Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 05-02-2017
Ran by David (administrator) on SNOW-PC (09-02-2017 08:17:22)
Running from C:\Users\David\Downloads
Loaded Profiles: David (Available Profiles: David)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 9 (Default browser: FF)
Boot Mode: Safe Mode (with Networking)
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2679592 2011-02-03] (Synaptics Incorporated)
HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [571304 2010-12-09] (TOSHIBA Corporation)
HKLM\...\Run: [HSON] => C:\Program Files\TOSHIBA\TBS\HSON.exe [296824 2010-09-25] (TOSHIBA Corporation)
HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [973176 2010-12-15] (TOSHIBA Corporation)
HKLM\...\Run: [Korean IME Migration] => C:\Program Files\Common Files\Microsoft Shared\IME12\IMEKR\IMKRMIG.EXE [43808 2006-10-26] (Microsoft Corporation)
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [5595848 2015-07-08] (ESET)
HKLM-x32\...\Run: [Korean IME Migration] => C:\Program Files (x86)\Common Files\microsoft shared\IME12\IMEKR\IMKRMIG.EXE [26400 2006-10-26] (Microsoft Corporation)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [24952456 2015-12-08] (Dropbox, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
HKU\S-1-5-21-768809636-1414782620-3286814988-1000\...\RunOnce: [Report] => C:\AdwCleaner\AdwCleaner[C0].txt [5203 2017-02-07] ()
HKU\S-1-5-21-768809636-1414782620-3286814988-1000\...\MountPoints2: {47507111-772b-11e3-8bb6-e89a8ff73b80} - E:\Startme.exe
HKU\S-1-5-21-768809636-1414782620-3286814988-1000\...\MountPoints2: {63fe880d-761d-11e3-89b7-e89a8ff73b80} - F:\.\outcast.exe
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2014-01-05] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-12-08] (Dropbox, Inc.)
BootExecute: autocheck autochk /p \??\C:autocheck autochk * 
GroupPolicy: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{F73D05EC-1B70-4BEF-BB37-DCA1F28CB6DE}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = 
HKU\S-1-5-21-768809636-1414782620-3286814988-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://fr.msn.com/?ocid=iehp
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2014-10-22] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2014-10-14] (Microsoft Corporation)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2014-10-22] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2013-09-12] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2014-10-14] (Microsoft Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-04-01] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)

FireFox:
========
FF ProfilePath: C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\wrsgw2s1.default-1448919255487 [2017-02-09]
FF Extension: (Firefox Hotfix) - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\wrsgw2s1.default-1448919255487\Extensions\firefox-hotfix@mozilla.org.xpi [2017-02-06]
FF Extension: (Adblock Plus) - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\wrsgw2s1.default-1448919255487\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2017-02-06]
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird => not found
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird => not found
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1212152.dll [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2013-11-14] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @nprotect.com/npEfdsWPlugin -> C:\Users\David\AppData\LocalLow\nProtect\npEfdsWCtrl\npEfdsWPlugin.dll [No File]
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2017-02-05] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2017-02-05] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [No File]
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-768809636-1414782620-3286814988-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\David\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-02-20] (Unity Technologies ApS)
FF Plugin HKU\S-1-5-21-768809636-1414782620-3286814988-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [No File]
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2013-11-14] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)

Chrome: 
=======
CHR DefaultProfile: Default
CHR Profile: C:\Users\David\AppData\Local\Google\Chrome\User Data\Default [2017-02-09]
CHR Extension: (Google Docs) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-03-03]
CHR Extension: (Google Drive) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-22]
CHR Extension: (YouTube) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-25]
CHR Extension: (Adblock Plus) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2017-02-06]
CHR Extension: (Google Search) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-19]
CHR Extension: (Google Docs Offline) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-02-06]
CHR Extension: (Chrome Web Store Payments) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-02-06]
CHR Extension: (Gmail) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-29]
CHR Extension: (Chrome Media Router) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-02-06]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2017-02-06] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2017-02-06] (Dropbox, Inc.)
S2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [1353720 2015-07-08] (ESET)
S4 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [25800 2015-09-28] (Hewlett-Packard Company)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [File not signed]
S2 rpcnetp; C:\Windows\System32\rpcnetp.exe [17920 2017-02-09] () [File not signed]
S2 rpcnetp; C:\Windows\SysWOW64\rpcnetp.exe [17920 2017-02-09] () [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-01-07] (Disc Soft Ltd)
S1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [255240 2015-07-14] (ESET)
U5 edevmon; C:\Windows\System32\Drivers\edevmon.sys [251632 2015-07-14] (ESET)
S1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [178520 2015-07-14] (ESET)
S2 epfwwfpr; C:\Windows\System32\DRIVERS\epfwwfpr.sys [168208 2015-07-14] (ESET)
S3 INSTB32; \??\C:\WINDOWS\TEMP\INSTB64.SYS [X]
S3 L1C; system32\DRIVERS\L1C62x64.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-02-09 08:17 - 2017-02-09 08:17 - 00014937 _____ C:\Users\David\Downloads\FRST.txt
2017-02-09 08:16 - 2017-02-09 08:17 - 00000000 ____D C:\FRST
2017-02-09 08:16 - 2017-02-09 08:16 - 02421248 _____ (Farbar) C:\Users\David\Downloads\FRST64.exe
2017-02-09 07:58 - 2017-02-09 07:58 - 00001849 _____ C:\Users\Public\Desktop\ZHPFix.lnk
2017-02-09 07:58 - 2017-02-09 07:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP
2017-02-09 07:54 - 2017-02-09 07:54 - 00271656 _____ C:\Windows\Minidump\020917-35069-01.dmp
2017-02-09 07:44 - 2017-02-09 07:44 - 00271656 _____ C:\Windows\Minidump\020917-34257-01.dmp
2017-02-09 07:23 - 2017-02-09 07:23 - 03521617 _____ (Nicolas Coolman ) C:\Users\David\Downloads\ZHPFix (1).exe
2017-02-08 19:54 - 2017-02-08 19:54 - 00271656 _____ C:\Windows\Minidump\020817-36161-01.dmp
2017-02-08 18:40 - 2017-02-09 07:58 - 00000000 ____D C:\Program Files (x86)\ZHPFix
2017-02-08 18:39 - 2017-02-08 18:39 - 03521617 _____ (Nicolas Coolman ) C:\Users\David\Downloads\ZHPFix.exe
2017-02-08 18:38 - 2017-02-08 18:38 - 02660864 _____ C:\Users\David\Downloads\ZHPDiag3(1).exe
2017-02-08 18:31 - 2017-02-08 18:32 - 02660864 _____ C:\Users\David\Downloads\ZHPDiag3 (1).exe
2017-02-08 18:27 - 2017-02-08 18:27 - 00283224 _____ C:\Windows\Minidump\020817-32136-01.dmp
2017-02-08 08:22 - 2017-02-08 18:52 - 00110380 _____ C:\Users\David\Desktop\ZHPDiag.txt
2017-02-08 08:17 - 2017-02-09 07:58 - 00000000 ____D C:\Users\David\AppData\Roaming\ZHP
2017-02-08 08:17 - 2017-02-08 18:34 - 00000782 _____ C:\Users\David\Desktop\ZHPDiag.lnk
2017-02-08 08:17 - 2017-02-08 08:17 - 02660864 _____ C:\Users\David\Downloads\ZHPDiag3.exe
2017-02-07 22:43 - 2017-02-07 22:43 - 00282984 _____ C:\Windows\Minidump\020717-33228-01.dmp
2017-02-07 22:24 - 2017-02-07 22:25 - 00283384 _____ C:\Windows\Minidump\020717-31278-01.dmp
2017-02-07 22:18 - 2017-02-07 22:18 - 04015056 _____ C:\Users\David\Downloads\adwcleaner_6.043 (1).exe
2017-02-07 22:08 - 2017-02-07 22:18 - 00000000 ____D C:\AdwCleaner
2017-02-07 22:07 - 2017-02-07 22:07 - 04015056 _____ C:\Users\David\Downloads\adwcleaner_6.043.exe
2017-02-07 19:19 - 2017-02-07 19:20 - 00283384 _____ C:\Windows\Minidump\020717-31886-01.dmp
2017-02-07 19:16 - 2017-02-07 19:16 - 00283144 _____ C:\Windows\Minidump\020717-37065-01.dmp
2017-02-07 18:40 - 2017-02-07 18:41 - 00284424 _____ C:\Windows\Minidump\020717-32229-01.dmp
2017-02-06 23:23 - 2017-02-06 23:23 - 00283512 _____ C:\Windows\Minidump\020617-31293-01.dmp
2017-02-06 23:15 - 2017-02-06 23:15 - 24258801 _____ C:\Users\David\Downloads\hddprot-20110531134325.zip
2017-02-06 23:10 - 2011-06-27 12:59 - 24428520 _____ C:\Users\David\Desktop\TC30361400A.exe
2017-02-06 23:08 - 2017-02-06 23:09 - 24298260 _____ C:\Users\David\Downloads\hddprot-20120413104325.zip
2017-02-06 22:55 - 2017-02-06 22:55 - 00284664 _____ C:\Windows\Minidump\020617-31481-01.dmp
2017-02-06 22:51 - 2017-02-06 22:51 - 00284520 _____ C:\Windows\Minidump\020617-55317-01.dmp
2017-02-06 22:39 - 2016-11-14 13:30 - 01908272 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434201.dll
2017-02-06 22:39 - 2016-11-14 13:30 - 01557552 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434201.dll
2017-02-06 22:38 - 2016-11-14 13:30 - 31523384 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2017-02-06 22:38 - 2016-11-14 13:30 - 24208440 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2017-02-06 22:38 - 2016-11-14 13:30 - 23000000 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2017-02-06 22:38 - 2016-11-14 13:30 - 18634216 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2017-02-06 22:38 - 2016-11-14 13:30 - 17559384 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2017-02-06 22:38 - 2016-11-14 13:30 - 16128720 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2017-02-06 22:38 - 2016-11-14 13:30 - 15301056 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2017-02-06 22:38 - 2016-11-14 13:30 - 14497712 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2017-02-06 22:38 - 2016-11-14 13:30 - 13915720 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2017-02-06 22:38 - 2016-11-14 13:30 - 13826968 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2017-02-06 22:38 - 2016-11-14 13:30 - 12905016 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2017-02-06 22:38 - 2016-11-14 13:30 - 11270656 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2017-02-06 22:38 - 2016-11-14 13:30 - 11208312 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2017-02-06 22:38 - 2016-11-14 13:30 - 04253240 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2017-02-06 22:38 - 2016-11-14 13:30 - 03995192 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2017-02-06 22:38 - 2016-11-14 13:30 - 03207824 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2017-02-06 22:38 - 2016-11-14 13:30 - 02822568 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2017-02-06 22:38 - 2016-11-14 13:30 - 00951232 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2017-02-06 22:38 - 2016-11-14 13:30 - 00913856 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2017-02-06 22:38 - 2016-11-14 13:30 - 00909760 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2017-02-06 22:38 - 2016-11-14 13:30 - 00876480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2017-02-06 22:35 - 2017-02-06 22:35 - 00284968 _____ C:\Windows\Minidump\020617-34195-01.dmp
2017-02-06 22:31 - 2017-02-06 22:32 - 00000000 ____D C:\ProgramData\NVIDIA
2017-02-06 22:27 - 2017-02-06 22:27 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2017-02-06 22:26 - 2015-02-04 04:56 - 00072904 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2017-02-06 22:26 - 2015-02-04 04:56 - 00059592 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2017-02-06 22:26 - 2015-02-04 03:21 - 06782152 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2017-02-06 22:26 - 2015-02-04 03:21 - 03522376 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2017-02-06 22:26 - 2015-02-04 03:21 - 02558792 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2017-02-06 22:26 - 2015-02-04 03:21 - 00932040 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2017-02-06 22:26 - 2015-02-04 03:21 - 00384200 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2017-02-06 22:26 - 2015-02-04 03:21 - 00062792 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2017-02-06 22:26 - 2015-02-03 17:18 - 04229086 _____ C:\Windows\system32\nvcoproc.bin
2017-02-06 22:25 - 2016-11-14 13:30 - 00026157 _____ C:\Windows\system32\nvinfo.pb
2017-02-06 22:25 - 2015-02-11 11:38 - 01515296 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll
2017-02-06 22:25 - 2015-02-11 11:38 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2017-02-06 22:25 - 2015-02-11 11:38 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2017-02-06 22:25 - 2015-02-04 04:56 - 01907400 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434144.dll
2017-02-06 22:25 - 2015-02-04 04:56 - 01555656 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434144.dll
2017-02-06 22:24 - 2017-02-06 22:42 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2017-02-06 22:12 - 2017-02-06 22:12 - 00000000 ____D C:\ProgramData\Oracle
2017-02-06 22:10 - 2017-02-07 22:05 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-02-06 22:08 - 2017-02-06 22:10 - 00738880 _____ (Oracle Corporation) C:\Users\David\Downloads\jxpiinstall.exe
2017-02-06 22:03 - 2017-02-06 22:03 - 00738880 _____ (Oracle Corporation) C:\Users\David\Downloads\chromeinstall-8u121.exe
2017-02-06 21:39 - 2017-02-06 21:41 - 306673592 _____ (NVIDIA Corporation) C:\Users\David\Downloads\342.01-notebook-win8-win7-64bit-international.exe
2017-02-06 20:59 - 2017-02-06 20:59 - 04958280 _____ (Resplendence Software Projects Sp. ) C:\Users\David\Downloads\whocrashedSetup (1).exe
2017-02-06 20:59 - 2017-02-06 20:59 - 00000846 _____ C:\Users\David\Desktop\WhoCrashed.lnk
2017-02-06 20:55 - 2017-02-06 20:55 - 00271824 _____ C:\Windows\Minidump\020617-30997-01.dmp
2017-02-05 21:12 - 2017-02-05 21:12 - 00271824 _____ C:\Windows\Minidump\020517-31995-01.dmp
2017-02-04 20:31 - 2008-07-20 11:26 - 01537024 _____ C:\Users\David\AppData\Roaming\questdb.v12
2017-02-04 20:27 - 2017-02-04 20:27 - 00271824 _____ C:\Windows\Minidump\020417-21621-01.dmp
2017-02-04 20:24 - 2017-02-04 20:24 - 00271824 _____ C:\Windows\Minidump\020417-19593-01.dmp
2017-01-19 09:41 - 2017-01-19 09:41 - 00271824 _____ C:\Windows\Minidump\011917-19453-01.dmp

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-02-09 07:54 - 2015-12-12 20:27 - 03123242 _____ C:\Windows\ntbtlog.txt
2017-02-09 07:54 - 2015-10-18 04:06 - 00000000 ____D C:\Windows\Minidump
2017-02-09 07:53 - 2015-12-12 15:37 - 00017920 _____ C:\Windows\SysWOW64\rpcnetp.exe
2017-02-09 07:53 - 2015-10-18 04:06 - 329508137 _____ C:\Windows\MEMORY.DMP
2017-02-09 07:53 - 2014-01-05 16:25 - 00000000 ____D C:\Program Files (x86)\WinRAR
2017-02-09 07:53 - 2009-12-31 14:31 - 00017920 _____ C:\Windows\system32\rpcnetp.exe
2017-02-09 07:52 - 2014-05-27 02:26 - 00000000 ____D C:\Users\David\AppData\Local\Ubisoft Game Launcher
2017-02-08 22:23 - 2007-04-21 15:42 - 00036864 _____ C:\Users\David\AppData\Roaming\CDRusersDB.v12
2017-02-08 20:11 - 2015-12-12 22:39 - 00000000 ____D C:\Program Files\WhoCrashed
2017-02-08 19:52 - 2015-05-10 13:18 - 00000000 ____D C:\Users\David\AppData\Roaming\Yacht Club Games
2017-02-08 19:52 - 2009-07-14 06:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2017-02-08 19:17 - 2014-01-05 07:12 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2017-02-08 19:17 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\inf
2017-02-08 18:25 - 2014-05-10 13:12 - 00001064 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cf6c4923c5cc4c.job
2017-02-08 18:24 - 2015-12-12 20:25 - 00078032 _____ (Absolute Software Corp.) C:\Windows\SysWOW64\rpcnet.dll
2017-02-08 18:24 - 2015-12-12 15:37 - 00017920 _____ C:\Windows\SysWOW64\rpcnetp.dll
2017-02-08 18:24 - 2015-10-08 20:33 - 00001180 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job
2017-02-08 18:24 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-02-07 22:40 - 2014-11-22 00:42 - 00001068 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA1d005e4c3374a53.job
2017-02-07 22:21 - 2014-04-03 01:06 - 00001068 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA1cf4ed08b83d1f3.job
2017-02-07 22:15 - 2015-12-12 23:44 - 00000000 ____D C:\Users\David\Desktop\DDU Logs
2017-02-07 22:10 - 2014-03-21 06:55 - 00000000 ____D C:\Users\David\AppData\Roaming\cacaoweb
2017-02-07 22:10 - 2014-01-05 06:57 - 00000000 ____D C:\Users\David
2017-02-07 22:05 - 2014-01-05 16:38 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-02-07 19:17 - 2015-10-08 20:33 - 00003928 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskMachineCore
2017-02-07 18:39 - 2015-10-08 20:33 - 00001184 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job
2017-02-06 22:34 - 2015-10-08 20:33 - 00004180 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskMachineUA
2017-02-06 22:26 - 2014-01-05 17:09 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2017-02-06 22:26 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Help
2017-02-06 20:59 - 2015-12-12 22:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WhoCrashed
2017-02-05 21:34 - 2014-01-07 01:01 - 00002267 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-02-05 21:09 - 2014-01-07 01:22 - 00000000 ____D C:\Office Activation Technologies
2017-02-04 20:52 - 2014-01-07 00:41 - 00000000 ____D C:\Users\David\AppData\Local\ElevatedDiagnostics
2017-02-04 20:31 - 2014-01-05 17:02 - 00000000 ____D C:\Users\David\AppData\Roaming\Macromedia
2017-01-19 18:11 - 2009-07-14 05:45 - 00021024 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-01-19 18:11 - 2009-07-14 05:45 - 00021024 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-01-19 14:24 - 2014-01-05 06:59 - 00745690 _____ C:\Windows\system32\perfh00C.dat
2017-01-19 14:24 - 2014-01-05 06:59 - 00149582 _____ C:\Windows\system32\perfc00C.dat
2017-01-19 14:24 - 2009-07-14 06:13 - 01668256 _____ C:\Windows\system32\PerfStringBackup.INI
2017-01-19 12:03 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache

==================== Files in the root of some directories =======

2007-04-21 15:42 - 2017-02-08 22:23 - 0036864 _____ () C:\Users\David\AppData\Roaming\CDRusersDB.v12
2017-02-04 20:31 - 2008-07-20 11:26 - 1537024 _____ () C:\Users\David\AppData\Roaming\questdb.v12
2014-01-07 00:57 - 2014-01-07 00:57 - 0003584 _____ () C:\Users\David\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-03-28 01:30 - 2014-03-28 01:30 - 0001623 _____ () C:\Users\David\AppData\Local\recently-used.xbel
2014-01-05 16:25 - 2014-01-05 16:25 - 0000017 _____ () C:\Users\David\AppData\Local\resmon.resmoncfg
2014-01-07 01:05 - 2014-01-07 01:05 - 0000057 _____ () C:\ProgramData\Ament.ini
2015-11-18 18:56 - 2015-11-18 19:09 - 0000715 _____ () C:\ProgramData\hpzinstall.log

Some files in TEMP:
====================
2015-12-09 15:01 - 2015-12-09 15:01 - 0071168 _____ () C:\Users\David\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpeipzqa.dll
2015-12-09 14:27 - 2015-12-09 14:27 - 0071168 _____ () C:\Users\David\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpwzzn7x.dll
2015-12-12 23:07 - 2015-02-04 01:00 - 0826696 _____ (NVIDIA Corporation) C:\Users\David\AppData\Local\Temp\nvStInst.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-01-19 11:55

==================== End of FRST.txt ============================