Publicité
Publicité
Format du document : text/plain
Prévisualisation
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:05-03-2016 01
Ran by DOS (administrator) on YAHYA (10-04-2016 19:51:23)
Running from C:\Users\DOS\Desktop
Loaded Profiles: DOS (Available Profiles: DOS)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(IObit) C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\ekrn.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Program Files (x86)\RocketDock\RocketDock.exe
(IObit) C:\Program Files (x86)\IObit\Advanced SystemCare\ASCTray.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(Tonec Inc.) C:\Program Files (x86)\Internet Download Manager\IDMan.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Zbshareware Lab) C:\Program Files (x86)\USB Disk Security\USBGuard.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(Tonec Inc.) C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() E:\Downloads\Compressed\DestV1.7.1\mainplug.ocx
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [16408320 2016-03-18] (Realtek Semiconductor)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-08-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [595480 2016-03-20] (Oracle Corporation)
HKLM-x32\...\Run: [USB Security] => C:\Program Files (x86)\USB Disk Security\USBGuard.exe [695528 2015-01-31] (Zbshareware Lab)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-568589206-187183825-684968512-1000\...\Run: [RocketDock] => C:\Program Files (x86)\RocketDock\RocketDock.exe [630784 2007-03-19] ()
HKU\S-1-5-21-568589206-187183825-684968512-1000\...\Run: [Advanced SystemCare 9] => C:\Program Files (x86)\IObit\Advanced SystemCare\ASCTray.exe [2019616 2016-01-11] (IObit)
HKU\S-1-5-21-568589206-187183825-684968512-1000\...\Run: [IDMan] => C:\Program Files (x86)\Internet Download Manager\IDMan.exe [3907152 2015-08-29] (Tonec Inc.)
HKU\S-1-5-21-568589206-187183825-684968512-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8686296 2016-03-11] (Piriform Ltd)
HKU\S-1-5-21-568589206-187183825-684968512-1000\...\Run: [CCleaner] => C:\Program Files\CCleaner\CCleaner64.exe [8686296 2016-03-11] (Piriform Ltd)
HKU\S-1-5-21-568589206-187183825-684968512-1000\...\Policies\Explorer: [NolowDiskSpaceChecks] 1
ShellIconOverlayIdentifiers: [ IDM Shell Extension] -> {CDC95B92-E27C-4745-A8C5-64A52A78855D} => C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll [2015-08-14] (Tonec Inc.)
ShellIconOverlayIdentifiers: [###MegaShellExtPending] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\DOS\AppData\Local\MEGAsync\ShellExtX64.dll [2014-05-01] ()
ShellIconOverlayIdentifiers: [###MegaShellExtSynced] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\DOS\AppData\Local\MEGAsync\ShellExtX64.dll [2014-05-01] ()
ShellIconOverlayIdentifiers: [###MegaShellExtSyncing] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\DOS\AppData\Local\MEGAsync\ShellExtX64.dll [2014-05-01] ()
ShellIconOverlayIdentifiers-x32: [###MegaShellExtPending] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\DOS\AppData\Local\MEGAsync\ShellExtX32.dll [2014-05-01] ()
ShellIconOverlayIdentifiers-x32: [###MegaShellExtSynced] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\DOS\AppData\Local\MEGAsync\ShellExtX32.dll [2014-05-01] ()
ShellIconOverlayIdentifiers-x32: [###MegaShellExtSyncing] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\DOS\AppData\Local\MEGAsync\ShellExtX32.dll [2014-05-01] ()
ShellIconOverlayIdentifiers-x32: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\SysWOW64\AcSignIcon.dll [2006-03-04] (Autodesk)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{DDC8C1E7-C3A1-4ACF-8826-760145FD82A2}: [DhcpNameServer] 192.168.1.1
Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-568589206-187183825-684968512-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-568589206-187183825-684968512-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-568589206-187183825-684968512-1000\Software\Microsoft\Internet Explorer\Main,Start Default_Page_URL = hxxps://www.google.com/
HKU\S-1-5-21-568589206-187183825-684968512-1000\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = hxxps://www.google.com/
HKU\S-1-5-21-568589206-187183825-684968512-1000\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxps://www.google.com/
SearchScopes: HKLM -> DefaultScope value is missing
SearchScopes: HKLM-x32 -> DefaultScope value is missing
SearchScopes: HKU\S-1-5-21-568589206-187183825-684968512-1000 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
BHO: IDM integration (IDMIEHlprObj Class) -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll [2015-08-28] (Internet Download Manager, Tonec Inc.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: IDM integration (IDMIEHlprObj Class) -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll [2015-08-28] (Internet Download Manager, Tonec Inc.)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_77\bin\ssv.dll [2016-03-29] (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_77\bin\jp2ssv.dll [2016-03-29] (Oracle Corporation)
FireFox:
========
FF ProfilePath: C:\Users\DOS\AppData\Roaming\Mozilla\Firefox\Profiles\t0h5x25y.default-1424368493781
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_21_0_0_197.dll [2016-03-29] ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\system32\npDeployJava1.dll [2013-09-21] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_197.dll [2016-03-29] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1224194.dll [2016-02-19] (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-10-14] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.77.2 -> C:\Program Files (x86)\Java\jre1.8.0_77\bin\dtplugin\npDeployJava1.dll [2016-03-29] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.77.2 -> C:\Program Files (x86)\Java\jre1.8.0_77\bin\plugin2\npjp2.dll [2016-03-29] (Oracle Corporation)
FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files (x86)\Yahoo!\Shared\npYState.dll [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-02] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-02] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=1.0.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2011-07-14] (the VideoLAN Team)
FF Plugin-x32: @videolan.org/vlc,version=1.1.11 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2011-07-14] (the VideoLAN Team)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-12-18] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-568589206-187183825-684968512-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [No File]
FF user.js: detected! => C:\Users\DOS\AppData\Roaming\Mozilla\Firefox\Profiles\t0h5x25y.default-1424368493781\user.js [2016-04-10]
FF Extension: IDM integration - C:\Program Files (x86)\Internet Download Manager\idmmzcc2.xpi [2015-08-14]
FF Extension: IE Tab 2 (FF 3.6+) - C:\Users\DOS\AppData\Roaming\Mozilla\Firefox\Profiles\t0h5x25y.default-1424368493781\extensions\{1BC9BA34-1EED-42ca-A505-6D2F1A935BBB} [2016-03-07]
FF Extension: anonymoX - C:\Users\DOS\AppData\Roaming\Mozilla\Firefox\Profiles\t0h5x25y.default-1424368493781\Extensions\client@anonymox.net.xpi [2016-03-26]
FF Extension: ZenMate Security, Privacy & Unblock VPN - C:\Users\DOS\AppData\Roaming\Mozilla\Firefox\Profiles\t0h5x25y.default-1424368493781\Extensions\firefox@zenmate.com.xpi [2016-03-22]
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi [2016-03-19] [not signed]
FF HKU\S-1-5-21-568589206-187183825-684968512-1000\...\Firefox\Extensions: [mozilla_cc2@internetdownloadmanager.com] - C:\Program Files (x86)\Internet Download Manager\idmmzcc2.xpi
FF HKU\S-1-5-21-568589206-187183825-684968512-1000\...\SeaMonkey\Extensions: [mozilla_cc@internetdownloadmanager.com] - C:\Users\DOS\AppData\Roaming\IDM\idmmzcc5 => not found
Chrome:
=======
CHR HomePage: Profile 1 -> hxxps://www.google.jo/
CHR StartupUrls: Profile 1 -> "hxxps://www.google.jo/"
CHR Profile: C:\Users\DOS\AppData\Local\Google\Chrome\User Data\Profile 1
CHR Extension: (MEGA) - C:\Users\DOS\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\bigefpfhnfcobdlfbedofhhaibnlghod [2016-04-08]
CHR Extension: (anonymoX) - C:\Users\DOS\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\icpklikeghomkemdellmmkoifgfbakio [2016-04-09]
CHR Extension: (IDM Integration Module) - C:\Users\DOS\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ngpampappnmepgilojfohadhhmbhlaek [2016-04-07]
CHR Extension: (Chrome Web Store Payments) - C:\Users\DOS\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-02]
CHR Extension: (TunnelBear VPN) - C:\Users\DOS\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\omdakjcmkglenbhjadbccaookpfjihpa [2016-04-03]
CHR Extension: (OneClick Cleaner for Chrome) - C:\Users\DOS\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\oncckmaelaecccmaniihojgeopkcajfh [2015-10-04]
CHR HKLM\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx [2015-08-28]
CHR HKLM-x32\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx [2015-08-28]
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AdvancedSystemCareService9; C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe [446240 2016-01-05] (IObit)
S3 Autodesk Licensing Service; C:\Program Files (x86)\Common Files\Autodesk Shared\Service\AdskScSrv.exe [77944 2013-10-01] (Autodesk)
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2519904 2016-03-25] (ESET)
S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [3398096 2015-02-10] (INCA Internet Co., Ltd.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-07-15] (Microsoft Corporation)
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [310728 2015-12-08] ()
S3 b06diag; C:\Windows\system32\drivers\bxdiaga.sys [88104 2012-03-08] (Broadcom Corporation)
S3 BFN7x64; C:\Windows\system32\drivers\Xeno7x64.sys [157288 2012-02-22] (Bigfoot Networks, Inc.)
S3 bxfcoe; C:\Windows\system32\drivers\bxfcoe.sys [178216 2012-02-22] (Broadcom Corporation)
S3 bxois; C:\Windows\system32\drivers\bxois.sys [539176 2012-02-22] (Broadcom Corporation)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [264552 2016-03-25] (ESET)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3341904 2012-03-26] (Broadcom Corporation)
U5 edevmon; C:\Windows\System32\Drivers\edevmon.sys [251632 2015-07-13] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [186784 2016-01-30] (ESET)
R2 ekbdflt; C:\Windows\System32\DRIVERS\ekbdflt.sys [142976 2016-01-30] (ESET)
R1 epfw; C:\Windows\System32\DRIVERS\epfw.sys [198096 2016-03-25] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [53384 2016-03-25] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [84800 2016-03-25] (ESET)
S3 EtronSTOR; C:\Windows\System32\Drivers\EtronSTOR.sys [32512 2012-07-24] (Etron Technology Inc)
S3 GGSAFERDriver; no ImagePath
S3 gkernel; no ImagePath
R1 HWiNFO32; C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [26528 2015-06-29] (REALiX(tm))
S3 igfx; C:\Windows\System32\DRIVERS\igdkmd64.sys [10629408 2012-11-15] (Intel Corporation) [File not signed]
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43168 2015-12-08] ()
S3 orange_zte_cdc_acm; C:\Windows\System32\DRIVERS\orange_zte_cdc_acm.sys [77824 2013-09-30] (ZTE) [File not signed]
S3 orange_zte_cpo; C:\Windows\System32\DRIVERS\orange_zte_cpo.sys [14336 2013-09-30] (ZTE) [File not signed]
S4 secdrv; C:\Windows\SysWow64\Drivers\secdrv.sys [11616 2001-08-03] () [File not signed]
R0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [21184 2014-06-04] (IObit)
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [24688 2016-04-07] ()
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2015-06-17] (Apple, Inc.) [File not signed]
S3 catchme; \??\C:\Users\DOS\AppData\Local\Temp\catchme.sys [X]
S3 cpuz138; \??\C:\Users\DOS\AppData\Local\Temp\cpuz138\cpuz138_x64.sys [X]
S3 huawei_cdcacm; system32\DRIVERS\ew_jucdcacm.sys [X]
S3 huawei_cdcecm; system32\DRIVERS\ew_jucdcecm.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 huawei_ext_ctrl; system32\DRIVERS\ew_juextctrl.sys [X]
S3 huawei_wwanecm; system32\DRIVERS\ew_juwwanecm.sys [X]
S3 USBPNPA; system32\drivers\CM10864.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-04-10 19:51 - 2016-04-10 19:52 - 00018867 _____ C:\Users\DOS\Desktop\FRST.txt
2016-04-10 19:51 - 2016-04-10 19:51 - 00000000 ____D C:\FRST
2016-04-10 19:50 - 2016-04-10 19:27 - 02374144 _____ (Farbar) C:\Users\DOS\Desktop\FRST64.exe
2016-04-10 15:51 - 2016-04-10 19:44 - 00000000 ____D C:\Users\DOS\AppData\Local\CrashDumps
2016-04-10 04:40 - 2016-04-08 16:40 - 00000040 ____H C:\Program Files (x86)\51fbcc42.tmp
2016-04-10 04:18 - 2016-04-10 04:18 - 00127462 _____ C:\Users\DOS\Desktop\ZHPDiag.txt
2016-04-10 04:09 - 2016-04-10 04:09 - 00000000 ____D C:\Users\DOS\AppData\Roaming\ProductData
2016-04-10 04:09 - 2016-04-10 04:09 - 00000000 ____D C:\ProgramData\ProductData
2016-04-10 04:09 - 2016-04-10 04:09 - 00000000 ____D C:\ProgramData\IDM
2016-04-10 03:34 - 2016-04-10 03:34 - 00000000 ____D C:\zoek
2016-04-10 02:33 - 2016-04-10 03:39 - 00003230 _____ C:\runcheck.txt
2016-04-10 02:33 - 2016-04-10 03:38 - 00000000 ____D C:\zoek_backup
2016-04-10 02:11 - 2016-04-10 02:11 - 00001805 _____ C:\Users\Public\Desktop\ZHPFix.lnk
2016-04-10 02:11 - 2016-04-10 02:11 - 00001805 _____ C:\ProgramData\Desktop\ZHPFix.lnk
2016-04-10 02:10 - 2016-04-10 02:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP
2016-04-10 02:09 - 2016-04-10 02:09 - 00000000 _____ C:\Users\DOS\Desktop\help.txt
2016-04-09 18:17 - 2016-04-09 18:17 - 00002780 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2016-04-09 18:17 - 2016-04-09 18:17 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk
2016-04-09 18:17 - 2016-04-09 18:17 - 00000822 _____ C:\ProgramData\Desktop\CCleaner.lnk
2016-04-09 18:17 - 2016-04-09 18:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2016-04-09 18:17 - 2016-04-09 18:17 - 00000000 ____D C:\Program Files\CCleaner
2016-04-09 18:04 - 2016-04-09 21:25 - 00500072 _____ C:\Windows\system32\FNTCACHE.DAT
2016-04-09 12:48 - 2016-04-10 04:11 - 00000815 _____ C:\Users\DOS\Desktop\ZHPDiag.lnk
2016-04-09 12:39 - 2016-04-09 21:26 - 00163176 _____ C:\Users\DOS\AppData\Local\GDIPFONTCACHEV1.DAT
2016-04-09 12:39 - 2016-04-09 12:39 - 00002858 _____ C:\Windows\System32\Tasks\ASC9_SkipUac_DOS
2016-04-09 11:29 - 2011-06-26 09:45 - 00256000 _____ C:\Windows\PEV.exe
2016-04-09 11:29 - 2010-11-07 20:20 - 00208896 _____ C:\Windows\MBR.exe
2016-04-09 11:29 - 2009-04-20 07:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2016-04-09 11:29 - 2000-08-31 03:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2016-04-09 11:29 - 2000-08-31 03:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2016-04-09 11:29 - 2000-08-31 03:00 - 00098816 _____ C:\Windows\sed.exe
2016-04-09 11:29 - 2000-08-31 03:00 - 00080412 _____ C:\Windows\grep.exe
2016-04-09 11:29 - 2000-08-31 03:00 - 00068096 _____ C:\Windows\zip.exe
2016-04-09 11:28 - 2016-04-09 12:33 - 00000000 ____D C:\Qoobox
2016-04-09 02:29 - 2016-04-09 21:28 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-04-09 02:29 - 2016-04-09 02:29 - 00001058 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-04-09 02:29 - 2016-04-09 02:29 - 00001058 _____ C:\ProgramData\Desktop\Malwarebytes Anti-Malware.lnk
2016-04-09 02:29 - 2016-04-09 02:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-04-09 02:29 - 2016-04-09 02:29 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-04-09 02:29 - 2016-03-10 14:09 - 00064896 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-04-09 02:29 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-04-09 02:29 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-04-08 23:53 - 2016-04-08 20:39 - 02179584 _____ C:\Users\DOS\Desktop\ZHPDiag3.exe
2016-04-08 19:50 - 2016-04-08 19:50 - 00000000 ____D C:\Users\DOS\Downloads\Video
2016-04-08 19:50 - 2016-04-08 19:50 - 00000000 ____D C:\Users\DOS\Downloads\Compressed
2016-04-08 19:46 - 2016-04-08 19:46 - 00000000 ____D C:\Windows\Tasks\ImCleanDisabled
2016-04-08 01:07 - 2016-04-08 19:45 - 00000000 ____D C:\AdsFix
2016-04-07 03:52 - 2016-04-10 04:19 - 00000000 ____D C:\Users\DOS\AppData\Roaming\ZHP
2016-04-07 01:47 - 2016-04-08 18:37 - 00000000 ____D C:\Program Files (x86)\PingPlotter
2016-04-07 01:47 - 2016-04-07 01:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PingPlotter
2016-04-07 01:46 - 2016-04-07 01:46 - 00000000 ____D C:\Users\DOS\AppData\Roaming\Downloaded Installations
2016-04-06 15:44 - 2016-04-06 15:44 - 00000000 ____H C:\asc_rdflag
2016-04-06 14:34 - 2016-04-06 14:34 - 05576400 _____ C:\Windows\system32\Drivers\RTAIODAT.DAT
2016-04-06 14:34 - 2016-04-06 14:34 - 04803840 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RTKVHD64.sys
2016-04-06 14:34 - 2016-04-06 14:34 - 03299832 _____ (Yamaha Corporation) C:\Windows\system32\YamahaAE2.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 03283248 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkApi64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 03198720 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtPgEx64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 02894976 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTSnMg64.cpl
2016-04-06 14:34 - 2016-04-06 14:34 - 02190992 _____ (Yamaha Corporation) C:\Windows\system32\YamahaAE.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 02110600 _____ (Waves Audio Ltd.) C:\Windows\system32\WavesGUILib64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 01943624 _____ (DTS, Inc.) C:\Windows\system32\sltech64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 01435152 _____ (Synopsys, Inc.) C:\Windows\system32\SRRPTR64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 01382240 _____ (TOSHIBA Corporation) C:\Windows\system32\tosade.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 01356512 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTCOM64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 01330072 _____ (DTS, Inc.) C:\Windows\system32\slcnt64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 01022872 _____ (DTS, Inc.) C:\Windows\system32\sl3apo64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00965032 _____ (Sony Corporation) C:\Windows\system32\SFSS_APO.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00927424 _____ (Sound Research, Corp.) C:\Windows\system32\SEHDRA64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00888480 _____ (TOSHIBA Corporation) C:\Windows\system32\tossaeapo64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00873472 _____ (TOSHIBA Corporation) C:\Windows\system32\tadefxapo264.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00716104 _____ (Sound Research, Corp.) C:\Windows\system32\SECOMN64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00689888 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtDataProc64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00596120 _____ (TOSHIBA Corporation) C:\Windows\system32\tosasfapo64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00589080 _____ (Sound Research, Corp.) C:\Windows\SysWOW64\SECOMN32.DLL
2016-04-06 14:34 - 2016-04-06 14:34 - 00532384 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSX64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00467168 _____ (Synopsys, Inc.) C:\Windows\system32\SRAPO64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00450128 _____ (Sound Research, Corp.) C:\Windows\system32\SEAPO64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00387320 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEP64A.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00381416 _____ (Synopsys, Inc.) C:\Windows\system32\SRCOM64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00343712 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtlCPAPI64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00341160 _____ (Synopsys, Inc.) C:\Windows\SysWOW64\SRCOM.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00341160 _____ (Synopsys, Inc.) C:\Windows\system32\SRCOM.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00321720 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DHT64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00321720 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DAA64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00258504 _____ (TODO:) C:\Windows\system32\slprp64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00231920 _____ (Synopsys, Inc.) C:\Windows\system32\SFNHK64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00224264 _____ (TOSHIBA Corporation) C:\Windows\system32\tossaemaxapo64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00221976 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSH64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00214840 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEED64A.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00209536 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSHP64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00192992 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCfg64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00172584 _____ (TOSHIBA Corporation) C:\Windows\system32\toseaeapo64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00166208 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSWOW64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00158704 _____ (TOSHIBA Corporation) C:\Windows\system32\tadefxapo.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00110984 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEL64A.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00090920 _____ (Synopsys, Inc.) C:\Windows\system32\SFCOM64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00088352 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEG64A.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00088328 _____ (Synopsys, Inc.) C:\Windows\system32\SFAPO64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00083632 _____ (Virage Logic Corporation / Sonic Focus) C:\Windows\SysWOW64\SFCOM.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00075544 _____ (TOSHIBA CORPORATION.) C:\Windows\system32\tepeqapo64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 72203792 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoRes64.dat
2016-04-06 14:33 - 2016-04-06 14:33 - 14057256 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioRealtek64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 13120760 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVoiceAPO3064.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 12986528 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVoiceAPO4064.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 10521552 _____ (Intel Corporation) C:\Windows\system32\IntelSSTAPO.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 07172920 _____ (Dolby Laboratories) C:\Windows\system32\R4EEP64A.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 07096192 _____ (Dolby Laboratories) C:\Windows\system32\DDPP64A.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 06343320 _____ (Nahimic Inc) C:\Windows\system32\NAHIMICV3apo.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 06264640 _____ (Dolby Laboratories) C:\Windows\system32\DDPP64AF3.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 05777704 _____ (Nahimic Inc) C:\Windows\system32\NAHIMICV2apo.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 05338936 _____ (Dolby Laboratories) C:\Windows\system32\DolbyDAX2APOv211.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 05289952 _____ (Nahimic Inc) C:\Windows\system32\NAHIMICAPOlfx.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 03282032 _____ (Fortemedia Corporation) C:\Windows\system32\FMAPO64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 02823280 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO7064.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 02714568 _____ (Realtek Semiconductor Corp.) C:\Windows\SysWOW64\RltkAPO.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 02437144 _____ (Dolby Laboratories) C:\Windows\system32\DolbyDAX2APOv201.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 02050184 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioEQ64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 02049664 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoInstII64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 01965816 _____ (Dolby Laboratories) C:\Windows\system32\DDPD64A.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 01959608 _____ (Dolby Laboratories) C:\Windows\system32\DDPD64AF3.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 01780624 _____ (DTS) C:\Windows\system32\DTSS2SpeakerDLL64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 01591064 _____ (DTS) C:\Windows\system32\DTSS2HeadphoneDLL64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 01508936 _____ (DTS) C:\Windows\system32\DTSBoostDLL64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 01421104 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO6064.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 01334384 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxSpeechAPO64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 01211840 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO5064.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 01186168 _____ (Intel Corporation) C:\Windows\system32\IntelSstCApoPropPage.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 01164336 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO4064.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 01060504 _____ (Dolby Laboratories) C:\Windows\system32\DolbyDAX2APOProp.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 01003864 _____ (Nahimic Inc) C:\Windows\system32\NahimicAPONSControl.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00998032 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVoiceAPO2064.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00931624 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPOShell64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00923752 _____ (Sony Corporation) C:\Windows\system32\MISS_APO.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00743968 _____ (DTS) C:\Windows\system32\DTSBassEnhancementDLL64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00727440 _____ (DTS) C:\Windows\system32\DTSSymmetryDLL64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00708320 _____ (DTS) C:\Windows\system32\DTSVoiceClarityDLL64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00678192 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO30.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00677680 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVolumeSDAPO.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00618192 _____ (Knowles Acoustics ) C:\Windows\system32\KAAPORT64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00514528 _____ (DTS) C:\Windows\system32\DTSU2PLFX64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00504312 _____ (DTS) C:\Windows\system32\DTSNeoPCDLL64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00500560 _____ (DTS) C:\Windows\system32\DTSU2PGFX64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00471336 _____ (ICEpower a/s) C:\Windows\system32\ICEsoundAPO64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00447720 _____ (Dolby Laboratories) C:\Windows\system32\R4EED64A.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00445408 _____ (DTS) C:\Windows\system32\DTSLimiterDLL64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00441272 _____ (DTS) C:\Windows\system32\DTSGainCompensatorDLL64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00428232 _____ (DTS) C:\Windows\system32\DTSU2PREC64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00416512 _____ (Harman) C:\Windows\system32\HMUI.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00370840 _____ (Dolby Laboratories) C:\Windows\system32\HiFiDAX2API.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00366128 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\HMAPO.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00362056 _____ (Dolby Laboratories) C:\Windows\system32\DDPO64AF3.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00360352 _____ (Harman) C:\Windows\system32\HMClariFi.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00330568 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO20.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00327464 _____ (Dolby Laboratories) C:\Windows\system32\DDPO64A.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00310424 _____ (Dolby Laboratories) C:\Windows\system32\DDPA64F3.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00272720 _____ (Dolby Laboratories) C:\Windows\system32\DDPA64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00253904 _____ (DTS) C:\Windows\system32\DTSGFXAPO64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00253872 _____ (DTS) C:\Windows\system32\DTSLFXAPO64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00252880 _____ (DTS) C:\Windows\system32\DTSGFXAPONS64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00203848 _____ (Harman) C:\Windows\system32\HMHVS.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00190944 _____ (Harman) C:\Windows\system32\HMEQ_Voice.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00190944 _____ (Harman) C:\Windows\system32\HMEQ.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00179608 _____ (Harman) C:\Windows\system32\HMLimiter.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00151792 _____ (Dolby Laboratories) C:\Windows\system32\R4EEL64A.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00134208 _____ (Dolby Laboratories) C:\Windows\system32\R4EEA64A.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00084624 _____ (Dolby Laboratories) C:\Windows\system32\R4EEG64A.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00065792 _____ (Harman) C:\Windows\system32\HarmanAudioInterface.dll
2016-04-06 14:32 - 2016-04-06 14:32 - 01601952 _____ (Conexant Systems Inc.) C:\Windows\system32\CX64APO.dll
2016-04-06 14:32 - 2016-04-06 14:32 - 00574760 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAC64.dll
2016-04-06 14:32 - 2016-04-06 14:32 - 00122328 _____ (Real Sound Lab SIA) C:\Windows\system32\CONEQMSAPOGUILibrary.dll
2016-04-06 14:32 - 2016-04-06 14:32 - 00118600 _____ C:\Windows\system32\AcpiServiceVnA64.dll
2016-04-06 14:32 - 2016-04-06 14:32 - 00118600 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAR64.dll
2016-04-06 14:32 - 2016-04-06 14:32 - 00105312 _____ C:\Windows\system32\audioLibVc.dll
2016-04-06 14:19 - 2016-04-06 14:19 - 00001126 _____ C:\Users\Public\Desktop\Smart Defrag 4.lnk
2016-04-06 14:19 - 2016-04-06 14:19 - 00001126 _____ C:\ProgramData\Desktop\Smart Defrag 4.lnk
2016-04-06 14:19 - 2016-04-06 14:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Smart Defrag 4
2016-04-06 14:19 - 2016-01-28 18:23 - 00033704 _____ (IObit) C:\Windows\system32\SmartDefragBootTime.exe
2016-04-06 14:19 - 2015-01-10 15:32 - 00128288 _____ (IObit) C:\Windows\SysWOW64\IObitSmartDefragExtension.dll20160406141924.dll
2016-04-06 14:19 - 2015-01-10 15:32 - 00128288 _____ (IObit) C:\Windows\system32\IObitSmartDefragExtension.dll
2016-04-06 14:19 - 2014-06-04 15:17 - 00021184 _____ (IObit) C:\Windows\system32\Drivers\SmartDefragDriver.sys
2016-04-06 12:40 - 2016-04-06 12:40 - 00001322 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IObit Uninstaller.lnk
2016-04-06 12:40 - 2016-04-06 12:40 - 00001310 _____ C:\Users\Public\Desktop\IObit Uninstaller.lnk
2016-04-06 12:40 - 2016-04-06 12:40 - 00001310 _____ C:\ProgramData\Desktop\IObit Uninstaller.lnk
2016-04-06 12:40 - 2016-04-06 12:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IObit Uninstaller
2016-04-06 12:39 - 2016-04-06 13:00 - 00002212 _____ C:\Users\Public\Desktop\Advanced SystemCare 9.lnk
2016-04-06 12:39 - 2016-04-06 13:00 - 00002212 _____ C:\ProgramData\Desktop\Advanced SystemCare 9.lnk
2016-04-06 12:39 - 2016-04-06 12:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced SystemCare
2016-04-01 01:15 - 2016-04-10 18:54 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-04-01 01:15 - 2016-04-01 01:15 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2016-03-22 17:25 - 2016-03-22 17:25 - 04477829 _____ C:\ملف تفعيل ام.dll
2016-03-19 12:56 - 2016-03-19 13:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-03-18 02:53 - 2016-03-18 02:53 - 03152591 _____ C:\Windows\system32\Drivers\rtkSSTsetting.dat
2016-03-18 02:53 - 2016-03-18 02:53 - 03052880 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RltkAPO64.dll
2016-03-18 02:53 - 2016-03-18 02:53 - 00023696 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCoLDR64.dll
2016-03-18 02:50 - 2016-03-18 02:50 - 01027840 _____ (Realtek ) C:\Windows\system32\Drivers\Rt64win7.sys
2016-03-18 02:50 - 2016-03-18 02:50 - 00082544 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RtNicProp64.dll
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-04-10 19:44 - 2009-07-14 06:20 - 00000000 ____D C:\Windows\inf
2016-04-10 19:22 - 2014-03-27 19:04 - 00000842 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-04-10 11:45 - 2009-07-14 07:45 - 00026768 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-04-10 11:45 - 2009-07-14 07:45 - 00026768 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-04-10 11:37 - 2014-03-27 19:04 - 00000838 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-04-10 11:36 - 2014-02-23 13:46 - 00065536 _____ C:\Windows\system32\Ikeext.etl
2016-04-10 11:36 - 2009-07-14 08:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-04-10 08:01 - 2009-07-14 06:20 - 00000000 ____D C:\Windows\tracing
2016-04-10 05:36 - 2013-10-09 19:08 - 00000000 ____D C:\Users\DOS\AppData\Roaming\DMCache
2016-04-10 02:10 - 2015-09-16 04:24 - 00000000 ____D C:\Program Files (x86)\ZHPFix
2016-04-09 21:23 - 2015-12-20 17:16 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2016-04-09 18:40 - 2015-12-10 21:58 - 00000000 ____D C:\Users\DOS\AppData\Roaming\IDM
2016-04-09 18:22 - 2015-09-24 17:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2016-04-09 12:26 - 2009-07-14 05:34 - 00000314 _____ C:\Windows\system.ini
2016-04-09 11:51 - 2010-02-09 17:00 - 00000000 ____D C:\Users\DOS
2016-04-09 10:01 - 2013-09-27 02:11 - 00000000 ____D C:\Windows\Minidump
2016-04-09 00:12 - 2009-07-14 06:20 - 00000000 ____D C:\Windows\system
2016-04-09 00:04 - 2016-01-26 18:06 - 00000000 ____D C:\Users\DOS\AppData\Local\Ubisoft Game Launcher
2016-04-08 16:04 - 2014-04-30 20:44 - 00000000 ____D C:\Program Files (x86)\Garena Plus
2016-04-08 01:07 - 2009-07-14 08:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2016-04-08 01:07 - 2009-07-14 06:20 - 00000000 ____D C:\Windows\Web
2016-04-07 20:12 - 2014-11-25 22:16 - 00000000 ____D C:\ProgramData\RogueKiller
2016-04-07 19:37 - 2014-11-25 22:16 - 00024688 _____ C:\Windows\system32\Drivers\TrueSight.sys
2016-04-07 15:28 - 2014-05-09 11:51 - 02583974 _____ C:\Windows\system32\perfh001.dat
2016-04-07 15:28 - 2014-05-09 11:51 - 01415004 _____ C:\Windows\system32\perfh00C.dat
2016-04-07 15:28 - 2014-05-09 11:51 - 00822334 _____ C:\Windows\system32\perfc00C.dat
2016-04-07 15:28 - 2014-05-09 11:51 - 00807420 _____ C:\Windows\system32\perfc001.dat
2016-04-07 15:28 - 2009-07-14 08:13 - 00006812 _____ C:\Windows\system32\PerfStringBackup.INI
2016-04-06 15:44 - 2015-07-15 12:01 - 132743168 _____ C:\Windows\system32\config\SOFTWARE.iodefrag.bak
2016-04-06 15:44 - 2015-07-15 12:01 - 00294912 _____ C:\Windows\system32\config\DEFAULT.iodefrag.bak
2016-04-06 15:44 - 2015-07-15 12:01 - 00036864 _____ C:\Windows\system32\config\SECURITY.iodefrag.bak
2016-04-06 15:44 - 2015-07-15 12:01 - 00032768 _____ C:\Windows\system32\config\SAM.iodefrag.bak
2016-04-06 15:35 - 2015-08-19 17:05 - 00000000 ____D C:\Program Files (x86)\BeinConnecTVv2
2016-04-06 15:33 - 2014-11-17 01:34 - 00000000 ____D C:\ProgramData\IObit
2016-04-06 14:42 - 2015-07-07 00:10 - 00000000 ____D C:\Windows\system32\DAX2
2016-04-06 14:39 - 2015-10-23 21:48 - 00000000 ____D C:\Windows\SysWOW64\RTCOM
2016-04-06 14:18 - 2014-11-17 01:34 - 00000000 ____D C:\Users\DOS\AppData\Roaming\IObit
2016-04-06 14:18 - 2014-11-17 01:33 - 00000000 ____D C:\Program Files (x86)\IObit
2016-04-06 12:39 - 2014-11-22 01:11 - 00000000 ____D C:\Users\DOS\AppData\LocalLow\IObit
2016-04-06 12:08 - 2016-02-05 00:15 - 00000000 ____D C:\Program Files (x86)\Steam
2016-04-06 00:32 - 2015-10-28 17:29 - 00000663 _____ C:\Windows\system32\Drivers\etc\hosts.rar
2016-04-05 19:45 - 2013-09-24 21:45 - 00000000 ____D C:\Users\DOS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2016-04-05 18:42 - 2015-12-20 17:17 - 00000000 ____D C:\Users\DOS\AppData\Roaming\TeamViewer
2016-04-01 01:15 - 2013-09-21 16:50 - 00797376 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-04-01 01:15 - 2013-09-21 16:50 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-03-31 01:24 - 2014-03-27 19:06 - 00002155 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-03-31 01:24 - 2014-03-27 19:06 - 00002143 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-03-31 01:24 - 2014-03-27 19:06 - 00002143 _____ C:\ProgramData\Desktop\Google Chrome.lnk
2016-03-29 18:16 - 2014-10-16 20:32 - 00000000 ____D C:\Program Files (x86)\Java
2016-03-29 18:16 - 2014-01-01 03:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2016-03-29 17:57 - 2015-08-28 01:24 - 00000000 ____D C:\Users\DOS\.oracle_jre_usage
2016-03-29 17:55 - 2015-06-29 01:22 - 00097856 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2016-03-25 02:03 - 2015-07-13 07:14 - 00264552 _____ (ESET) C:\Windows\system32\Drivers\eamonm.sys
2016-03-25 02:03 - 2015-07-13 07:14 - 00198096 _____ (ESET) C:\Windows\system32\Drivers\epfw.sys
2016-03-25 02:03 - 2015-07-13 07:14 - 00084800 _____ (ESET) C:\Windows\system32\Drivers\epfwwfp.sys
2016-03-25 02:03 - 2015-07-13 07:14 - 00053384 _____ (ESET) C:\Windows\system32\Drivers\EpfwLWF.sys
2016-03-20 06:04 - 2013-09-21 17:07 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-03-18 02:50 - 2013-03-14 16:42 - 00116304 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RTNUninst64.dll
2016-03-13 08:51 - 2015-04-25 12:21 - 00271200 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2016-03-13 08:51 - 2014-07-20 10:51 - 00271200 _____ C:\Windows\SysWOW64\PnkBstrB.xtr
2016-03-13 08:48 - 2015-04-25 12:21 - 00271200 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2016-03-11 09:00 - 2015-10-30 16:06 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
==================== Files in the root of some directories =======
2016-04-10 04:40 - 2016-04-08 16:40 - 0000040 ____H () C:\Program Files (x86)\51fbcc42.tmp
2014-03-20 21:16 - 2014-03-20 21:16 - 0000091 _____ () C:\Users\DOS\AppData\Local\fusioncache.dat
2013-09-27 22:35 - 2015-07-05 00:13 - 0007596 _____ () C:\Users\DOS\AppData\Local\Resmon.ResmonCfg
2014-05-03 12:15 - 2014-05-03 12:15 - 0017408 _____ () C:\Users\DOS\AppData\Local\WebpageIcons.db
2015-06-29 03:02 - 2015-06-29 03:02 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
Some files in TEMP:
====================
C:\Users\DOS\AppData\Local\Temp\7za.exe
C:\Users\DOS\AppData\Local\Temp\DaS_21.exe
C:\Users\DOS\AppData\Local\Temp\dateinj01.dll
C:\Users\DOS\AppData\Local\Temp\hijackthis.exe
C:\Users\DOS\AppData\Local\Temp\NirCmd.exe
C:\Users\DOS\AppData\Local\Temp\PEVZ.EXE
C:\Users\DOS\AppData\Local\Temp\remove.exe
C:\Users\DOS\AppData\Local\Temp\sed.exe
C:\Users\DOS\AppData\Local\Temp\shortcut.exe
C:\Users\DOS\AppData\Local\Temp\swreg.exe
C:\Users\DOS\AppData\Local\Temp\swxcacls.exe
C:\Users\DOS\AppData\Local\Temp\wget.exe
C:\Users\DOS\AppData\Local\Temp\zoek-delete.exe
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2016-04-09 11:58
==================== End of FRST.txt ============================
Ran by DOS (administrator) on YAHYA (10-04-2016 19:51:23)
Running from C:\Users\DOS\Desktop
Loaded Profiles: DOS (Available Profiles: DOS)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(IObit) C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\ekrn.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Program Files (x86)\RocketDock\RocketDock.exe
(IObit) C:\Program Files (x86)\IObit\Advanced SystemCare\ASCTray.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(Tonec Inc.) C:\Program Files (x86)\Internet Download Manager\IDMan.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Zbshareware Lab) C:\Program Files (x86)\USB Disk Security\USBGuard.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(Tonec Inc.) C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() E:\Downloads\Compressed\DestV1.7.1\mainplug.ocx
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [16408320 2016-03-18] (Realtek Semiconductor)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-08-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [595480 2016-03-20] (Oracle Corporation)
HKLM-x32\...\Run: [USB Security] => C:\Program Files (x86)\USB Disk Security\USBGuard.exe [695528 2015-01-31] (Zbshareware Lab)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-568589206-187183825-684968512-1000\...\Run: [RocketDock] => C:\Program Files (x86)\RocketDock\RocketDock.exe [630784 2007-03-19] ()
HKU\S-1-5-21-568589206-187183825-684968512-1000\...\Run: [Advanced SystemCare 9] => C:\Program Files (x86)\IObit\Advanced SystemCare\ASCTray.exe [2019616 2016-01-11] (IObit)
HKU\S-1-5-21-568589206-187183825-684968512-1000\...\Run: [IDMan] => C:\Program Files (x86)\Internet Download Manager\IDMan.exe [3907152 2015-08-29] (Tonec Inc.)
HKU\S-1-5-21-568589206-187183825-684968512-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8686296 2016-03-11] (Piriform Ltd)
HKU\S-1-5-21-568589206-187183825-684968512-1000\...\Run: [CCleaner] => C:\Program Files\CCleaner\CCleaner64.exe [8686296 2016-03-11] (Piriform Ltd)
HKU\S-1-5-21-568589206-187183825-684968512-1000\...\Policies\Explorer: [NolowDiskSpaceChecks] 1
ShellIconOverlayIdentifiers: [ IDM Shell Extension] -> {CDC95B92-E27C-4745-A8C5-64A52A78855D} => C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll [2015-08-14] (Tonec Inc.)
ShellIconOverlayIdentifiers: [###MegaShellExtPending] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\DOS\AppData\Local\MEGAsync\ShellExtX64.dll [2014-05-01] ()
ShellIconOverlayIdentifiers: [###MegaShellExtSynced] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\DOS\AppData\Local\MEGAsync\ShellExtX64.dll [2014-05-01] ()
ShellIconOverlayIdentifiers: [###MegaShellExtSyncing] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\DOS\AppData\Local\MEGAsync\ShellExtX64.dll [2014-05-01] ()
ShellIconOverlayIdentifiers-x32: [###MegaShellExtPending] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\DOS\AppData\Local\MEGAsync\ShellExtX32.dll [2014-05-01] ()
ShellIconOverlayIdentifiers-x32: [###MegaShellExtSynced] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\DOS\AppData\Local\MEGAsync\ShellExtX32.dll [2014-05-01] ()
ShellIconOverlayIdentifiers-x32: [###MegaShellExtSyncing] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\DOS\AppData\Local\MEGAsync\ShellExtX32.dll [2014-05-01] ()
ShellIconOverlayIdentifiers-x32: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\SysWOW64\AcSignIcon.dll [2006-03-04] (Autodesk)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{DDC8C1E7-C3A1-4ACF-8826-760145FD82A2}: [DhcpNameServer] 192.168.1.1
Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-568589206-187183825-684968512-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-568589206-187183825-684968512-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-568589206-187183825-684968512-1000\Software\Microsoft\Internet Explorer\Main,Start Default_Page_URL = hxxps://www.google.com/
HKU\S-1-5-21-568589206-187183825-684968512-1000\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = hxxps://www.google.com/
HKU\S-1-5-21-568589206-187183825-684968512-1000\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxps://www.google.com/
SearchScopes: HKLM -> DefaultScope value is missing
SearchScopes: HKLM-x32 -> DefaultScope value is missing
SearchScopes: HKU\S-1-5-21-568589206-187183825-684968512-1000 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
BHO: IDM integration (IDMIEHlprObj Class) -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll [2015-08-28] (Internet Download Manager, Tonec Inc.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: IDM integration (IDMIEHlprObj Class) -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll [2015-08-28] (Internet Download Manager, Tonec Inc.)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_77\bin\ssv.dll [2016-03-29] (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_77\bin\jp2ssv.dll [2016-03-29] (Oracle Corporation)
FireFox:
========
FF ProfilePath: C:\Users\DOS\AppData\Roaming\Mozilla\Firefox\Profiles\t0h5x25y.default-1424368493781
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_21_0_0_197.dll [2016-03-29] ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\system32\npDeployJava1.dll [2013-09-21] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_197.dll [2016-03-29] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1224194.dll [2016-02-19] (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-10-14] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.77.2 -> C:\Program Files (x86)\Java\jre1.8.0_77\bin\dtplugin\npDeployJava1.dll [2016-03-29] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.77.2 -> C:\Program Files (x86)\Java\jre1.8.0_77\bin\plugin2\npjp2.dll [2016-03-29] (Oracle Corporation)
FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files (x86)\Yahoo!\Shared\npYState.dll [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-02] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-02] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=1.0.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2011-07-14] (the VideoLAN Team)
FF Plugin-x32: @videolan.org/vlc,version=1.1.11 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2011-07-14] (the VideoLAN Team)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-12-18] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-568589206-187183825-684968512-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [No File]
FF user.js: detected! => C:\Users\DOS\AppData\Roaming\Mozilla\Firefox\Profiles\t0h5x25y.default-1424368493781\user.js [2016-04-10]
FF Extension: IDM integration - C:\Program Files (x86)\Internet Download Manager\idmmzcc2.xpi [2015-08-14]
FF Extension: IE Tab 2 (FF 3.6+) - C:\Users\DOS\AppData\Roaming\Mozilla\Firefox\Profiles\t0h5x25y.default-1424368493781\extensions\{1BC9BA34-1EED-42ca-A505-6D2F1A935BBB} [2016-03-07]
FF Extension: anonymoX - C:\Users\DOS\AppData\Roaming\Mozilla\Firefox\Profiles\t0h5x25y.default-1424368493781\Extensions\client@anonymox.net.xpi [2016-03-26]
FF Extension: ZenMate Security, Privacy & Unblock VPN - C:\Users\DOS\AppData\Roaming\Mozilla\Firefox\Profiles\t0h5x25y.default-1424368493781\Extensions\firefox@zenmate.com.xpi [2016-03-22]
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi [2016-03-19] [not signed]
FF HKU\S-1-5-21-568589206-187183825-684968512-1000\...\Firefox\Extensions: [mozilla_cc2@internetdownloadmanager.com] - C:\Program Files (x86)\Internet Download Manager\idmmzcc2.xpi
FF HKU\S-1-5-21-568589206-187183825-684968512-1000\...\SeaMonkey\Extensions: [mozilla_cc@internetdownloadmanager.com] - C:\Users\DOS\AppData\Roaming\IDM\idmmzcc5 => not found
Chrome:
=======
CHR HomePage: Profile 1 -> hxxps://www.google.jo/
CHR StartupUrls: Profile 1 -> "hxxps://www.google.jo/"
CHR Profile: C:\Users\DOS\AppData\Local\Google\Chrome\User Data\Profile 1
CHR Extension: (MEGA) - C:\Users\DOS\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\bigefpfhnfcobdlfbedofhhaibnlghod [2016-04-08]
CHR Extension: (anonymoX) - C:\Users\DOS\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\icpklikeghomkemdellmmkoifgfbakio [2016-04-09]
CHR Extension: (IDM Integration Module) - C:\Users\DOS\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ngpampappnmepgilojfohadhhmbhlaek [2016-04-07]
CHR Extension: (Chrome Web Store Payments) - C:\Users\DOS\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-02]
CHR Extension: (TunnelBear VPN) - C:\Users\DOS\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\omdakjcmkglenbhjadbccaookpfjihpa [2016-04-03]
CHR Extension: (OneClick Cleaner for Chrome) - C:\Users\DOS\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\oncckmaelaecccmaniihojgeopkcajfh [2015-10-04]
CHR HKLM\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx [2015-08-28]
CHR HKLM-x32\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx [2015-08-28]
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AdvancedSystemCareService9; C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe [446240 2016-01-05] (IObit)
S3 Autodesk Licensing Service; C:\Program Files (x86)\Common Files\Autodesk Shared\Service\AdskScSrv.exe [77944 2013-10-01] (Autodesk)
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2519904 2016-03-25] (ESET)
S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [3398096 2015-02-10] (INCA Internet Co., Ltd.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-07-15] (Microsoft Corporation)
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [310728 2015-12-08] ()
S3 b06diag; C:\Windows\system32\drivers\bxdiaga.sys [88104 2012-03-08] (Broadcom Corporation)
S3 BFN7x64; C:\Windows\system32\drivers\Xeno7x64.sys [157288 2012-02-22] (Bigfoot Networks, Inc.)
S3 bxfcoe; C:\Windows\system32\drivers\bxfcoe.sys [178216 2012-02-22] (Broadcom Corporation)
S3 bxois; C:\Windows\system32\drivers\bxois.sys [539176 2012-02-22] (Broadcom Corporation)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [264552 2016-03-25] (ESET)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3341904 2012-03-26] (Broadcom Corporation)
U5 edevmon; C:\Windows\System32\Drivers\edevmon.sys [251632 2015-07-13] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [186784 2016-01-30] (ESET)
R2 ekbdflt; C:\Windows\System32\DRIVERS\ekbdflt.sys [142976 2016-01-30] (ESET)
R1 epfw; C:\Windows\System32\DRIVERS\epfw.sys [198096 2016-03-25] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [53384 2016-03-25] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [84800 2016-03-25] (ESET)
S3 EtronSTOR; C:\Windows\System32\Drivers\EtronSTOR.sys [32512 2012-07-24] (Etron Technology Inc)
S3 GGSAFERDriver; no ImagePath
S3 gkernel; no ImagePath
R1 HWiNFO32; C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [26528 2015-06-29] (REALiX(tm))
S3 igfx; C:\Windows\System32\DRIVERS\igdkmd64.sys [10629408 2012-11-15] (Intel Corporation) [File not signed]
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43168 2015-12-08] ()
S3 orange_zte_cdc_acm; C:\Windows\System32\DRIVERS\orange_zte_cdc_acm.sys [77824 2013-09-30] (ZTE) [File not signed]
S3 orange_zte_cpo; C:\Windows\System32\DRIVERS\orange_zte_cpo.sys [14336 2013-09-30] (ZTE) [File not signed]
S4 secdrv; C:\Windows\SysWow64\Drivers\secdrv.sys [11616 2001-08-03] () [File not signed]
R0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [21184 2014-06-04] (IObit)
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [24688 2016-04-07] ()
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2015-06-17] (Apple, Inc.) [File not signed]
S3 catchme; \??\C:\Users\DOS\AppData\Local\Temp\catchme.sys [X]
S3 cpuz138; \??\C:\Users\DOS\AppData\Local\Temp\cpuz138\cpuz138_x64.sys [X]
S3 huawei_cdcacm; system32\DRIVERS\ew_jucdcacm.sys [X]
S3 huawei_cdcecm; system32\DRIVERS\ew_jucdcecm.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 huawei_ext_ctrl; system32\DRIVERS\ew_juextctrl.sys [X]
S3 huawei_wwanecm; system32\DRIVERS\ew_juwwanecm.sys [X]
S3 USBPNPA; system32\drivers\CM10864.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-04-10 19:51 - 2016-04-10 19:52 - 00018867 _____ C:\Users\DOS\Desktop\FRST.txt
2016-04-10 19:51 - 2016-04-10 19:51 - 00000000 ____D C:\FRST
2016-04-10 19:50 - 2016-04-10 19:27 - 02374144 _____ (Farbar) C:\Users\DOS\Desktop\FRST64.exe
2016-04-10 15:51 - 2016-04-10 19:44 - 00000000 ____D C:\Users\DOS\AppData\Local\CrashDumps
2016-04-10 04:40 - 2016-04-08 16:40 - 00000040 ____H C:\Program Files (x86)\51fbcc42.tmp
2016-04-10 04:18 - 2016-04-10 04:18 - 00127462 _____ C:\Users\DOS\Desktop\ZHPDiag.txt
2016-04-10 04:09 - 2016-04-10 04:09 - 00000000 ____D C:\Users\DOS\AppData\Roaming\ProductData
2016-04-10 04:09 - 2016-04-10 04:09 - 00000000 ____D C:\ProgramData\ProductData
2016-04-10 04:09 - 2016-04-10 04:09 - 00000000 ____D C:\ProgramData\IDM
2016-04-10 03:34 - 2016-04-10 03:34 - 00000000 ____D C:\zoek
2016-04-10 02:33 - 2016-04-10 03:39 - 00003230 _____ C:\runcheck.txt
2016-04-10 02:33 - 2016-04-10 03:38 - 00000000 ____D C:\zoek_backup
2016-04-10 02:11 - 2016-04-10 02:11 - 00001805 _____ C:\Users\Public\Desktop\ZHPFix.lnk
2016-04-10 02:11 - 2016-04-10 02:11 - 00001805 _____ C:\ProgramData\Desktop\ZHPFix.lnk
2016-04-10 02:10 - 2016-04-10 02:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP
2016-04-10 02:09 - 2016-04-10 02:09 - 00000000 _____ C:\Users\DOS\Desktop\help.txt
2016-04-09 18:17 - 2016-04-09 18:17 - 00002780 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2016-04-09 18:17 - 2016-04-09 18:17 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk
2016-04-09 18:17 - 2016-04-09 18:17 - 00000822 _____ C:\ProgramData\Desktop\CCleaner.lnk
2016-04-09 18:17 - 2016-04-09 18:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2016-04-09 18:17 - 2016-04-09 18:17 - 00000000 ____D C:\Program Files\CCleaner
2016-04-09 18:04 - 2016-04-09 21:25 - 00500072 _____ C:\Windows\system32\FNTCACHE.DAT
2016-04-09 12:48 - 2016-04-10 04:11 - 00000815 _____ C:\Users\DOS\Desktop\ZHPDiag.lnk
2016-04-09 12:39 - 2016-04-09 21:26 - 00163176 _____ C:\Users\DOS\AppData\Local\GDIPFONTCACHEV1.DAT
2016-04-09 12:39 - 2016-04-09 12:39 - 00002858 _____ C:\Windows\System32\Tasks\ASC9_SkipUac_DOS
2016-04-09 11:29 - 2011-06-26 09:45 - 00256000 _____ C:\Windows\PEV.exe
2016-04-09 11:29 - 2010-11-07 20:20 - 00208896 _____ C:\Windows\MBR.exe
2016-04-09 11:29 - 2009-04-20 07:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2016-04-09 11:29 - 2000-08-31 03:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2016-04-09 11:29 - 2000-08-31 03:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2016-04-09 11:29 - 2000-08-31 03:00 - 00098816 _____ C:\Windows\sed.exe
2016-04-09 11:29 - 2000-08-31 03:00 - 00080412 _____ C:\Windows\grep.exe
2016-04-09 11:29 - 2000-08-31 03:00 - 00068096 _____ C:\Windows\zip.exe
2016-04-09 11:28 - 2016-04-09 12:33 - 00000000 ____D C:\Qoobox
2016-04-09 02:29 - 2016-04-09 21:28 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-04-09 02:29 - 2016-04-09 02:29 - 00001058 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-04-09 02:29 - 2016-04-09 02:29 - 00001058 _____ C:\ProgramData\Desktop\Malwarebytes Anti-Malware.lnk
2016-04-09 02:29 - 2016-04-09 02:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-04-09 02:29 - 2016-04-09 02:29 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-04-09 02:29 - 2016-03-10 14:09 - 00064896 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-04-09 02:29 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-04-09 02:29 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-04-08 23:53 - 2016-04-08 20:39 - 02179584 _____ C:\Users\DOS\Desktop\ZHPDiag3.exe
2016-04-08 19:50 - 2016-04-08 19:50 - 00000000 ____D C:\Users\DOS\Downloads\Video
2016-04-08 19:50 - 2016-04-08 19:50 - 00000000 ____D C:\Users\DOS\Downloads\Compressed
2016-04-08 19:46 - 2016-04-08 19:46 - 00000000 ____D C:\Windows\Tasks\ImCleanDisabled
2016-04-08 01:07 - 2016-04-08 19:45 - 00000000 ____D C:\AdsFix
2016-04-07 03:52 - 2016-04-10 04:19 - 00000000 ____D C:\Users\DOS\AppData\Roaming\ZHP
2016-04-07 01:47 - 2016-04-08 18:37 - 00000000 ____D C:\Program Files (x86)\PingPlotter
2016-04-07 01:47 - 2016-04-07 01:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PingPlotter
2016-04-07 01:46 - 2016-04-07 01:46 - 00000000 ____D C:\Users\DOS\AppData\Roaming\Downloaded Installations
2016-04-06 15:44 - 2016-04-06 15:44 - 00000000 ____H C:\asc_rdflag
2016-04-06 14:34 - 2016-04-06 14:34 - 05576400 _____ C:\Windows\system32\Drivers\RTAIODAT.DAT
2016-04-06 14:34 - 2016-04-06 14:34 - 04803840 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RTKVHD64.sys
2016-04-06 14:34 - 2016-04-06 14:34 - 03299832 _____ (Yamaha Corporation) C:\Windows\system32\YamahaAE2.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 03283248 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkApi64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 03198720 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtPgEx64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 02894976 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTSnMg64.cpl
2016-04-06 14:34 - 2016-04-06 14:34 - 02190992 _____ (Yamaha Corporation) C:\Windows\system32\YamahaAE.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 02110600 _____ (Waves Audio Ltd.) C:\Windows\system32\WavesGUILib64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 01943624 _____ (DTS, Inc.) C:\Windows\system32\sltech64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 01435152 _____ (Synopsys, Inc.) C:\Windows\system32\SRRPTR64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 01382240 _____ (TOSHIBA Corporation) C:\Windows\system32\tosade.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 01356512 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTCOM64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 01330072 _____ (DTS, Inc.) C:\Windows\system32\slcnt64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 01022872 _____ (DTS, Inc.) C:\Windows\system32\sl3apo64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00965032 _____ (Sony Corporation) C:\Windows\system32\SFSS_APO.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00927424 _____ (Sound Research, Corp.) C:\Windows\system32\SEHDRA64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00888480 _____ (TOSHIBA Corporation) C:\Windows\system32\tossaeapo64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00873472 _____ (TOSHIBA Corporation) C:\Windows\system32\tadefxapo264.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00716104 _____ (Sound Research, Corp.) C:\Windows\system32\SECOMN64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00689888 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtDataProc64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00596120 _____ (TOSHIBA Corporation) C:\Windows\system32\tosasfapo64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00589080 _____ (Sound Research, Corp.) C:\Windows\SysWOW64\SECOMN32.DLL
2016-04-06 14:34 - 2016-04-06 14:34 - 00532384 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSX64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00467168 _____ (Synopsys, Inc.) C:\Windows\system32\SRAPO64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00450128 _____ (Sound Research, Corp.) C:\Windows\system32\SEAPO64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00387320 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEP64A.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00381416 _____ (Synopsys, Inc.) C:\Windows\system32\SRCOM64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00343712 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtlCPAPI64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00341160 _____ (Synopsys, Inc.) C:\Windows\SysWOW64\SRCOM.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00341160 _____ (Synopsys, Inc.) C:\Windows\system32\SRCOM.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00321720 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DHT64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00321720 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DAA64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00258504 _____ (TODO:
2016-04-06 14:34 - 2016-04-06 14:34 - 00231920 _____ (Synopsys, Inc.) C:\Windows\system32\SFNHK64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00224264 _____ (TOSHIBA Corporation) C:\Windows\system32\tossaemaxapo64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00221976 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSH64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00214840 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEED64A.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00209536 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSHP64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00192992 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCfg64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00172584 _____ (TOSHIBA Corporation) C:\Windows\system32\toseaeapo64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00166208 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSWOW64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00158704 _____ (TOSHIBA Corporation) C:\Windows\system32\tadefxapo.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00110984 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEL64A.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00090920 _____ (Synopsys, Inc.) C:\Windows\system32\SFCOM64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00088352 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEG64A.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00088328 _____ (Synopsys, Inc.) C:\Windows\system32\SFAPO64.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00083632 _____ (Virage Logic Corporation / Sonic Focus) C:\Windows\SysWOW64\SFCOM.dll
2016-04-06 14:34 - 2016-04-06 14:34 - 00075544 _____ (TOSHIBA CORPORATION.) C:\Windows\system32\tepeqapo64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 72203792 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoRes64.dat
2016-04-06 14:33 - 2016-04-06 14:33 - 14057256 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioRealtek64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 13120760 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVoiceAPO3064.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 12986528 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVoiceAPO4064.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 10521552 _____ (Intel Corporation) C:\Windows\system32\IntelSSTAPO.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 07172920 _____ (Dolby Laboratories) C:\Windows\system32\R4EEP64A.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 07096192 _____ (Dolby Laboratories) C:\Windows\system32\DDPP64A.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 06343320 _____ (Nahimic Inc) C:\Windows\system32\NAHIMICV3apo.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 06264640 _____ (Dolby Laboratories) C:\Windows\system32\DDPP64AF3.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 05777704 _____ (Nahimic Inc) C:\Windows\system32\NAHIMICV2apo.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 05338936 _____ (Dolby Laboratories) C:\Windows\system32\DolbyDAX2APOv211.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 05289952 _____ (Nahimic Inc) C:\Windows\system32\NAHIMICAPOlfx.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 03282032 _____ (Fortemedia Corporation) C:\Windows\system32\FMAPO64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 02823280 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO7064.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 02714568 _____ (Realtek Semiconductor Corp.) C:\Windows\SysWOW64\RltkAPO.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 02437144 _____ (Dolby Laboratories) C:\Windows\system32\DolbyDAX2APOv201.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 02050184 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioEQ64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 02049664 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoInstII64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 01965816 _____ (Dolby Laboratories) C:\Windows\system32\DDPD64A.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 01959608 _____ (Dolby Laboratories) C:\Windows\system32\DDPD64AF3.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 01780624 _____ (DTS) C:\Windows\system32\DTSS2SpeakerDLL64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 01591064 _____ (DTS) C:\Windows\system32\DTSS2HeadphoneDLL64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 01508936 _____ (DTS) C:\Windows\system32\DTSBoostDLL64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 01421104 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO6064.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 01334384 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxSpeechAPO64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 01211840 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO5064.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 01186168 _____ (Intel Corporation) C:\Windows\system32\IntelSstCApoPropPage.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 01164336 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO4064.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 01060504 _____ (Dolby Laboratories) C:\Windows\system32\DolbyDAX2APOProp.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 01003864 _____ (Nahimic Inc) C:\Windows\system32\NahimicAPONSControl.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00998032 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVoiceAPO2064.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00931624 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPOShell64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00923752 _____ (Sony Corporation) C:\Windows\system32\MISS_APO.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00743968 _____ (DTS) C:\Windows\system32\DTSBassEnhancementDLL64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00727440 _____ (DTS) C:\Windows\system32\DTSSymmetryDLL64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00708320 _____ (DTS) C:\Windows\system32\DTSVoiceClarityDLL64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00678192 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO30.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00677680 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVolumeSDAPO.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00618192 _____ (Knowles Acoustics ) C:\Windows\system32\KAAPORT64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00514528 _____ (DTS) C:\Windows\system32\DTSU2PLFX64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00504312 _____ (DTS) C:\Windows\system32\DTSNeoPCDLL64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00500560 _____ (DTS) C:\Windows\system32\DTSU2PGFX64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00471336 _____ (ICEpower a/s) C:\Windows\system32\ICEsoundAPO64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00447720 _____ (Dolby Laboratories) C:\Windows\system32\R4EED64A.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00445408 _____ (DTS) C:\Windows\system32\DTSLimiterDLL64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00441272 _____ (DTS) C:\Windows\system32\DTSGainCompensatorDLL64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00428232 _____ (DTS) C:\Windows\system32\DTSU2PREC64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00416512 _____ (Harman) C:\Windows\system32\HMUI.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00370840 _____ (Dolby Laboratories) C:\Windows\system32\HiFiDAX2API.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00366128 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\HMAPO.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00362056 _____ (Dolby Laboratories) C:\Windows\system32\DDPO64AF3.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00360352 _____ (Harman) C:\Windows\system32\HMClariFi.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00330568 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO20.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00327464 _____ (Dolby Laboratories) C:\Windows\system32\DDPO64A.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00310424 _____ (Dolby Laboratories) C:\Windows\system32\DDPA64F3.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00272720 _____ (Dolby Laboratories) C:\Windows\system32\DDPA64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00253904 _____ (DTS) C:\Windows\system32\DTSGFXAPO64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00253872 _____ (DTS) C:\Windows\system32\DTSLFXAPO64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00252880 _____ (DTS) C:\Windows\system32\DTSGFXAPONS64.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00203848 _____ (Harman) C:\Windows\system32\HMHVS.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00190944 _____ (Harman) C:\Windows\system32\HMEQ_Voice.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00190944 _____ (Harman) C:\Windows\system32\HMEQ.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00179608 _____ (Harman) C:\Windows\system32\HMLimiter.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00151792 _____ (Dolby Laboratories) C:\Windows\system32\R4EEL64A.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00134208 _____ (Dolby Laboratories) C:\Windows\system32\R4EEA64A.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00084624 _____ (Dolby Laboratories) C:\Windows\system32\R4EEG64A.dll
2016-04-06 14:33 - 2016-04-06 14:33 - 00065792 _____ (Harman) C:\Windows\system32\HarmanAudioInterface.dll
2016-04-06 14:32 - 2016-04-06 14:32 - 01601952 _____ (Conexant Systems Inc.) C:\Windows\system32\CX64APO.dll
2016-04-06 14:32 - 2016-04-06 14:32 - 00574760 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAC64.dll
2016-04-06 14:32 - 2016-04-06 14:32 - 00122328 _____ (Real Sound Lab SIA) C:\Windows\system32\CONEQMSAPOGUILibrary.dll
2016-04-06 14:32 - 2016-04-06 14:32 - 00118600 _____ C:\Windows\system32\AcpiServiceVnA64.dll
2016-04-06 14:32 - 2016-04-06 14:32 - 00118600 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAR64.dll
2016-04-06 14:32 - 2016-04-06 14:32 - 00105312 _____ C:\Windows\system32\audioLibVc.dll
2016-04-06 14:19 - 2016-04-06 14:19 - 00001126 _____ C:\Users\Public\Desktop\Smart Defrag 4.lnk
2016-04-06 14:19 - 2016-04-06 14:19 - 00001126 _____ C:\ProgramData\Desktop\Smart Defrag 4.lnk
2016-04-06 14:19 - 2016-04-06 14:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Smart Defrag 4
2016-04-06 14:19 - 2016-01-28 18:23 - 00033704 _____ (IObit) C:\Windows\system32\SmartDefragBootTime.exe
2016-04-06 14:19 - 2015-01-10 15:32 - 00128288 _____ (IObit) C:\Windows\SysWOW64\IObitSmartDefragExtension.dll20160406141924.dll
2016-04-06 14:19 - 2015-01-10 15:32 - 00128288 _____ (IObit) C:\Windows\system32\IObitSmartDefragExtension.dll
2016-04-06 14:19 - 2014-06-04 15:17 - 00021184 _____ (IObit) C:\Windows\system32\Drivers\SmartDefragDriver.sys
2016-04-06 12:40 - 2016-04-06 12:40 - 00001322 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IObit Uninstaller.lnk
2016-04-06 12:40 - 2016-04-06 12:40 - 00001310 _____ C:\Users\Public\Desktop\IObit Uninstaller.lnk
2016-04-06 12:40 - 2016-04-06 12:40 - 00001310 _____ C:\ProgramData\Desktop\IObit Uninstaller.lnk
2016-04-06 12:40 - 2016-04-06 12:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IObit Uninstaller
2016-04-06 12:39 - 2016-04-06 13:00 - 00002212 _____ C:\Users\Public\Desktop\Advanced SystemCare 9.lnk
2016-04-06 12:39 - 2016-04-06 13:00 - 00002212 _____ C:\ProgramData\Desktop\Advanced SystemCare 9.lnk
2016-04-06 12:39 - 2016-04-06 12:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced SystemCare
2016-04-01 01:15 - 2016-04-10 18:54 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-04-01 01:15 - 2016-04-01 01:15 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2016-03-22 17:25 - 2016-03-22 17:25 - 04477829 _____ C:\ملف تفعيل ام.dll
2016-03-19 12:56 - 2016-03-19 13:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-03-18 02:53 - 2016-03-18 02:53 - 03152591 _____ C:\Windows\system32\Drivers\rtkSSTsetting.dat
2016-03-18 02:53 - 2016-03-18 02:53 - 03052880 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RltkAPO64.dll
2016-03-18 02:53 - 2016-03-18 02:53 - 00023696 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCoLDR64.dll
2016-03-18 02:50 - 2016-03-18 02:50 - 01027840 _____ (Realtek ) C:\Windows\system32\Drivers\Rt64win7.sys
2016-03-18 02:50 - 2016-03-18 02:50 - 00082544 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RtNicProp64.dll
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-04-10 19:44 - 2009-07-14 06:20 - 00000000 ____D C:\Windows\inf
2016-04-10 19:22 - 2014-03-27 19:04 - 00000842 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-04-10 11:45 - 2009-07-14 07:45 - 00026768 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-04-10 11:45 - 2009-07-14 07:45 - 00026768 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-04-10 11:37 - 2014-03-27 19:04 - 00000838 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-04-10 11:36 - 2014-02-23 13:46 - 00065536 _____ C:\Windows\system32\Ikeext.etl
2016-04-10 11:36 - 2009-07-14 08:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-04-10 08:01 - 2009-07-14 06:20 - 00000000 ____D C:\Windows\tracing
2016-04-10 05:36 - 2013-10-09 19:08 - 00000000 ____D C:\Users\DOS\AppData\Roaming\DMCache
2016-04-10 02:10 - 2015-09-16 04:24 - 00000000 ____D C:\Program Files (x86)\ZHPFix
2016-04-09 21:23 - 2015-12-20 17:16 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2016-04-09 18:40 - 2015-12-10 21:58 - 00000000 ____D C:\Users\DOS\AppData\Roaming\IDM
2016-04-09 18:22 - 2015-09-24 17:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2016-04-09 12:26 - 2009-07-14 05:34 - 00000314 _____ C:\Windows\system.ini
2016-04-09 11:51 - 2010-02-09 17:00 - 00000000 ____D C:\Users\DOS
2016-04-09 10:01 - 2013-09-27 02:11 - 00000000 ____D C:\Windows\Minidump
2016-04-09 00:12 - 2009-07-14 06:20 - 00000000 ____D C:\Windows\system
2016-04-09 00:04 - 2016-01-26 18:06 - 00000000 ____D C:\Users\DOS\AppData\Local\Ubisoft Game Launcher
2016-04-08 16:04 - 2014-04-30 20:44 - 00000000 ____D C:\Program Files (x86)\Garena Plus
2016-04-08 01:07 - 2009-07-14 08:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2016-04-08 01:07 - 2009-07-14 06:20 - 00000000 ____D C:\Windows\Web
2016-04-07 20:12 - 2014-11-25 22:16 - 00000000 ____D C:\ProgramData\RogueKiller
2016-04-07 19:37 - 2014-11-25 22:16 - 00024688 _____ C:\Windows\system32\Drivers\TrueSight.sys
2016-04-07 15:28 - 2014-05-09 11:51 - 02583974 _____ C:\Windows\system32\perfh001.dat
2016-04-07 15:28 - 2014-05-09 11:51 - 01415004 _____ C:\Windows\system32\perfh00C.dat
2016-04-07 15:28 - 2014-05-09 11:51 - 00822334 _____ C:\Windows\system32\perfc00C.dat
2016-04-07 15:28 - 2014-05-09 11:51 - 00807420 _____ C:\Windows\system32\perfc001.dat
2016-04-07 15:28 - 2009-07-14 08:13 - 00006812 _____ C:\Windows\system32\PerfStringBackup.INI
2016-04-06 15:44 - 2015-07-15 12:01 - 132743168 _____ C:\Windows\system32\config\SOFTWARE.iodefrag.bak
2016-04-06 15:44 - 2015-07-15 12:01 - 00294912 _____ C:\Windows\system32\config\DEFAULT.iodefrag.bak
2016-04-06 15:44 - 2015-07-15 12:01 - 00036864 _____ C:\Windows\system32\config\SECURITY.iodefrag.bak
2016-04-06 15:44 - 2015-07-15 12:01 - 00032768 _____ C:\Windows\system32\config\SAM.iodefrag.bak
2016-04-06 15:35 - 2015-08-19 17:05 - 00000000 ____D C:\Program Files (x86)\BeinConnecTVv2
2016-04-06 15:33 - 2014-11-17 01:34 - 00000000 ____D C:\ProgramData\IObit
2016-04-06 14:42 - 2015-07-07 00:10 - 00000000 ____D C:\Windows\system32\DAX2
2016-04-06 14:39 - 2015-10-23 21:48 - 00000000 ____D C:\Windows\SysWOW64\RTCOM
2016-04-06 14:18 - 2014-11-17 01:34 - 00000000 ____D C:\Users\DOS\AppData\Roaming\IObit
2016-04-06 14:18 - 2014-11-17 01:33 - 00000000 ____D C:\Program Files (x86)\IObit
2016-04-06 12:39 - 2014-11-22 01:11 - 00000000 ____D C:\Users\DOS\AppData\LocalLow\IObit
2016-04-06 12:08 - 2016-02-05 00:15 - 00000000 ____D C:\Program Files (x86)\Steam
2016-04-06 00:32 - 2015-10-28 17:29 - 00000663 _____ C:\Windows\system32\Drivers\etc\hosts.rar
2016-04-05 19:45 - 2013-09-24 21:45 - 00000000 ____D C:\Users\DOS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2016-04-05 18:42 - 2015-12-20 17:17 - 00000000 ____D C:\Users\DOS\AppData\Roaming\TeamViewer
2016-04-01 01:15 - 2013-09-21 16:50 - 00797376 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-04-01 01:15 - 2013-09-21 16:50 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-03-31 01:24 - 2014-03-27 19:06 - 00002155 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-03-31 01:24 - 2014-03-27 19:06 - 00002143 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-03-31 01:24 - 2014-03-27 19:06 - 00002143 _____ C:\ProgramData\Desktop\Google Chrome.lnk
2016-03-29 18:16 - 2014-10-16 20:32 - 00000000 ____D C:\Program Files (x86)\Java
2016-03-29 18:16 - 2014-01-01 03:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2016-03-29 17:57 - 2015-08-28 01:24 - 00000000 ____D C:\Users\DOS\.oracle_jre_usage
2016-03-29 17:55 - 2015-06-29 01:22 - 00097856 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2016-03-25 02:03 - 2015-07-13 07:14 - 00264552 _____ (ESET) C:\Windows\system32\Drivers\eamonm.sys
2016-03-25 02:03 - 2015-07-13 07:14 - 00198096 _____ (ESET) C:\Windows\system32\Drivers\epfw.sys
2016-03-25 02:03 - 2015-07-13 07:14 - 00084800 _____ (ESET) C:\Windows\system32\Drivers\epfwwfp.sys
2016-03-25 02:03 - 2015-07-13 07:14 - 00053384 _____ (ESET) C:\Windows\system32\Drivers\EpfwLWF.sys
2016-03-20 06:04 - 2013-09-21 17:07 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-03-18 02:50 - 2013-03-14 16:42 - 00116304 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RTNUninst64.dll
2016-03-13 08:51 - 2015-04-25 12:21 - 00271200 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2016-03-13 08:51 - 2014-07-20 10:51 - 00271200 _____ C:\Windows\SysWOW64\PnkBstrB.xtr
2016-03-13 08:48 - 2015-04-25 12:21 - 00271200 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2016-03-11 09:00 - 2015-10-30 16:06 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
==================== Files in the root of some directories =======
2016-04-10 04:40 - 2016-04-08 16:40 - 0000040 ____H () C:\Program Files (x86)\51fbcc42.tmp
2014-03-20 21:16 - 2014-03-20 21:16 - 0000091 _____ () C:\Users\DOS\AppData\Local\fusioncache.dat
2013-09-27 22:35 - 2015-07-05 00:13 - 0007596 _____ () C:\Users\DOS\AppData\Local\Resmon.ResmonCfg
2014-05-03 12:15 - 2014-05-03 12:15 - 0017408 _____ () C:\Users\DOS\AppData\Local\WebpageIcons.db
2015-06-29 03:02 - 2015-06-29 03:02 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
Some files in TEMP:
====================
C:\Users\DOS\AppData\Local\Temp\7za.exe
C:\Users\DOS\AppData\Local\Temp\DaS_21.exe
C:\Users\DOS\AppData\Local\Temp\dateinj01.dll
C:\Users\DOS\AppData\Local\Temp\hijackthis.exe
C:\Users\DOS\AppData\Local\Temp\NirCmd.exe
C:\Users\DOS\AppData\Local\Temp\PEVZ.EXE
C:\Users\DOS\AppData\Local\Temp\remove.exe
C:\Users\DOS\AppData\Local\Temp\sed.exe
C:\Users\DOS\AppData\Local\Temp\shortcut.exe
C:\Users\DOS\AppData\Local\Temp\swreg.exe
C:\Users\DOS\AppData\Local\Temp\swxcacls.exe
C:\Users\DOS\AppData\Local\Temp\wget.exe
C:\Users\DOS\AppData\Local\Temp\zoek-delete.exe
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2016-04-09 11:58
==================== End of FRST.txt ============================