnkBstrK.sys
2015-04-11 14:44 - 2015-04-11 14:44 - 0000020 ___SH () C:\Users\User\AppData\Roaming\Sys11965 DataCollection.dat
2015-04-11 14:44 - 2015-04-11 14:44 - 0000020 ___SH () C:\Users\User\AppData\Roaming\System413_DataDB.ind
2017-03-26 18:12 - 2017-03-26 18:12 - 1058101 _____ () C:\Users\User\AppData\Local\ars.cache
2017-03-26 18:12 - 2017-03-26 18:12 - 0384255 _____ () C:\Users\User\AppData\Local\census.cache
2015-07-12 23:19 - 2016-09-09 23:24 - 0003584 _____ () C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2017-03-26 17:50 - 2017-03-26 17:50 - 0000036 _____ () C:\Users\User\AppData\Local\housecall.guid.cache
2015-08-11 16:42 - 2015-08-11 16:42 - 0000017 _____ () C:\Users\User\AppData\Local\resmon.resmoncfg
2017-03-26 18:03 - 2017-03-26 18:03 - 0000010 _____ () C:\Users\User\AppData\Local\sponge.last.runtime.cache
2017-02-26 18:03 - 2017-02-26 18:03 - 0000116 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc

Some files in TEMP:
====================
2017-07-03 12:43 - 2017-05-12 19:04 - 1310528 _____ (Microsoft Corporation) C:\Users\User\AppData\Local\Temp\dllnt_dump.dll

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-07-02 19:44

==================== End of FRST.txt ============================
  • 0

#24
RKinner
Posted 03 July 2017 - 10:38 AM

RKinner

    Malware Expert

  • Expert
  • 24,625 posts
  • MVP

OK this time the proxy did not return so I think we got it all.  Unless there are other problems we can clean up:

 

Time to clean up:
 
To delete the Quarantine Folder used by FRST create a fixlist.txt file with just the following line:
 
DeleteQuarantine:
 
Save the fixlist.txt to the same folder as FRST then run FRST and hit Fix.  You can easily delete any other folders and logs.
 
If we installed Speccy it needs to be uninstalled.  Process Explorer, VEW, AdwCleaner, JRT  and their logs and Speccy's log can just be deleted.
 
Also make sure you have the latest versions of any adobe.com products you use like Shockwave, Flash or Acrobat.  Flash is now the most malware targeted program so it must be kept up to date.  Be careful with Adobe.  They are fond of offering optional downloads like yahoo or Ask toolbars or that worthless McAfee Security Scan.  Go slow and uncheck the optional stuff.
 
Whether you use adobe reader, acrobat or fox-it to read pdf files you need to disable Javascript in the program.  There is an exploit out there now that can use it to get on your PC.  For Adobe Reader:  Start, All Programs, Adobe Reader, Edit, Preferences, Click on Javascript in the left column and uncheck Enable Acrobat Javascript.  OK Close program.  It's the same for Foxit reader except you uncheck Enable Javascript Actions. 
 
 
If you use Chrome/Firefox then get the Ublock Origin  Add-on from https://www.ublock.org/.  For IE go to adblockplus.org  and get the add-on.  (It's actually a program for IE)
 
If Chrome/Firefox is slow loading make sure it only has the current Java add-on.  Then download and run Speedy Fox.
http://www.crystalidea.com/speedyfox.  Close Chrome/Firefox/Skpe. Hit Optimize.   You can run it any time that Chrome/Firefox seems slow starting..
 
To prevent a relatively new phishing attack:  In Firefox, type:
 
about:config
 
in the URL box and hit Enter.  You should get a new page of options (if you get a notice about voiding the warranty just cancel the warning).  In the Search box put in 
 
puny
 
You should only get one option:
network.IDN_show_punycode
We want it to say True but by default it is False so double click on it to toggle from False to True.
Close and restart firefox.
 
To test it you can go to:
 
 
If the value is false you will see https://www.apple.cominstead of the correct value
 
 
If you are a Facebook user get the FB Purity extension for your browser:
This will stop all of the suggested pages and ads so that Facebook loads much quicker.
 
 
Be warned:  If you use Limewire, utorrent or any of the other P2P programs you will probably be coming back to the Malware Removal forum.  If you must use P2P then submit any files you get to http://virustotal.combeforeyou open them.
 
Due to a recent rise in the number of Crytolocker infections I am now recommending you install:
 
CryptoPrevent
 
 
The free version does not update on its own so you should check for updated versions once in a while. When you install it the default is NONE which is kind of worthless so change it to Standard or default. If you have problems after installing CryptoPrevent you can just uninstall it.
 
If you have a router, log on to it today and change the default password!  If using a Wireless router you really should be using encryption on the link.  Use the strongest (newest) encryption method that your router and PC wireless adapter support especially if you own a business.  See http://www.king5.com...0637284.htmlandhttp://www.seattlepi...ted-1344185.php for why encryption is important.  If you don't know how, visit the router maker's website.  They all have detailed step by step instructions or a wizard you can download.
 
Special note on Java.  Old Java versions should be removed after first clearing the Java Cache by following the instructions in:
Then remove the old versions by going to Control Panel, Programs and Features and Uninstall all Java programs which are not Java Version 7 update 25 or better.  These may call themselves: Java Runtime, Runtime Environment, Runtime, JRE, Java Virtual Machine, Virtual Machine, Java VM, JVM, VM, J2RE, J2SE.  Get the latest version from Java.com.  They will usually attempt to foist some garbage like the Ask toolbar, Yahoo toolbar or McAfee Security Scan on you as part of the download.  Just uncheck the garbage before the download (or install) starts.  If you use a 64-bit browser and want the 64-bit version of Java you need to use it to visit java.com.
Due to multiple security problems with Java we are now recommending that it not be installed unless you absolutely know you need it.  IF that is the case then go to Control Panel, Java, Security and slide it up to the highest level.  OK.

  • 0

#25
Django2009
Posted 03 July 2017 - 11:37 AM

Django2009

    Member

  • Topic Starter
  • Member
  • PipPip
  • 56 posts

Fix result of Farbar Recovery Scan Tool (x86) Version: 02-07-2017
Ran by User (03-07-2017 18:03:21) Run:4
Running from C:\Users\User\Downloads
Loaded Profiles: User (Available Profiles: User)
Boot Mode: Normal

==============================================

fixlist content:
*****************
DeleteQuarantine:
*****************

"C:\FRST\Quarantine" => removed successfully..

==== End of Fixlog 18:03:37 ====

 

Done and also done all the above things to do.


  • 0

Advertisements

Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP