Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 05-05-2017 01
Ran by Don (administrator) on DON-PC (05-05-2017 16:28:33)
Running from C:\Users\Don\Desktop
Loaded Profiles: Don (Available Profiles: Don)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 8 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Program Files (x86)\Intel\AMT\atchksrv.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(SHADOWDEFENDER.COM) C:\Program Files\Shadow Defender\DefenderDaemon.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Intel) C:\Program Files (x86)\Intel\AMT\LMS.exe
(Intel) C:\Program Files (x86)\Intel\AMT\UNS.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(Tonec Inc.) C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe
(CyberGhost S.R.L) C:\Program Files (x86)\CyberGhost\CyberGhost.Service.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Shadow Defender Daemon] => C:\Program Files\Shadow Defender\DefenderDaemon.exe [484344 2016-07-23] (SHADOWDEFENDER.COM)
Winlogon\Notify\DfLogon: LogonDll.dll [X]
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2465256179-1618623775-1583742719-1000\...\Run: [IDMan] => C:\Program Files (x86)\Internet Download Manager\IDMan.exe [4027504 2017-05-02] (Tonec Inc.)
HKU\S-1-5-21-2465256179-1618623775-1583742719-1000\...\Run: [uTorrent] => C:\Users\Don\AppData\Roaming\uTorrent\uTorrent.exe [2144448 2017-05-03] (BitTorrent Inc.)
HKU\S-1-5-21-2465256179-1618623775-1583742719-1000\...\MountPoints2: {2bfa26cb-1b02-11e7-ae12-005056c00008} - G:\AutoRun.exe
HKU\S-1-5-21-2465256179-1618623775-1583742719-1000\...\MountPoints2: {5cc1552d-0ac3-11e7-be2f-806e6f6e6963} - G:\autorun.exe
HKU\S-1-5-21-2465256179-1618623775-1583742719-1000\...\MountPoints2: {bf67ea72-17d6-11e7-9c7c-005056c00008} - G:\AutoRun.exe
HKU\S-1-5-21-2465256179-1618623775-1583742719-1000\...\MountPoints2: {bf67ea85-17d6-11e7-9c7c-005056c00008} - G:\AutoRun.exe
ShellIconOverlayIdentifiers: [   IDM Shell Extension] -> {CDC95B92-E27C-4745-A8C5-64A52A78855D} => C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll [2015-08-14] (Tonec Inc.)
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\..\Interfaces\{1D79AC72-AB39-40C7-8078-D3C5DE3E7704}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{6EE58ACB-4A43-4EAA-B932-7EF621A5E68F}: [NameServer] 62.251.230.241 212.217.0.1

Internet Explorer:
==================
HKU\S-1-5-21-2465256179-1618623775-1583742719-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/ar-eg/?ocid=iehp
BHO: IDM integration (IDMIEHlprObj Class) -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll [2016-12-10] (Internet Download Manager, Tonec Inc.)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_121\bin\ssv.dll [2017-02-15] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-02-15] (Oracle Corporation)
BHO-x32: IDM integration (IDMIEHlprObj Class) -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll [2016-12-10] (Internet Download Manager, Tonec Inc.)
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-21] (Microsoft Corporation)

FireFox:
========
FF DefaultProfile: 91b6kcxx.default
FF DefaultProfile: 3ooqrun8.default
FF ProfilePath: C:\Users\Don\AppData\Roaming\Mozilla\Firefox\Profiles\91b6kcxx.default [2017-05-05]
FF Extension: (Firefox All Aboard 1.6) - C:\Users\Don\AppData\Roaming\Mozilla\Firefox\Profiles\91b6kcxx.default\Extensions\@all-aboard-v1-6 [2017-03-07]
FF Extension: (To Google Translate) - C:\Users\Don\AppData\Roaming\Mozilla\Firefox\Profiles\91b6kcxx.default\Extensions\jid1-93WyvpgvxzGATw@jetpack.xpi [2017-04-29]
FF Extension: (ImTranslator) - C:\Users\Don\AppData\Roaming\Mozilla\Firefox\Profiles\91b6kcxx.default\Extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}.xpi [2017-04-30]
FF Extension: (Adblock Plus) - C:\Users\Don\AppData\Roaming\Mozilla\Firefox\Profiles\91b6kcxx.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2017-02-15]
FF Extension: (Shield Recipe Client) - C:\Users\Don\AppData\Roaming\Mozilla\Firefox\Profiles\91b6kcxx.default\features\{0da16ea8-f9af-4644-b135-19cfef54dbb5}\shield-recipe-client@mozilla.org.xpi [2017-05-03]
FF ProfilePath: C:\Users\Don\AppData\Roaming\8pecxstudios\Cyberfox\Profiles\3ooqrun8.default [2017-05-05]
FF Homepage: 8pecxstudios\Cyberfox\Profiles\3ooqrun8.default -> www.youtube.com
FF Extension: (Adblock Plus) - C:\Users\Don\AppData\Roaming\8pecxstudios\Cyberfox\Profiles\3ooqrun8.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2017-02-15]
FF Extension: (CyberCTR) - C:\Program Files\Cyberfox\browser\features\CTR@8pecxstudios.com.xpi [2017-02-11] [not signed]
FF HKU\S-1-5-21-2465256179-1618623775-1583742719-1000\...\Firefox\Extensions: [mozilla_cc3@internetdownloadmanager.com] - C:\Program Files (x86)\Internet Download Manager\idmmzcc3.xpi
FF Extension: (No Name) - C:\Program Files (x86)\Internet Download Manager\idmmzcc3.xpi [2017-04-25]
FF HKU\S-1-5-21-2465256179-1618623775-1583742719-1000\...\SeaMonkey\Extensions: [mozilla_cc2@internetdownloadmanager.com] - C:\Program Files (x86)\Internet Download Manager\idmmzcc2.xpi
FF Extension: (IDM integration) - C:\Program Files (x86)\Internet Download Manager\idmmzcc2.xpi [2017-01-26]
FF HKU\S-1-5-21-2465256179-1618623775-1583742719-1000\...\SeaMonkey\Extensions: [mozilla_cc@internetdownloadmanager.com] - C:\Users\Don\AppData\Roaming\IDM\idmmzcc5
FF Extension: (IDM CC) - C:\Users\Don\AppData\Roaming\IDM\idmmzcc5 [2017-05-03] [not signed]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_25_0_0_148.dll [2017-04-13] ()
FF Plugin: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-02-15] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-02-15] (Oracle Corporation)
FF Plugin: @videolan.org/vlc,version=2.2.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_25_0_0_148.dll [2017-04-13] ()
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-05-03] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-05-03] (Google Inc.)
FF Plugin HKU\S-1-5-21-2465256179-1618623775-1583742719-1000: @acestream.net/acestreamplugin,version=3.1.16.1 -> C:\Users\Don\AppData\Roaming\ACEStream\player\npace_plugin.dll [No File]

Chrome: 
=======
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR Profile: C:\Users\Don\AppData\Local\Google\Chrome\User Data\Default [2017-05-05]
CHR Extension: (Google Slides) - C:\Users\Don\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-03-07]
CHR Extension: (Flash Video Downloader) - C:\Users\Don\AppData\Local\Google\Chrome\User Data\Default\Extensions\aiimdkdngfcipjohbjenkahhlhccpdbc [2017-03-17]
CHR Extension: (Google Docs) - C:\Users\Don\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-03-07]
CHR Extension: (Adblock Plus) - C:\Users\Don\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2017-04-02]
CHR Extension: (Google Sheets) - C:\Users\Don\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-03-07]
CHR Extension: (Google Docs Offline) - C:\Users\Don\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-03-07]
CHR Extension: (Unlimited Free VPN - Hola) - C:\Users\Don\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio [2017-05-04]
CHR Extension: (IE Tab) - C:\Users\Don\AppData\Local\Google\Chrome\User Data\Default\Extensions\hehijbfgiekmjfkfjpbkbammjbdenadd [2017-04-29]
CHR Extension: (BrowserStack Local) - C:\Users\Don\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfiddfehmfdojjfdpfngagldgaaafcfo [2017-04-01]
CHR Extension: (IDM Integration Module) - C:\Users\Don\AppData\Local\Google\Chrome\User Data\Default\Extensions\ngpampappnmepgilojfohadhhmbhlaek [2017-04-29]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Don\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-17]
CHR Extension: (Chrome Media Router) - C:\Users\Don\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-05-05]
CHR HKLM\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx [2017-05-02]
CHR HKU\S-1-5-21-2465256179-1618623775-1583742719-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [mjbepbhonbojpoaenhckjocchgfiaofo] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx [2017-05-02]

Opera: 
=======
OPR Extension: (Video Downloader Pro) - C:\Users\Don\AppData\Roaming\Opera Software\Opera Stable\Extensions\ibehiiilehaakkhkigckfjfknboalpbe [2017-04-01]
OPR Extension: (IDM Integration Module) - C:\Users\Don\AppData\Roaming\Opera Software\Opera Stable\Extensions\ngpampappnmepgilojfohadhhmbhlaek [2017-04-04]
StartMenuInternet: (HKLM) OperaStable - C:\Program Files\Opera\Launcher.exe

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 atchksrv; C:\Program Files (x86)\Intel\AMT\atchksrv.exe [176128 2009-12-01] (Intel Corporation) [File not signed]
R2 CG6Service; C:\Program Files (x86)\CyberGhost\CyberGhost.Service.exe [71728 2016-08-18] (CyberGhost S.R.L)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
S2 Internet Mobile. RunOuc; C:\Program Files (x86)\Internet Mobile\UpdateDog\ouc.exe [655712 2017-04-02] ()
R2 LMS; C:\Program Files (x86)\Intel\AMT\LMS.exe [102400 2009-12-01] (Intel) [File not signed]
R2 UNS; C:\Program Files (x86)\Intel\AMT\UNS.exe [2519040 2009-12-01] (Intel) [File not signed]
S2 VMwareHostd; C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe [12472904 2016-10-21] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)
S2 {0CBD4F48-3751-475D-BE88-4F271385B672}; C:\Program Files\Shadow Defender\Service.exe [79056 2016-07-23] (SHADOWDEFENDER.COM)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R0 diskpt; C:\Windows\System32\drivers\diskpt.sys [420592 2016-07-23] (SHADOWDEFENDER.COM)
S3 huawei_wwanecm; C:\Windows\System32\DRIVERS\ew_juwwanecm.sys [229376 2017-04-02] (Huawei Technologies Co., Ltd.)
R2 npf; C:\Windows\System32\drivers\npf.sys [35344 2011-02-11] (CACE Technologies, Inc.)
R2 VBoxDrv; F:\YouWave Android\vb\VBoxDrv.sys [202592 2011-11-20] (Oracle Corporation)
R1 vmkbd3; C:\Windows\System32\DRIVERS\vmkbd.sys [52288 2016-10-21] (VMware, Inc.)
R0 vsock; C:\Windows\System32\DRIVERS\vsock.sys [93248 2016-09-30] (VMware, Inc.)
R2 vstor2-mntapi20-shared; C:\Windows\SysWow64\drivers\vstor2-mntapi20-shared.sys [34520 2015-07-09] (VMware, Inc.)
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-05-05 16:28 - 2017-05-05 16:29 - 00013815 _____ C:\Users\Don\Desktop\FRST.txt
2017-05-05 16:27 - 2017-05-05 16:28 - 00000000 ____D C:\FRST
2017-05-05 16:08 - 2017-05-05 16:08 - 02429440 _____ (Farbar) C:\Users\Don\Desktop\FRST64.exe
2017-05-05 14:43 - 2017-05-05 15:56 - 995993758 _____ C:\Users\Don\Desktop\Get.Out.2017.HC.720p.HDRiP.950MB.ShAaNiG.mkv
2017-05-05 14:42 - 2017-05-05 14:42 - 00019847 _____ C:\Users\Don\Downloads\[YTSYIFY.COM] Get Out (2017) HDRip [720p].torrent
2017-05-05 09:29 - 2017-05-05 09:29 - 145446380 _____ C:\Users\Don\Desktop\Cristiano Ronaldo ● TOP 10 Solo Goals Ever - 2003-2016 HD - YouTube.MP4
2017-05-05 07:49 - 2017-05-05 07:49 - 00000000 _____ C:\Users\Don\Desktop\New Text Document (3).txt
2017-05-05 06:54 - 2017-05-05 06:54 - 00000000 _____ C:\Users\Don\Desktop\New Text Document (2).txt
2017-05-05 06:40 - 2017-05-05 06:47 - 00000000 ____D C:\Users\Don\Desktop\New folder
2017-05-05 06:39 - 2017-05-05 06:39 - 01206280 _____ C:\Users\Don\Desktop\Untitled1.avi
2017-05-05 06:28 - 2017-05-05 06:28 - 00363803 _____ C:\Users\Don\Desktop\f.vep
2017-05-05 06:27 - 2017-05-05 06:28 - 01208250 _____ C:\Users\Don\Desktop\Untitled.avi
2017-05-05 06:23 - 2017-05-05 06:24 - 34297248 _____ C:\Users\Don\Desktop\Spoo Pow Jamais Nkon 3abad [OFFICIEL CLIP HD].mp4
2017-05-05 03:17 - 2017-05-05 03:18 - 29934781 _____ C:\Users\Don\Desktop\Lbenj - La Trace (Prod. Karim LOUKILI & Meed) - YouTube.MP4
2017-05-04 23:44 - 2017-05-04 23:51 - 00003742 _____ C:\Users\Don\Desktop\ZHPCleaner.txt
2017-05-04 23:36 - 2017-05-04 23:36 - 00000790 _____ C:\Users\Don\Desktop\ZHPCleaner.lnk
2017-05-04 23:34 - 2017-05-04 23:34 - 02766336 _____ C:\Users\Don\Desktop\ZHPCleaner.exe
2017-05-04 23:20 - 2017-05-04 23:20 - 00006018 _____ C:\Users\Don\Desktop\rk_8BEE.tmp.txt
2017-05-04 23:17 - 2017-05-04 23:18 - 00000351 _____ C:\Users\Don\Desktop\New Text Document.txt
2017-05-04 23:12 - 2017-05-04 23:12 - 00005746 _____ C:\Users\Don\Desktop\rk_79A5.tmp.txt
2017-05-04 22:53 - 2017-05-04 22:53 - 00028272 _____ C:\Windows\system32\Drivers\TrueSight.sys
2017-05-04 22:50 - 2017-05-04 22:50 - 00000858 _____ C:\Users\Public\Desktop\RogueKiller.lnk
2017-05-04 22:50 - 2017-05-04 22:50 - 00000000 ____D C:\ProgramData\RogueKiller
2017-05-04 22:50 - 2017-05-04 22:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller
2017-05-04 22:50 - 2017-05-04 22:50 - 00000000 ____D C:\Program Files\RogueKiller
2017-05-04 22:41 - 2017-05-04 22:42 - 35354672 _____ (Adlice Software ) C:\Users\Don\Desktop\setup.exe
2017-05-04 21:55 - 2017-05-04 21:55 - 00112907 _____ C:\Users\Don\Desktop\ZHPDiag.txt
2017-05-04 21:49 - 2017-05-04 23:36 - 00000000 ____D C:\Users\Don\AppData\Local\ZHP
2017-05-04 21:49 - 2017-05-04 21:49 - 02722304 _____ C:\Users\Don\Desktop\ZHPDiag3.exe
2017-05-04 16:46 - 2017-05-04 16:46 - 00000000 ____D C:\Program Files\ESET
2017-05-04 16:45 - 2017-05-03 22:18 - 120717952 _____ (ESET) C:\Users\Don\Desktop\eis_nt64_are.exe
2017-05-04 03:49 - 2017-05-04 03:50 - 34564331 _____ C:\Users\Don\Desktop\LFERDA - Panachi [Clip Officiel] - YouTube.MP4
2017-05-04 03:38 - 2017-05-04 03:39 - 42903445 _____ C:\Users\Don\Desktop\LFERDA - Occupé [Clip Officiel] - YouTube.MP4
2017-05-03 23:20 - 2017-05-03 23:20 - 05112774 _____ C:\Users\Don\Desktop\Lferda - ERROR 404 (Officiel Audio) - YouTube.MP4
2017-05-03 23:09 - 2017-05-03 23:11 - 51458271 _____ C:\Users\Don\Desktop\7-toun & Spoo pow - WEST-DLAM - Lyrics - YouTube.MP4
2017-05-03 21:47 - 2017-05-05 16:08 - 00000000 ____D C:\Users\Don\AppData\Roaming\IDM
2017-05-03 21:47 - 2017-05-03 21:47 - 00001013 _____ C:\Users\Don\Desktop\Internet Download Manager.lnk
2017-05-03 21:47 - 2017-05-03 21:47 - 00000000 ____D C:\Users\Don\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Download Manager
2017-05-03 21:47 - 2017-05-03 21:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Download Manager
2017-05-03 21:47 - 2017-05-03 21:47 - 00000000 ____D C:\Program Files (x86)\Internet Download Manager
2017-05-03 21:46 - 2017-05-03 21:46 - 00001163 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-05-03 21:46 - 2017-05-03 21:46 - 00001151 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2017-05-03 21:46 - 2017-05-03 21:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-05-03 21:46 - 2017-05-03 21:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-05-03 21:42 - 2017-05-03 21:42 - 00002271 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-05-03 21:42 - 2017-05-03 21:42 - 00002259 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-05-03 21:39 - 2017-05-03 21:42 - 00000000 ____D C:\Program Files (x86)\Google
2017-05-03 21:39 - 2017-05-03 21:39 - 00003330 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2017-05-03 21:39 - 2017-05-03 21:39 - 00003202 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2017-05-03 21:05 - 2017-05-03 21:09 - 00000000 ____D C:\AdwCleaner
2017-05-03 17:42 - 2017-05-03 17:42 - 07164088 _____ (Tonec Inc.) C:\Users\Don\Desktop\idman628build9.exe
2017-05-03 14:48 - 2017-05-03 14:48 - 00000000 ___RD C:\Users\Don\OneDrive
2017-05-03 14:47 - 2017-05-03 14:47 - 00000000 ____D C:\ProgramData\Microsoft OneDrive
2017-05-03 14:47 - 2015-07-18 13:08 - 00984448 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00901264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ucrtbase.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00066400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-private-l1-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00063840 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00022368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-math-l1-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00020832 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00019808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00019808 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00017760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-string-l1-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00017760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00016224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00016224 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00015712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00015712 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00014176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-time-l1-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00014176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00013664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00013664 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-eventing-provider-l1-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l2-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-eventing-provider-l1-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2017-05-03 14:47 - 2015-07-18 13:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
2017-05-03 14:35 - 2017-05-03 14:35 - 00000000 ____D C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform
2017-05-03 14:27 - 2017-05-03 14:27 - 00000000 ____D C:\Users\Don\AppData\Roaming\PowerISO
2017-05-03 14:26 - 2017-05-03 14:26 - 00000812 _____ C:\Users\Public\Desktop\PowerISO.lnk
2017-05-03 14:26 - 2017-05-03 14:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerISO
2017-05-03 14:26 - 2017-05-03 14:26 - 00000000 ____D C:\Program Files\PowerISO
2017-05-03 14:26 - 2016-10-02 00:50 - 00137280 _____ (Power Software Ltd) C:\Windows\system32\Drivers\scdemu.sys
2017-05-03 12:26 - 2017-05-03 12:26 - 01146880 _____ (HeiDoc.net) C:\Users\Don\Downloads\Windows ISO Downloader.exe
2017-05-02 21:59 - 2017-05-05 06:41 - 00008192 _____ C:\Users\Don\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2017-05-02 21:59 - 2017-05-02 21:59 - 00000000 ____D C:\Users\Don\AppData\Roaming\GeoVid
2017-05-02 21:57 - 2017-05-02 21:57 - 00001083 _____ C:\Users\Don\Desktop\Video Avatar.lnk
2017-05-02 21:57 - 2017-05-02 21:57 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Video Avatar
2017-05-02 21:57 - 2017-05-02 21:57 - 00000000 ____D C:\ProgramData\GeoVid
2017-05-02 21:57 - 2017-05-02 21:57 - 00000000 ____D C:\Program Files (x86)\GeoVid
2017-05-02 21:57 - 2007-06-28 18:55 - 00077824 _____ C:\Windows\SysWOW64\xvid.ax
2017-05-02 21:57 - 2005-06-07 15:11 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dsetup.dll
2017-05-02 21:57 - 2003-03-19 08:19 - 01060864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc71.dll
2017-05-02 21:57 - 2003-03-19 08:12 - 01047552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc71u.dll
2017-05-02 21:57 - 2003-03-19 06:05 - 00089088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\atl71.dll
2017-05-02 17:03 - 2016-10-17 15:35 - 00223464 _____ (Tonec Inc.) C:\Windows\system32\Drivers\idmwfp.sys
2017-05-02 16:50 - 2017-05-02 17:14 - 00000000 ____D C:\Users\Don\AppData\Local\Sony
2017-05-02 16:50 - 2017-05-02 16:50 - 00000000 ____D C:\Windows\SysWOW64\spool
2017-05-02 16:48 - 2017-05-02 17:15 - 00000000 ____D C:\Users\Don\AppData\Roaming\Sony
2017-05-02 03:59 - 2017-05-03 20:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2017-05-02 02:25 - 2017-05-02 02:25 - 00000000 ____D C:\Users\Don\AppData\Roaming\mkvtoolnix
2017-05-02 02:24 - 2017-05-02 02:24 - 00001866 _____ C:\Users\Public\Desktop\mkvmerge GUI.lnk
2017-05-02 02:24 - 2017-05-02 02:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MKVToolNix
2017-05-02 02:24 - 2017-05-02 02:24 - 00000000 ____D C:\Program Files (x86)\MKVToolNix
2017-05-02 00:15 - 2017-05-02 00:15 - 00001352 _____ C:\Users\Don\Desktop\WinAVI All-in-One Converter.lnk
2017-05-02 00:15 - 2017-05-02 00:15 - 00000000 ____D C:\Users\Don\AppData\Roaming\WinAVI
2017-05-02 00:15 - 2017-05-02 00:15 - 00000000 ____D C:\Users\Don\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinAVI All-in-One Converter
2017-05-02 00:15 - 2017-05-02 00:15 - 00000000 ____D C:\Users\Don\AppData\Local\WinAVI
2017-05-02 00:15 - 2017-05-02 00:15 - 00000000 ____D C:\Program Files (x86)\WinAVI
2017-05-02 00:13 - 2017-05-03 21:08 - 00000000 ____D C:\Users\Don\AppData\Roaming\Lavasoft
2017-05-02 00:13 - 2017-05-03 21:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
2017-05-02 00:13 - 2017-05-02 00:13 - 00000000 ____D C:\Users\Don\AppData\Local\Lavasoft
2017-05-02 00:12 - 2017-05-05 15:56 - 00000000 ____D C:\Users\Don\AppData\Roaming\MPC-HC
2017-05-02 00:12 - 2017-05-03 21:08 - 00000000 ____D C:\ProgramData\Lavasoft
2017-05-02 00:11 - 2017-05-02 00:11 - 00003152 _____ C:\Windows\System32\Tasks\klcp_update
2017-05-02 00:11 - 2017-05-02 00:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack
2017-05-02 00:11 - 2016-05-08 10:27 - 03613696 _____ (x264vfw project) C:\Windows\SysWOW64\x264vfw.dll
2017-05-02 00:11 - 2016-05-08 10:19 - 03642880 _____ (x264vfw project) C:\Windows\system32\x264vfw64.dll
2017-05-02 00:11 - 2015-12-18 10:00 - 00755200 _____ C:\Windows\system32\xvidcore.dll
2017-05-02 00:11 - 2015-12-18 10:00 - 00674816 _____ C:\Windows\SysWOW64\xvidcore.dll
2017-05-02 00:11 - 2015-12-18 10:00 - 00309248 _____ C:\Windows\system32\xvidvfw.dll
2017-05-02 00:11 - 2015-12-18 10:00 - 00282112 _____ C:\Windows\SysWOW64\xvidvfw.dll
2017-05-02 00:11 - 2015-10-24 17:00 - 00126976 _____ C:\Windows\system32\ff_vfw.dll
2017-05-02 00:11 - 2015-10-24 17:00 - 00112128 _____ C:\Windows\SysWOW64\ff_vfw.dll
2017-05-02 00:11 - 2012-07-21 11:55 - 00180736 _____ (fccHandler) C:\Windows\system32\ac3acm.acm
2017-05-02 00:11 - 2012-07-21 11:54 - 00122880 _____ (fccHandler) C:\Windows\SysWOW64\ac3acm.acm
2017-05-02 00:11 - 2011-12-07 18:37 - 00148992 _____ ( ) C:\Windows\system32\lagarith.dll
2017-05-02 00:11 - 2011-12-07 18:32 - 00216064 _____ ( ) C:\Windows\SysWOW64\lagarith.dll
2017-05-02 00:10 - 2017-05-02 00:11 - 00000000 ____D C:\Program Files (x86)\K-Lite Codec Pack
2017-05-02 00:10 - 2017-04-30 20:41 - 43807219 _____ (KLCP ) C:\Users\Don\Desktop\k-lite-mega-codec-pack-12-9-0.exe
2017-05-01 18:00 - 2017-05-01 18:00 - 00000000 ____D C:\Users\Don\AppData\Local\FreemakeVideoDownloader
2017-05-01 17:59 - 2017-05-01 17:59 - 00000000 ____D C:\Program Files\WinPcap
2017-05-01 13:07 - 2017-05-01 13:08 - 00000000 ____D C:\Users\Don\Downloads\New folder
2017-04-28 23:13 - 2017-04-28 23:13 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2017-04-28 17:58 - 2013-10-03 22:26 - 10907648 _____ C:\Users\Don\Desktop\Inpaint.exe
2017-04-27 16:37 - 2017-04-27 16:37 - 00001071 _____ C:\Users\Don\Desktop\Format Factory.lnk
2017-04-27 16:37 - 2017-04-27 16:37 - 00000000 ____D C:\Program Files (x86)\FormatFactory
2017-04-24 03:17 - 2017-05-03 23:02 - 00000000 ____D C:\Users\Don\Documents\Snagit Stamps
2017-04-23 21:42 - 2017-04-23 21:42 - 00000000 ____D C:\Users\Don\Documents\webkit
2017-04-23 21:21 - 2017-04-24 15:55 - 00000000 ____D C:\Users\Don\Documents\New folder
2017-04-07 22:35 - 2017-04-07 22:35 - 00000000 ____D C:\Users\Don\AppData\Roaming\Shadow Defender
2017-04-06 19:55 - 2017-04-06 19:55 - 00000000 ____D C:\Users\Don\.Virtualbox
2017-04-06 19:54 - 2017-04-06 19:54 - 00000600 _____ C:\Users\Public\Desktop\YouWave Android.lnk
2017-04-06 19:54 - 2017-04-06 19:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouWave Android
2017-04-06 17:49 - 2017-04-06 19:15 - 00000000 _____ C:\Windows\diskpt.dat
2017-04-06 17:49 - 2017-04-06 17:49 - 00000000 _____ C:\Windows\diskptex.dat
2017-04-06 17:48 - 2017-04-06 17:48 - 00001018 _____ C:\Users\Public\Desktop\Shadow Defender.lnk
2017-04-06 17:48 - 2017-04-06 17:48 - 00000064 _____ C:\Windows\diskpt.crt
2017-04-06 17:48 - 2017-04-06 17:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Shadow Defender
2017-04-06 17:48 - 2017-04-06 17:48 - 00000000 ____D C:\Program Files\Shadow Defender
2017-04-06 17:48 - 2016-07-23 02:02 - 00420592 _____ (SHADOWDEFENDER.COM) C:\Windows\system32\Drivers\diskpt.sys

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-05-05 16:28 - 2017-02-15 17:12 - 00000000 ____D C:\Users\Don\AppData\LocalLow\Mozilla
2017-05-05 16:26 - 2017-02-15 23:30 - 00000000 ____D C:\Users\Don\AppData\Roaming\DMCache
2017-05-05 16:06 - 2017-02-15 19:13 - 00000000 ____D C:\Users\Don\AppData\Roaming\vlc
2017-05-05 15:56 - 2017-02-15 19:15 - 00000000 ____D C:\Users\Don\AppData\Roaming\uTorrent
2017-05-05 14:32 - 2009-07-14 04:45 - 00022944 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-05-05 14:32 - 2009-07-14 04:45 - 00022944 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-05-05 14:23 - 2017-04-01 21:38 - 00000000 ____D C:\ProgramData\VMware
2017-05-05 14:22 - 2009-07-14 05:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-05-05 00:01 - 2017-02-21 01:47 - 00000000 ____D C:\Users\Don\AppData\Local\CrashDumps
2017-05-05 00:01 - 2009-07-14 03:20 - 00000000 ____D C:\Windows\inf
2017-05-04 23:51 - 2017-02-21 14:46 - 00000000 ____D C:\Users\Don\AppData\Roaming\ZHP
2017-05-04 20:03 - 2017-02-15 19:06 - 00000000 ____D C:\ProgramData\TEMP
2017-05-04 16:51 - 2017-02-20 20:09 - 00000000 ____D C:\Users\Don\AppData\Local\ESET
2017-05-04 01:24 - 2011-02-07 13:35 - 00739590 _____ C:\Windows\system32\perfh00C.dat
2017-05-04 01:24 - 2011-02-07 13:35 - 00481018 _____ C:\Windows\system32\perfh001.dat
2017-05-04 01:24 - 2011-02-07 13:35 - 00150044 _____ C:\Windows\system32\perfc00C.dat
2017-05-04 01:24 - 2011-02-07 13:35 - 00095362 _____ C:\Windows\system32\perfc001.dat
2017-05-04 01:24 - 2009-07-14 05:13 - 02241668 _____ C:\Windows\system32\PerfStringBackup.INI
2017-05-03 22:22 - 2017-02-15 17:04 - 00196208 _____ C:\Users\Don\AppData\Local\GDIPFONTCACHEV1.DAT
2017-05-03 21:35 - 2009-07-14 04:45 - 00609496 _____ C:\Windows\system32\FNTCACHE.DAT
2017-05-03 21:29 - 2017-02-20 20:00 - 00000000 ____D C:\Users\Don\AppData\Roaming\Yandex
2017-05-03 21:22 - 2009-07-14 03:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2017-05-03 21:20 - 2017-02-16 18:54 - 00000000 ____D C:\ProgramData\Freemake
2017-05-03 14:48 - 2017-02-15 16:58 - 00000000 ____D C:\Users\Don
2017-05-02 03:48 - 2017-04-04 22:11 - 00000000 ____D C:\Users\Don\Desktop\dcc
2017-05-01 18:00 - 2017-02-16 18:54 - 00000000 ____D C:\Users\Don\Documents\Freemake
2017-05-01 12:46 - 2017-02-15 23:43 - 00000000 ____D C:\Users\Don\AppData\Roaming\Skype
2017-05-01 02:46 - 2017-04-01 21:45 - 00000000 ____D C:\Users\Don\AppData\Roaming\VMware
2017-05-01 02:46 - 2017-04-01 21:45 - 00000000 ____D C:\Users\Don\AppData\Local\VMware
2017-04-25 19:53 - 2010-11-21 07:16 - 00000000 ____D C:\Windows\ShellNew
2017-04-13 15:45 - 2017-02-16 00:17 - 00000000 ____D C:\Users\Don\AppData\Local\Adobe
2017-04-13 15:30 - 2017-02-16 00:18 - 00802904 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-04-13 15:30 - 2017-02-16 00:18 - 00144472 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-04-13 15:30 - 2017-02-16 00:18 - 00004442 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier
2017-04-13 15:30 - 2017-02-16 00:18 - 00004312 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2017-04-13 15:30 - 2017-02-16 00:18 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2017-04-13 15:30 - 2017-02-16 00:18 - 00000000 ____D C:\Windows\system32\Macromed
2017-04-06 20:45 - 2017-04-02 19:19 - 00000000 ____D C:\ProgramData\DatacardService

==================== Files in the root of some directories =======

2017-05-02 21:59 - 2017-05-05 06:41 - 0008192 _____ () C:\Users\Don\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

Some files in TEMP:
====================
2017-05-04 22:50 - 2010-11-21 03:23 - 1731936 _____ (Microsoft Corporation) C:\Users\Don\AppData\Local\Temp\dllnt_dump.dll

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-05-04 19:52

==================== End of FRST.txt ============================