Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 02-11-2017
Ran by Adrian (administrator) on ADRIAN-PC (05-11-2017 18:43:29)
Running from C:\Users\Adrian\Desktop
Loaded Profiles: Adrian (Available Profiles: Adrian & Guest)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: "C:\Program Files\Pale Moon\palemoon.exe" -osint -url "%1")
Boot Mode: Safe Mode (with Networking)
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8551848 2015-10-19] (Piriform Ltd)
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\Run: [MinerGateGui] => C:\Users\Adrian\AppData\Roaming\server\minergate.exe [17689600 2017-10-13] ()
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {abf5f654-731c-11e4-8cb8-f82fa8dc94ee} - E:\unlock.exe autoplay=true
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {fafbe510-26ac-11e4-88ef-f82fa8dc94ee} - E:\LG_PC_Programs.exe
Lsa: [Notification Packages] scecli C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
GroupPolicy: Restriction <==== ATTENTION
GroupPolicy\User: Restriction <==== ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\Parameters: [NameServer] 8.8.8.8,8.8.8.4
Tcpip\..\Interfaces\{12AA26AC-4392-403A-9A14-02CD4B939AC0}: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{B1A57BC6-6D23-472E-B8AD-E4B5EB2CEAC1}: [NameServer] 8.8.8.8

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = www.bing.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\ssv.dll [2017-03-14] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-03-14] (Oracle Corporation)
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF DefaultProfile: haadg4ll.default-1485454395780-1505925842552
FF DefaultProfile: y4erocbx.default
FF ProfilePath: C:\Users\Adrian\AppData\Roaming\TomTom\HOME\Profiles\urd9ga9k.default [2017-06-01]
FF ProfilePath: C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\haadg4ll.default-1485454395780-1505925842552 [2017-11-05]
FF user.js: detected! => C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\haadg4ll.default-1485454395780-1505925842552\user.js [2017-06-29]
FF Homepage: Mozilla\Firefox\Profiles\haadg4ll.default-1485454395780-1505925842552 -> www.google.fr
FF Extension: (Домашняя страница Mail.Ru) - C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\haadg4ll.default-1485454395780-1505925842552\Extensions\3db0-6cc2-c767-dfda [2017-11-03]
FF Extension: (antiporn) - C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\haadg4ll.default-1485454395780-1505925842552\Extensions\jid1-o7IpBfZ5ihakSw@jetpack.xpi [2017-10-10]
FF Extension: (Video DownloadHelper) - C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\haadg4ll.default-1485454395780-1505925842552\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2017-10-21]
FF Extension: (Flash and Video Download) - C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\haadg4ll.default-1485454395780-1505925842552\Extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a} [2017-10-20]
FF ProfilePath: C:\Users\Adrian\AppData\Roaming\Moonchild Productions\Pale Moon\Profiles\y4erocbx.default [2017-11-05]
FF DefaultSearchEngine: Moonchild Productions\Pale Moon\Profiles\y4erocbx.default -> Google
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_27_0_0_183.dll [2017-10-25] ()
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll [2014-07-25] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_27_0_0_183.dll [2017-10-25] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-03-14] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-03-14] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll [2014-07-25] (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-08-01] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2016-12-23] (Adobe Systems Inc.)

Chrome:
=======
CHR HomePage: Default -> hxxps://inline.go.mail.ru/homepage?inline_comp=hp&inline_hp_cnt=11956636
CHR StartupUrls: Default -> "hxxp://mail.ru/cnt/10445?gp=811021"
CHR NewTab: Default -> "chrome-extension://lhemechcanjmilllmccjbjldonmnnjjj/visual-bookmarks.html"
CHR DefaultSearchURL: Default -> hxxp://go.mail.ru/distib/ep/?q={searchTerms}&fr=ntg&product_id=%7B3D91A3EC-D5F6-4AE0-8888-D9B130BCBEBB%7D&gp=811022
CHR DefaultSearchKeyword: Default -> go.mail.ru
CHR DefaultSuggestURL: Default -> hxxp://suggests.go.mail.ru/ff3?q={searchTerms}
CHR Profile: C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default [2017-11-05]
CHR Extension: (Визуальные Закладки Mail.Ru) - C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj [2017-11-03]
CHR Extension: (Skype) - C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2017-09-11]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-09-11]
CHR Extension: (Chrome Media Router) - C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-09-20]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-10-12]

Opera:
=======
OPR Extension: (Stormcrow) - C:\Users\Adrian\AppData\Roaming\Opera Software\Opera Stable\Extensions\fjpfeaedoichmjfaaeghijjenilnibdl [2017-09-20]
OPR Extension: (Adult Blocker) - C:\Users\Adrian\AppData\Roaming\Opera Software\Opera Stable\Extensions\neopaobcplailacdmjplehdnhhdacocl [2016-11-03]
OPR Extension: (Adblock Plus) - C:\Users\Adrian\AppData\Roaming\Opera Software\Opera Stable\Extensions\oidhhegpmlfpoeialbgcdocjalghfpkp [2017-09-20]
StartMenuInternet: (HKLM) OperaStable - C:\Program Files\Opera\Launcher.exe

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [173472 2017-01-31] (SUPERAntiSpyware.com)
S2 dadhService_23338201; C:\ProgramData\dadhService\dadhService_23338201.exe [1945600 2017-11-03] () [File not signed]
S3 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe [1368408 2015-11-30] (Disc Soft Ltd)
S2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-30] (Intel Corporation)
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1514464 2016-03-10] (Malwarebytes)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1136608 2016-03-10] (Malwarebytes)
S2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201872 2012-11-23] (Realtek Semiconductor)
S2 wltrysvc; C:\Program Files\Dell\DW WLAN Card\bcmwltry.exe [6170624 2014-07-23] (Dell Inc.) [File not signed]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [31920 2014-04-09] (Wondershare)
S3 atrfiltr; C:\Windows\System32\DRIVERS\atrfiltr.sys [16224 2014-09-11] (Windows (R) Win 7 DDK provider)
S3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [170200 2014-07-23] (Broadcom Corporation.)
S3 cxbu0x64; C:\Windows\System32\DRIVERS\cxbu0x64.sys [191224 2014-05-14] (HID Global Corporation)
R3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [30264 2015-12-06] (Disc Soft Ltd)
R3 dtliteusbbus; C:\Windows\System32\DRIVERS\dtliteusbbus.sys [46392 2015-12-06] (Disc Soft Ltd)
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2017-11-05] ()
R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [44744 2015-05-08] (AnchorFree Inc.)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-08-30] (Intel Corporation)
S3 jakstaVA; C:\Windows\System32\DRIVERS\jaksta_va.sys [103816 2014-12-09] (e2eSoft)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [27008 2016-03-10] (Malwarebytes)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2017-11-05] (Malwarebytes)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64896 2016-03-10] (Malwarebytes Corporation)
S1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S4 secdrv; C:\Windows\SysWow64\Drivers\secdrv.sys [11973 2016-12-28] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [File not signed]
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [31472 2013-11-22] (Synaptics Incorporated)
R3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42064 2016-05-27] (Anchorfree Inc.)
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-11-05 18:43 - 2017-11-05 18:43 - 000013685 _____ C:\Users\Adrian\Desktop\FRST.txt
2017-11-05 18:16 - 2017-11-05 18:16 - 000119084 _____ C:\Users\Adrian\Desktop\ZHPDiag.txt
2017-11-05 18:11 - 2017-11-05 18:11 - 002900480 _____ C:\Users\Adrian\Downloads\zhpdiag_v2017.10.9.179(1).exe
2017-11-05 18:00 - 2017-11-05 18:01 - 000065110 _____ C:\Windows\ntbtlog.txt
2017-11-05 17:57 - 2017-11-05 18:01 - 000317056 _____ C:\Windows\system32\FNTCACHE.DAT
2017-11-05 17:56 - 2017-11-05 17:56 - 000001496 _____ C:\Windows\Tasks\A PDF Realiser.job
2017-11-05 17:55 - 2017-11-05 17:55 - 008261584 _____ (Malwarebytes) C:\Users\Adrian\Downloads\adwcleaner_7.0.4.0.exe
2017-11-05 15:02 - 2017-11-05 15:02 - 000070584 _____ C:\Users\Adrian\AppData\Local\GDIPFONTCACHEV1.DAT
2017-11-05 10:33 - 2017-11-05 17:57 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\uxl2hdgdu4s
2017-11-05 10:32 - 2017-11-05 17:57 - 000000000 ____D C:\Program Files\M2RZMA4RJZ
2017-11-05 10:20 - 2017-11-05 10:20 - 000003266 _____ C:\Windows\System32\Tasks\SpyHunter4Startup
2017-11-05 10:18 - 2017-11-05 17:58 - 000001131 _____ C:\Users\Adrian\Desktop\SpyHunter.lnk
2017-11-05 10:18 - 2017-11-05 13:07 - 000000000 ____D C:\Users\Adrian\AppData\Local\IntInfApp
2017-11-05 10:17 - 2017-11-05 10:17 - 000022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys
2017-11-03 22:18 - 2017-11-05 13:57 - 000000012 _____ C:\ProgramData\rwi.hdad
2017-11-03 22:15 - 2017-11-03 22:15 - 000000008 __RSH C:\ProgramData\ntuser.pol
2017-11-03 22:14 - 2017-11-03 22:19 - 000001678 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Моzillа Firеfох.lnk
2017-11-03 22:14 - 2017-11-03 22:19 - 000001613 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ореrа Вrоwsеr.lnk
2017-11-03 22:14 - 2017-11-03 22:14 - 000000000 ____D C:\Windows\Azart
2017-11-03 22:14 - 2017-11-03 22:14 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\3hqdlvlvpef
2017-11-03 22:13 - 2017-11-05 17:56 - 000016710 _____ C:\Windows\System32\Tasks\A PDF Realiser
2017-11-03 22:13 - 2017-11-05 17:31 - 000000000 ____D C:\Program Files\KTXSO4G0W1
2017-11-03 22:13 - 2017-11-05 16:14 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\ReportErr
2017-11-03 22:13 - 2017-11-03 22:19 - 000001666 _____ C:\Users\Public\Desktop\Моzillа Firеfох.lnk
2017-11-03 22:13 - 2017-11-03 22:19 - 000001601 _____ C:\Users\Public\Desktop\Ореrа Вrоwsеr.lnk
2017-11-03 22:13 - 2017-11-03 22:13 - 000000000 ____D C:\ProgramData\dadhService
2017-11-03 22:12 - 2017-11-05 17:59 - 000001923 _____ C:\Users\Adrian\AppData\Roaming\Microsoft\Windows\Start Menu\Delete miner.lnk
2017-11-03 22:12 - 2017-11-03 22:14 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\server
2017-11-02 19:41 - 2017-11-02 19:44 - 000000000 ____D C:\Users\Adrian\Downloads\Les Infidèles
2017-11-02 19:39 - 2017-11-02 19:39 - 000000000 ____D C:\Users\Adrian\Downloads\Noydem
2017-11-02 19:31 - 2017-11-02 19:33 - 063231015 _____ C:\Users\Adrian\Downloads\Virgil_&_Steve_Howe_--_Nexus.zip
2017-11-02 19:31 - 2017-11-02 19:33 - 050255194 _____ C:\Users\Adrian\Downloads\The Rasmus - 2017 - Dark Matters.rar
2017-11-02 19:25 - 2017-11-02 19:29 - 173711615 _____ C:\Users\Adrian\Downloads\LES_INFIDELES_-_Le_coeur_des_foules.zip
2017-11-02 19:16 - 2017-11-02 19:17 - 000000000 ____D C:\Users\Adrian\Downloads\Tangram
2017-11-02 19:15 - 2017-11-02 19:16 - 000000000 ____D C:\Users\Adrian\Downloads\Thief
2017-11-02 19:13 - 2017-11-02 19:14 - 000000000 ____D C:\Users\Adrian\Downloads\Tiemko
2017-11-02 19:11 - 2017-11-02 19:13 - 000000000 ____D C:\Users\Adrian\Downloads\Tangerine Dream Poland
2017-11-02 19:10 - 2017-11-02 19:10 - 000000000 ____D C:\Users\Adrian\Downloads\White Eagle
2017-11-02 19:09 - 2017-11-02 19:10 - 000000000 ____D C:\Users\Adrian\Downloads\Tour de France
2017-11-02 19:07 - 2017-11-02 19:08 - 000000000 ____D C:\Users\Adrian\Downloads\LIZZY MERCIER DESCLOUX ~ Lizzy Mercier Descloux [1984]
2017-10-30 17:13 - 2015-07-07 00:27 - 000000000 ____D C:\Users\Adrian\Downloads\__MACOSX
2017-10-30 17:13 - 2015-07-07 00:26 - 000000000 ____D C:\Users\Adrian\Downloads\Fantomette - Georges Chaulet
2017-10-29 18:32 - 2017-10-29 18:32 - 001006492 _____ C:\Users\Adrian\Downloads\Verne-Le_Chateau_des_Carpathes.pdf
2017-10-26 10:30 - 2017-10-26 10:31 - 000000000 ____D C:\Users\Adrian\Downloads\Zeit
2017-10-26 10:29 - 2017-10-26 10:30 - 000000000 ____D C:\Users\Adrian\Downloads\Atem
2017-10-26 00:35 - 2017-10-26 00:35 - 000770080 _____ C:\Users\Adrian\Downloads\2003_The_Jethro_Tull_Christmas_Album.pdf
2017-10-23 20:24 - 2017-05-27 08:21 - 000000000 ____D C:\Users\Adrian\Downloads\Covers
2017-10-23 13:09 - 2017-10-23 20:22 - 532939211 _____ C:\Users\Adrian\Downloads\LMA_JeTu.1977.SFTW.TCS.2017.40THAE_Scans.rar
2017-10-22 19:13 - 2017-10-22 19:54 - 000002021 _____ C:\Users\Adrian\Documents\Cinéma d'Europe.txt
2017-10-22 18:57 - 2017-10-22 21:21 - 000000000 ____D C:\Users\Adrian\Downloads\Cinéma d'Europe
2017-10-22 16:40 - 2017-10-22 16:40 - 000011849 _____ C:\Users\Adrian\Downloads\costs-for-costa-rica.xlsx
2017-10-22 16:24 - 2017-10-22 16:24 - 000134131 _____ C:\Users\Adrian\Downloads\Rupi_s_Dance.pdf
2017-10-20 16:51 - 2017-10-20 16:51 - 000495898 _____ C:\Users\Adrian\Downloads\video-1508483112.mp4
2017-10-20 16:50 - 2017-10-20 16:50 - 001532597 _____ C:\Users\Adrian\Downloads\video-1508484494.mp4
2017-10-18 21:25 - 2017-11-05 17:37 - 002403328 _____ (Farbar) C:\Users\Adrian\Downloads\FRST64.exe
2017-10-18 21:06 - 2017-10-18 21:34 - 000000000 ____D C:\Users\Adrian\Downloads\Suspiria
2017-10-18 20:56 - 2017-10-18 21:01 - 081954797 _____ C:\Users\Adrian\Downloads\Carnival of souls.rar
2017-10-18 20:55 - 2017-10-18 21:00 - 067087993 _____ C:\Users\Adrian\Downloads\Iris.rar
2017-10-18 20:54 - 2017-10-18 20:59 - 112737354 _____ C:\Users\Adrian\Downloads\Suspiria.7z
2017-10-18 15:25 - 2017-10-18 15:25 - 000000000 ____D C:\Users\Adrian\Downloads\Cast
2017-10-18 15:19 - 2017-10-18 15:19 - 000000000 ____D C:\Users\Adrian\Downloads\Ars Nova
2017-10-18 15:07 - 2017-10-18 15:08 - 000000000 ____D C:\Users\Adrian\Downloads\Gerard
2017-10-18 10:54 - 2017-10-18 11:16 - 373232699 _____ C:\Users\Adrian\Downloads\Krautrock The Rebirth of Germany == full length documentary (with Translating tools) [360p].webm
2017-10-18 10:53 - 2017-10-18 11:07 - 334452261 _____ C:\Users\Adrian\Downloads\Tangerine Dream - Arte - 25.11.2016 смотреть онлайн видео от.mp4
2017-10-17 11:02 - 2017-10-17 11:02 - 002900480 _____ C:\Users\Adrian\Downloads\zhpdiag_v2017.10.9.179.exe
2017-10-17 10:59 - 2017-10-17 10:59 - 000000000 ____D C:\Windows\pss
2017-10-16 09:00 - 2017-10-16 09:00 - 038515032 _____ C:\Users\Adrian\Downloads\_docslide_us_mad-movies-hs05-lage-dor-du-cinema-de.pdf
2017-10-16 08:27 - 2017-10-16 08:29 - 000000000 ____D C:\Users\Adrian\Downloads\Stati Di Immaginazione
2017-10-16 08:26 - 2017-10-16 08:27 - 000000000 ____D C:\Users\Adrian\Downloads\Ulisse
2017-10-16 08:22 - 2017-10-16 08:23 - 000000000 ____D C:\Users\Adrian\Downloads\Serendipity
2017-10-13 09:24 - 2017-09-26 20:31 - 000000000 ____D C:\Users\Adrian\Downloads\Marilyn Manson - Heaven Upside Down (2017)
2017-10-12 11:16 - 2017-10-12 11:48 - 000000000 ____D C:\Users\Adrian\Desktop\NES

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-11-05 18:43 - 2017-09-13 19:24 - 000000000 ____D C:\FRST
2017-11-05 18:12 - 2015-08-16 20:19 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\ZHP
2017-11-05 18:06 - 2009-07-14 07:13 - 000784286 _____ C:\Windows\system32\PerfStringBackup.INI
2017-11-05 18:06 - 2009-07-14 05:20 - 000000000 ____D C:\Windows\inf
2017-11-05 18:02 - 2016-06-04 13:37 - 000000000 ____D C:\AdwCleaner
2017-11-05 17:59 - 2017-09-23 11:55 - 000001082 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pale Moon.lnk
2017-11-05 17:59 - 2017-09-23 11:55 - 000000923 _____ C:\Users\Public\Desktop\Pale Moon.lnk
2017-11-05 17:59 - 2017-04-14 10:33 - 000002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2017-11-05 17:59 - 2017-04-14 10:33 - 000002001 _____ C:\Users\Public\Desktop\Acrobat Reader DC.lnk
2017-11-05 17:59 - 2017-03-29 19:04 - 000001846 _____ C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
2017-11-05 17:59 - 2016-12-29 11:49 - 000000936 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Utilitaires Sierra.lnk
2017-11-05 17:59 - 2016-06-26 14:25 - 000002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2017-11-05 17:59 - 2016-06-26 14:25 - 000002001 _____ C:\Users\Public\Desktop\Acrobat Reader DC.lnk
2017-11-05 17:59 - 2015-12-06 13:35 - 000001811 _____ C:\Users\Public\Desktop\DAEMON Tools Lite.lnk
2017-11-05 17:59 - 2015-11-22 22:06 - 000001988 _____ C:\Users\Adrian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FileHippo App Manager.lnk
2017-11-05 17:59 - 2015-08-31 17:49 - 000000860 _____ C:\Users\Public\Desktop\CCleaner.lnk
2017-11-05 17:59 - 2015-08-17 14:36 - 000001060 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2017-11-05 17:59 - 2015-07-30 18:04 - 000001070 _____ C:\Users\Public\Desktop\OpenOffice 4.1.1.lnk
2017-11-05 17:59 - 2014-09-01 21:47 - 000000959 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk
2017-11-05 17:59 - 2014-08-04 18:46 - 000002691 _____ C:\Users\Public\Desktop\Skype.lnk
2017-11-05 17:59 - 2014-08-01 14:32 - 000000977 _____ C:\Users\Public\Desktop\Mp3tag.lnk
2017-11-05 17:59 - 2014-07-24 15:42 - 000000794 _____ C:\Users\Adrian\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk
2017-11-05 17:59 - 2014-07-24 13:39 - 000001024 _____ C:\Users\Public\Desktop\VLC media player.lnk
2017-11-05 17:59 - 2014-07-24 13:36 - 000001933 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SumatraPDF.lnk
2017-11-05 17:59 - 2009-07-14 07:01 - 000001218 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk
2017-11-05 17:59 - 2009-07-14 06:57 - 000001523 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2017-11-05 17:59 - 2009-07-14 06:57 - 000001352 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk
2017-11-05 17:59 - 2009-07-14 06:57 - 000001304 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
2017-11-05 17:59 - 2009-07-14 06:57 - 000001246 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
2017-11-05 17:59 - 2009-07-14 06:54 - 000001210 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
2017-11-05 17:59 - 2009-07-14 06:49 - 000001246 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk
2017-11-05 17:58 - 2016-06-05 16:10 - 000000832 _____ C:\Users\Adrian\Desktop\ZHPCleaner.lnk
2017-11-05 17:58 - 2016-06-03 16:32 - 000001748 _____ C:\Users\Adrian\Desktop\MPC-HC x64.lnk
2017-11-05 17:58 - 2016-05-02 19:24 - 000001968 _____ C:\Users\Adrian\Desktop\AVI ReComp.lnk
2017-11-05 17:58 - 2015-08-17 14:39 - 000192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-11-05 17:58 - 2014-09-01 21:47 - 000000947 _____ C:\Users\Adrian\Desktop\Audacity.lnk
2017-11-05 17:58 - 2014-07-24 15:42 - 000000814 _____ C:\Users\Adrian\Desktop\µTorrent.lnk
2017-11-05 17:57 - 2009-07-14 07:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2017-11-05 17:57 - 2009-07-14 05:20 - 000000000 ____D C:\Windows\ModemLogs
2017-11-05 17:57 - 2009-07-14 05:20 - 000000000 ____D C:\Program Files\A PDF Realiser
2017-11-05 17:32 - 2014-07-24 12:25 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\Adobe
2017-11-05 15:31 - 2016-06-03 16:33 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\MPC-HC
2017-11-05 15:31 - 2014-07-30 09:34 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\FileZilla
2017-11-05 15:31 - 2014-07-24 15:42 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\uTorrent
2017-11-05 14:45 - 2017-09-15 09:46 - 000000000 ____D C:\Users\Adrian\Desktop\FRST-OlderVersion
2017-11-05 14:45 - 2017-09-13 19:23 - 002403328 _____ (Farbar) C:\Users\Adrian\Desktop\FRST64.exe
2017-11-05 14:43 - 2015-08-17 14:36 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2017-11-05 14:43 - 2015-08-17 14:35 - 000000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2017-11-05 14:42 - 2009-07-14 06:45 - 000025120 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-11-05 14:42 - 2009-07-14 06:45 - 000025120 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-11-05 10:28 - 2017-09-23 11:55 - 000000000 ____D C:\Program Files\Pale Moon
2017-11-05 10:20 - 2014-07-24 12:24 - 000000000 ____D C:\Windows\SysWOW64\Macromed
2017-11-03 22:14 - 2009-07-14 05:20 - 000000000 ___HD C:\Windows\system32\GroupPolicy
2017-11-03 22:14 - 2009-07-14 05:20 - 000000000 ____D C:\Windows\SysWOW64\GroupPolicy
2017-11-02 19:44 - 2014-08-01 14:32 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\Mp3tag
2017-10-30 12:20 - 2014-07-24 16:31 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\vlc
2017-10-29 12:31 - 2017-07-06 15:22 - 000000000 ____D C:\Users\Adrian\Documents\Depart' Aimant
2017-10-29 09:10 - 2017-09-06 16:04 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-10-28 10:10 - 2017-09-06 16:04 - 000000000 ____D C:\Program Files\Mozilla Firefox
2017-10-27 10:57 - 2017-09-20 20:53 - 000000000 ____D C:\Program Files\Opera
2017-10-26 00:19 - 2015-12-22 00:42 - 000803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-10-26 00:19 - 2015-12-22 00:42 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-10-26 00:19 - 2014-07-24 12:24 - 000000000 ____D C:\Windows\system32\Macromed
2017-10-22 21:12 - 2014-08-23 13:32 - 000000000 ____D C:\Users\Adrian\Documents\Chroniques
2017-10-22 18:35 - 2014-07-23 18:30 - 000000000 ____D C:\Users\Adrian
2017-10-16 22:16 - 2014-08-22 18:55 - 000000000 ____D C:\Users\Adrian\Downloads\Pas finis
2017-10-16 08:42 - 2014-10-13 19:31 - 000000000 ____D C:\Users\Adrian\Downloads\Livres
2017-10-13 09:26 - 2014-10-13 19:32 - 000000000 ____D C:\Users\Adrian\Downloads\Photos
2017-10-13 09:26 - 2014-10-13 19:31 - 000000000 ____D C:\Users\Adrian\Downloads\Installations
2017-10-13 09:11 - 2017-08-06 18:25 - 000000000 ____D C:\Users\Adrian\Downloads\Correction
2017-10-09 15:01 - 2016-11-15 20:08 - 000000000 ____D C:\Users\Adrian\AppData\LocalLow\Mozilla

==================== Files in the root of some directories =======

2015-12-06 18:47 - 2017-08-06 12:32 - 000011264 _____ () C:\Users\Adrian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2017-09-06 19:27 - 2017-09-06 19:27 - 000140800 _____ () C:\Users\Adrian\AppData\Local\installer.dat
2016-07-17 09:44 - 2016-07-17 09:46 - 000002222 _____ () C:\Users\Adrian\AppData\Local\WiDiSetupLog.20160717.104454.txt
2016-07-17 09:55 - 2016-07-17 09:55 - 000011200 _____ () C:\Users\Adrian\AppData\Local\WiDiSetupLog.20160717.105514.txt
2017-11-03 22:18 - 2017-11-05 13:57 - 000000012 _____ () C:\ProgramData\rwi.hdad

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-12-17 12:22

==================== End of FRST.txt ============================