ok
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 06-12-2017
Ran by any (administrator) on ANY-PC (07-12-2017 10:50:07)
Running from C:\Users\any\Desktop
Loaded Profiles: any (Available Profiles: any)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser not detected!)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApntEx.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\hidfind.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
() C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PrivacyIconClient.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [698712 2013-02-21] (Alps Electric Co., Ltd.)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe [113656 2013-01-23] (Intel Corporation)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4174464 2017-05-23] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [vmware-tray.exe] => C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe [104128 2015-10-18] (VMware, Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-1477751146-2404892005-3129194611-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [10024624 2017-11-08] (Piriform Ltd)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\Parameters: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{0C6985E1-1667-415A-B8DB-5171049BFE5E}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{11269F51-7019-4C34-A30D-7BD50404B7AF}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{5812E880-62D4-4E47-BC5A-0AD777C8A9C7}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{5812E880-62D4-4E47-BC5A-0AD777C8A9C7}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{6E627F9B-B832-405D-B0AB-F2F42EDE8F7C}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{8D60680D-1169-444D-8E2D-F1A706293515}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{971C1E7E-B445-4875-93E4-AD13EC7B7628}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{AB434DF6-B1AF-42A3-B960-0CE5545B86EF}: [NameServer] 8.8.8.8
Internet Explorer:
==================
HKU\S-1-5-21-1477751146-2404892005-3129194611-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
BHO: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_144\bin\ssv.dll [2017-10-05] (Oracle Corporation)
BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_144\bin\jp2ssv.dll [2017-10-05] (Oracle Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2006-10-26] (Microsoft Corporation)
FireFox:
========
FF DefaultProfile: h2cs3zsa.default
FF ProfilePath: C:\Users\any\AppData\Roaming\Mozilla\Firefox\Profiles\h2cs3zsa.default [2017-12-07]
FF Extension: (Adblock Plus) - C:\Users\any\AppData\Roaming\Mozilla\Firefox\Profiles\h2cs3zsa.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2017-12-03]
FF Extension: (Disable Media WMF NV12 format) - C:\Users\any\AppData\Roaming\Mozilla\Firefox\Profiles\h2cs3zsa.default\features\{ffa400d2-9eca-4c42-91ff-dda8aad4a55e}\[email protected] [2017-12-02] [Lagacy]
FF Plugin: @java.com/DTPlugin,version=11.144.2 -> C:\Program Files\Java\jre1.8.0_144\bin\dtplugin\npDeployJava1.dll [2017-10-05] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.144.2 -> C:\Program Files\Java\jre1.8.0_144\bin\plugin2\npjp2.dll [2017-10-05] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.38 -> C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIIPT.dll [2012-05-21] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIUpdater.dll [2012-05-21] (Intel Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6234056 2017-11-01] (Malwarebytes)
S4 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [268704 2017-03-21] ()
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1776864 2017-05-23] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2131760 2017-05-23] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [233936 2017-05-23] (Safer-Networking Ltd.)
S4 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [10803440 2017-08-29] (TeamViewer GmbH)
R2 VMwareHostd; C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe [12465856 2015-10-18] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3750304 2017-03-21] (Intel® Corporation)
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [119680 2017-03-08] (Future Technology Devices International Ltd.)
R2 MBAMChameleon; C:\Windows\System32\Drivers\MbamChameleon.sys [193464 2017-12-02] (Malwarebytes)
R1 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [253880 2017-12-02] (Malwarebytes)
R3 NETwNs64; C:\Windows\System32\DRIVERS\NETwsw01.sys [11534096 2015-05-04] (Intel Corporation)
R3 VBoxNetAdp; C:\Windows\System32\DRIVERS\VBoxNetAdp6.sys [200832 2017-11-22] (Oracle Corporation)
R1 VBoxNetLwf; C:\Windows\System32\DRIVERS\VBoxNetLwf.sys [211704 2017-11-22] (Oracle Corporation)
R2 VMparport; C:\Windows\system32\drivers\VMparport.sys [31936 2015-10-18] (VMware, Inc.)
R0 vsock; C:\Windows\System32\drivers\vsock.sys [75512 2015-10-18] (VMware, Inc.)
R2 vstor2-mntapi20-shared; C:\Windows\SysWow64\drivers\vstor2-mntapi20-shared.sys [34520 2015-07-09] (VMware, Inc.)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-12-07 10:50 - 2017-12-07 10:50 - 000000000 ____D C:\Users\any\Desktop\FRST-OlderVersion
2017-12-06 22:40 - 2017-12-06 22:40 - 008172032 _____ (Malwarebytes) C:\Users\any\Desktop\AdwCleaner.exe
2017-12-06 20:04 - 2017-12-06 20:04 - 036195904 _____ (Adlice Software ) C:\Users\any\Downloads\setup(1).exe
2017-12-06 10:09 - 2017-12-06 10:10 - 000000000 ____D C:\ProgramData\TEMP
2017-12-06 10:09 - 2017-12-06 10:10 - 000000000 ____D C:\Program Files (x86)\SpywareBlaster
2017-12-06 10:09 - 2017-12-06 10:09 - 000001083 _____ C:\Users\Public\Desktop\SpywareBlaster.lnk
2017-12-06 10:09 - 2017-12-06 10:09 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
2017-12-04 18:57 - 2017-12-05 21:06 - 000002567 _____ C:\Users\any\Desktop\Fixlog.txt
2017-12-04 15:47 - 2017-12-04 15:47 - 000255928 _____ (Malwarebytes) C:\Windows\system32\Drivers\445775F3.sys
2017-12-03 20:42 - 2017-12-04 16:04 - 000000000 ____D C:\Users\any\Desktop\mbar
2017-12-03 20:42 - 2017-12-04 16:04 - 000000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2017-12-03 20:42 - 2017-12-03 20:42 - 000255928 _____ (Malwarebytes) C:\Windows\system32\Drivers\55E4E48E.sys
2017-12-03 20:41 - 2017-12-03 20:42 - 014161479 _____ C:\Users\any\Downloads\mbar-1.10.3.1001-nr.exe
2017-12-03 14:45 - 2017-12-06 22:44 - 000000000 ____D C:\AdwCleaner
2017-12-03 14:45 - 2017-12-03 14:45 - 008187336 _____ (Malwarebytes) C:\Users\any\Downloads\adwcleaner_7.0.5.0.exe
2017-12-03 12:46 - 2017-12-03 12:47 - 000034763 _____ C:\Users\any\Desktop\Addition.txt
2017-12-03 12:45 - 2017-05-01 06:25 - 001458856 _____ (Sysinternals - www.sysinternals.com) C:\Users\any\Desktop\procexp64.exe
2017-12-03 12:41 - 2017-12-07 10:50 - 002390528 _____ (Farbar) C:\Users\any\Desktop\FRST64.exe
2017-12-03 12:41 - 2017-12-07 10:50 - 000009722 _____ C:\Users\any\Desktop\FRST.txt
2017-12-03 12:41 - 2017-12-07 10:50 - 000000000 ____D C:\FRST
2017-12-03 12:09 - 2017-12-03 12:45 - 000003325 _____ C:\Users\any\Desktop\Processes.txt
2017-12-03 12:08 - 2017-12-03 12:09 - 000000674 _____ C:\Users\any\Desktop\processname.vbs
2017-12-03 12:06 - 2017-12-03 12:06 - 000532480 _____ (Trend Micro Incorporated) C:\Users\any\Downloads\cwshredder.exe
2017-12-03 12:02 - 2017-12-03 12:02 - 004291320 _____ (BrightFort LLC ) C:\Users\any\Downloads\spywareblastersetup55(2).exe
2017-12-03 12:02 - 2017-12-03 12:02 - 004291320 _____ (BrightFort LLC ) C:\Users\any\Downloads\spywareblastersetup55(1).exe
2017-12-03 12:01 - 2017-12-03 12:01 - 000000000 ____D C:\Users\any\AppData\Local\CrashDumps
2017-12-03 11:56 - 2017-12-06 20:05 - 000028272 _____ C:\Windows\system32\Drivers\TrueSight.sys
2017-12-03 11:56 - 2017-12-06 20:04 - 000000858 _____ C:\Users\Public\Desktop\RogueKiller.lnk
2017-12-03 11:56 - 2017-12-06 20:04 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller
2017-12-03 11:56 - 2017-12-06 20:01 - 000000000 ____D C:\ProgramData\RogueKiller
2017-12-03 11:55 - 2017-12-06 20:04 - 000000000 ____D C:\Program Files\RogueKiller
2017-12-03 11:55 - 2017-12-03 11:55 - 036146872 _____ (Adlice Software ) C:\Users\any\Downloads\setup.exe
2017-12-03 11:25 - 2017-12-03 11:26 - 482629632 _____ C:\Users\any\Desktop\naugatx8620160902.iso
2017-12-03 11:17 - 2017-12-03 11:17 - 000030404 _____ C:\ProgramData\agent.uninstall.1512321414.bdinstall.bin
2017-12-03 00:07 - 2017-12-03 07:48 - 000000000 ____D C:\Users\any\Downloads\Android 4.0.1 Ice Cream Sandwich Virtual Machine
2017-12-03 00:06 - 2017-12-03 00:13 - 477644890 _____ C:\Users\any\Downloads\naugatx8620160902.iso.bz2
2017-12-02 23:45 - 2017-12-02 23:45 - 000000000 ____D C:\Users\any\Documents\Virtual Machines
2017-12-02 23:40 - 2017-12-06 22:47 - 000000000 ____D C:\Users\any\AppData\LocalLow\Mozilla
2017-12-02 23:40 - 2017-12-02 23:40 - 000000000 ____D C:\Users\any\AppData\Roaming\Mozilla
2017-12-02 23:39 - 2017-12-02 23:44 - 000000000 ____D C:\Users\any\AppData\Local\Mozilla
2017-12-02 23:39 - 2017-12-02 23:39 - 000311256 _____ (Mozilla) C:\Users\any\Downloads\Firefox Installer.exe
2017-12-02 23:39 - 2017-12-02 23:39 - 000000936 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-12-02 23:39 - 2017-12-02 23:39 - 000000924 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2017-12-02 23:39 - 2017-12-02 23:39 - 000000000 ____D C:\Program Files\Mozilla Firefox
2017-12-02 23:39 - 2017-12-02 23:39 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-12-02 23:35 - 2017-12-03 12:01 - 000000000 ____D C:\Users\any\AppData\Roaming\VMware
2017-12-02 23:35 - 2017-12-03 12:01 - 000000000 ____D C:\Users\any\AppData\Local\VMware
2017-12-02 23:23 - 2015-10-18 18:33 - 000066752 _____ (VMware, Inc.) C:\Windows\system32\Drivers\vmx86.sys
2017-12-02 23:23 - 2015-10-18 18:33 - 000031936 _____ (VMware, Inc.) C:\Windows\system32\Drivers\VMparport.sys
2017-12-02 23:23 - 2015-10-18 17:53 - 000075512 _____ (VMware, Inc.) C:\Windows\system32\Drivers\vsock.sys
2017-12-02 23:23 - 2015-10-18 17:53 - 000068288 _____ (VMware, Inc.) C:\Windows\system32\vsocklib.dll
2017-12-02 23:23 - 2015-10-18 17:53 - 000064192 _____ (VMware, Inc.) C:\Windows\SysWOW64\vsocklib.dll
2017-12-02 23:21 - 2015-10-18 18:33 - 000934080 _____ (VMware, Inc.) C:\Windows\system32\vnetlib64.dll
2017-12-02 23:21 - 2015-10-18 18:33 - 000391872 _____ (VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
2017-12-02 23:21 - 2015-10-18 18:33 - 000358080 _____ (VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
2017-12-02 23:21 - 2015-10-18 18:11 - 000026816 _____ (VMware, Inc.) C:\Windows\system32\Drivers\vmnetuserif.sys
2017-12-02 23:21 - 2015-10-06 08:02 - 000057536 _____ (VMware, Inc.) C:\Windows\system32\Drivers\hcmon.sys
2017-12-02 23:19 - 2017-12-02 23:19 - 000001024 _____ C:\Windows\SysWOW64\%TMP%
2017-12-02 23:18 - 2017-12-02 23:18 - 000001203 _____ C:\Users\Public\Desktop\VMware Workstation Pro.lnk
2017-12-02 23:18 - 2017-12-02 23:18 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VMware
2017-12-02 23:18 - 2017-12-02 23:18 - 000000000 ____D C:\Program Files\Common Files\VMware
2017-12-02 23:15 - 2017-12-06 22:46 - 000000000 ____D C:\ProgramData\VMware
2017-12-02 23:15 - 2017-12-02 23:15 - 000000000 ____D C:\Users\Public\Documents\Shared Virtual Machines
2017-12-02 23:15 - 2017-12-02 23:15 - 000000000 ____D C:\Program Files (x86)\VMware
2017-12-02 22:57 - 2017-12-02 23:02 - 295212528 _____ (Emsisoft Ltd. ) C:\Users\any\Downloads\EmsisoftAntiMalwareSetup.exe
2017-12-02 22:55 - 2017-12-02 22:55 - 000048459 _____ C:\ProgramData\agent.1512276895.bdinstall.bin
2017-12-02 22:54 - 2017-12-02 22:55 - 000000000 ____D C:\ProgramData\Bitdefender Agent
2017-12-02 22:53 - 2017-12-02 22:53 - 009932672 _____ C:\Users\any\Downloads\bitdefender_online.exe
2017-12-02 22:33 - 2017-12-04 14:39 - 000004130 _____ C:\Windows\System32\Tasks\CCleaner Update
2017-12-02 22:33 - 2017-12-02 22:33 - 000002782 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2017-12-02 22:33 - 2017-12-02 22:33 - 000000822 _____ C:\Users\Public\Desktop\CCleaner.lnk
2017-12-02 22:33 - 2017-12-02 22:33 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2017-12-02 22:33 - 2017-12-02 22:33 - 000000000 ____D C:\Program Files\CCleaner
2017-12-02 22:32 - 2017-12-02 22:32 - 010849904 _____ (Piriform Ltd) C:\Users\any\Downloads\ccsetup537.exe
2017-12-02 22:29 - 2017-12-02 22:29 - 004291320 _____ (BrightFort LLC ) C:\Users\any\Downloads\spywareblastersetup55.exe
2017-12-02 22:15 - 2017-12-02 22:15 - 000001395 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2017-12-02 22:15 - 2017-12-02 22:15 - 000001383 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2017-12-02 22:15 - 2017-12-02 22:15 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2017-12-02 22:14 - 2017-05-23 09:22 - 000032240 _____ (Safer-Networking Ltd.) C:\Windows\system32\sdnclean64.exe
2017-12-02 22:02 - 2017-12-02 22:02 - 000001867 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-12-02 22:02 - 2017-12-02 22:02 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-12-02 22:02 - 2017-12-02 22:02 - 000000000 ____D C:\ProgramData\MB3CoreBackup
2017-12-02 22:02 - 2017-11-01 08:54 - 000077432 _____ C:\Windows\system32\Drivers\mbae64.sys
2017-12-02 21:57 - 2017-12-02 21:57 - 000000085 _____ C:\Windows\wininit.ini
2017-12-02 21:51 - 2017-12-03 20:43 - 000000000 ____D C:\ProgramData\Malwarebytes
2017-12-02 21:51 - 2017-12-02 22:02 - 000253880 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys
2017-12-02 21:51 - 2017-12-02 22:02 - 000193464 _____ (Malwarebytes) C:\Windows\system32\Drivers\MbamChameleon.sys
2017-12-02 21:51 - 2017-12-02 21:51 - 000000000 ____D C:\Program Files\Malwarebytes
2017-12-02 20:54 - 2017-12-02 20:17 - 000001282 _____ C:\Windows\system32\Drivers\etc\hosts.20171202-205444.backup
2017-12-02 20:50 - 2017-12-03 11:18 - 000000000 ____D C:\Windows\pss
2017-12-02 20:47 - 2017-12-02 22:15 - 000000000 ____D C:\ProgramData\Spybot - Search & Destroy
2017-12-02 20:47 - 2017-12-02 22:15 - 000000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2017-12-02 20:34 - 2017-12-02 22:34 - 000000000 ____D C:\Windows\Minidump
2017-12-02 20:25 - 2017-12-02 20:25 - 000000000 ____D C:\Users\any\AppData\Roaming\Macromedia
2017-12-02 20:19 - 2017-12-02 20:19 - 000018772 _____ C:\Users\any\Downloads\O-Demonoid_www.Demonoid.pw-O_VMware_Workstation_Pro_14_0_0_Build_6661328_License_Keys_[SadeemPC].TORRENT
2017-12-02 20:18 - 2017-12-03 11:19 - 000003614 _____ C:\Windows\System32\Tasks\bak6717741k6717741
2017-12-02 20:17 - 2017-12-07 09:52 - 000000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2017-12-02 20:17 - 2017-12-02 20:17 - 000797376 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-12-02 20:17 - 2017-12-02 20:17 - 000142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-12-02 20:17 - 2017-12-02 20:17 - 000003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2017-12-02 20:17 - 2017-12-02 20:17 - 000000000 ____D C:\Windows\SysWOW64\Macromed
2017-12-02 20:17 - 2017-12-02 20:17 - 000000000 ____D C:\Windows\system32\Macromed
2017-12-02 19:59 - 2017-12-02 20:11 - 000000000 ____D C:\Users\any\Downloads\VMware Workstation Pro v12.0.1.3160714 + Serials [TechTools.NET]
2017-12-02 19:14 - 2017-12-02 19:20 - 462422016 _____ C:\Users\any\Desktop\android-x86-4.4-r5.iso
2017-12-01 17:02 - 2017-12-01 17:03 - 000000000 ____D C:\Users\any\VirtualBox VMs
2017-12-01 16:25 - 2017-12-02 20:12 - 000000000 ____D C:\Users\any\.VirtualBox
2017-12-01 16:23 - 2017-12-01 16:23 - 000001076 _____ C:\Users\Public\Desktop\Oracle VM VirtualBox.lnk
2017-12-01 16:23 - 2017-12-01 16:23 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox
2017-12-01 16:22 - 2017-12-01 16:22 - 000000000 ____D C:\Program Files\Oracle
2017-12-01 16:22 - 2017-11-22 17:23 - 000972192 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxDrv.sys
2017-12-01 16:22 - 2017-11-22 17:23 - 000157672 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxUSBMon.sys
2017-12-01 16:20 - 2017-12-01 16:39 - 000000000 ____D C:\Users\any\Desktop\android files
2017-12-01 16:18 - 2017-12-01 16:18 - 000000000 ___RD C:\Users\any\Documents\MEGA
2017-12-01 16:11 - 2017-12-01 16:11 - 000001048 _____ C:\Users\any\Desktop\MEGAsync.lnk
2017-12-01 16:11 - 2017-12-01 16:11 - 000000000 ____D C:\Windows\System32\Tasks\MEGA
2017-12-01 16:11 - 2017-12-01 16:11 - 000000000 ____D C:\Users\any\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MEGAsync
2017-12-01 16:11 - 2017-12-01 16:11 - 000000000 ____D C:\Users\any\AppData\Local\MEGAsync
2017-12-01 16:11 - 2017-12-01 16:11 - 000000000 ____D C:\Users\any\AppData\Local\Mega Limited
2017-12-01 16:10 - 2017-12-01 16:10 - 014976440 _____ (MEGA Limited) C:\Users\any\Downloads\MEGAsyncSetup.exe
2017-12-01 16:08 - 2017-12-01 16:10 - 115120984 _____ (Oracle Corporation) C:\Users\any\Downloads\VirtualBox-5.2.2-119230-Win.exe
2017-12-01 16:08 - 2017-12-01 16:09 - 019504049 _____ C:\Users\any\Downloads\Oracle_VM_VirtualBox_Extension_Pack-5.2.2-119230.vbox-extpack
2017-11-22 17:23 - 2017-11-22 17:23 - 000211704 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetLwf.sys
2017-11-22 17:23 - 2017-11-22 17:23 - 000200832 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetAdp6.sys
2017-11-20 22:45 - 2017-10-17 20:34 - 000134376 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2017-11-20 22:45 - 2017-10-17 20:30 - 000605184 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2017-11-20 22:45 - 2017-10-15 16:04 - 000407392 _____ (Microsoft Corporation) C:\Windows\system32\centel.dll
2017-11-20 22:45 - 2017-10-04 07:04 - 002023936 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2017-11-20 22:45 - 2017-10-04 07:04 - 001570304 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2017-11-20 22:45 - 2017-10-04 07:04 - 000670208 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2017-11-20 22:45 - 2017-10-04 07:04 - 000603648 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2017-11-20 22:45 - 2017-10-04 07:04 - 000370688 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2017-11-20 22:45 - 2017-10-04 07:04 - 000241664 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2017-11-20 22:45 - 2017-10-04 07:04 - 000181760 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2017-11-12 14:39 - 2017-11-12 14:39 - 000006807 _____ C:\Users\any\Desktop\NCSExpert Profiles - PFL.zip.pdf
2017-11-12 14:34 - 2017-11-12 14:34 - 000006807 _____ C:\Users\any\Downloads\NCSExpert Profiles - PFL.zip (5).pdf
2017-11-12 14:34 - 2017-11-12 14:34 - 000006807 _____ C:\Users\any\Downloads\NCSExpert Profiles - PFL.zip (3).pdf
2017-11-12 14:34 - 2017-11-12 14:34 - 000006807 _____ C:\Users\any\Downloads\NCSExpert Profiles - PFL.zip (2).pdf
2017-11-12 14:33 - 2017-11-12 14:33 - 000008376 _____ C:\Users\any\Desktop\attachment.htm
2017-11-12 14:33 - 2017-11-12 14:33 - 000006807 _____ C:\Users\any\Downloads\NCSExpert Profiles - PFl.zip.pdf
2017-11-12 14:33 - 2017-11-12 14:33 - 000006807 _____ C:\Users\any\Downloads\NCSExpert Profiles - PFL.zip
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-12-07 03:51 - 2009-07-13 22:45 - 000021504 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-12-07 03:51 - 2009-07-13 22:45 - 000021504 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-12-06 22:46 - 2009-07-13 23:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2017-12-04 15:10 - 2009-07-13 20:34 - 014155776 _____ C:\Windows\system32\config\HARDWARE
2017-12-03 11:21 - 2009-07-13 23:13 - 000803410 _____ C:\Windows\system32\PerfStringBackup.INI
2017-12-03 11:21 - 2009-07-13 21:20 - 000000000 ____D C:\Windows\inf
2017-12-03 11:12 - 2017-10-10 17:56 - 000000000 ____D C:\Users\any\AppData\Roaming\uTorrent
2017-12-02 23:41 - 2017-05-22 22:01 - 000000000 ____D C:\Program Files (x86)\Google
2017-12-02 23:27 - 2017-05-24 02:20 - 000000000 ____D C:\Windows\system32\appraiser
2017-12-02 23:18 - 2017-05-23 02:37 - 000799000 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2017-12-02 22:35 - 2017-05-27 10:03 - 000000000 ____D C:\Program Files (x86)\TeamViewer
2017-12-02 22:34 - 2017-05-09 00:26 - 000000000 ____D C:\Windows\Panther
2017-12-02 20:54 - 2009-07-13 20:34 - 000451095 ____R C:\Windows\system32\Drivers\etc\hosts.20171202-213611.backup
2017-12-01 17:02 - 2017-05-08 19:32 - 000000000 ____D C:\Users\any
2017-11-12 14:37 - 2017-10-10 17:57 - 000000000 ____D C:\Users\any\Downloads\BMW
==================== Files in the root of some directories =======
2012-05-21 13:00 - 2012-05-21 13:00 - 000020984 _____ (Intel Corporation) C:\Users\any\AppData\Roaming\JomCap.dll
Some files in TEMP:
====================
2017-12-02 22:01 - 2017-12-02 22:01 - 000079552 _____ (Microsoft Corporation) C:\Users\any\AppData\Local\Temp\2828.tmp.exe
2017-12-02 22:01 - 2017-12-02 22:01 - 078346672 _____ (Malwarebytes ) C:\Users\any\AppData\Local\Temp\54A4.tmp.exe
2017-12-02 22:13 - 2017-12-02 22:13 - 051725936 _____ (Safer-Networking Ltd. ) C:\Users\any\AppData\Local\Temp\8F91.tmp.exe
2017-12-02 21:00 - 2017-12-02 21:00 - 007794352 _____ () C:\Users\any\AppData\Local\Temp\9C8C.tmp.exe
2017-12-03 11:56 - 2017-05-12 12:24 - 001732864 _____ (Microsoft Corporation) C:\Users\any\AppData\Local\Temp\dllnt_dump.dll
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2017-12-01 17:38
==================== End of FRST.txt ============================