Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 08-05-2017
Ran by C Brindamour (administrator) on CBRINDAMOUR-PC (10-05-2017 13:59:40)
Running from E:\
Loaded Profiles: C Brindamour (Available Profiles: C Brindamour)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: Anglais (États-Unis)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(ALCPU) C:\Program Files\Core Temp\Core Temp.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(CHENGDU YIWO Tech Development Co., Ltd) C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe
(Druide informatique inc.) C:\Program Files (x86)\Druide\Antidote 9\Application\Bin32\AgentAntidote.exe
(Druide informatique inc.) C:\Program Files (x86)\Druide\Antidote 9\Application\Bin64\AgentAntidote.exe
() C:\Program Files\Everything\Everything.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
() C:\Windows\SysWOW64\DeltaIITray.exe
(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winampa.exe
() C:\Program Files (x86)\EaseUS\Todo Backup\bin\TodoBackupService.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Microsoft Corporation) C:\Windows\System32\vds.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_x64.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\LogiAppBroker.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2776528 2016-12-14] (Malwarebytes)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1353680 2016-11-14] (Microsoft Corporation)
HKLM\...\Run: [AgentAntidote32] => C:\Program Files (x86)\Druide\Antidote 9\Application\Bin32\AgentAntidote.exe [1644136 2017-03-10] (Druide informatique inc.)
HKLM\...\Run: [AgentAntidote64] => C:\Program Files (x86)\Druide\Antidote 9\Application\Bin64\AgentAntidote.exe [1786472 2017-03-10] (Druide informatique inc.)
HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [3113592 2015-08-25] (Logitech, Inc.)
HKLM-x32\...\Run: [M-Audio Taskbar Icon] => C:\Windows\SysWOW64\DeltaIITray.exe [237872 2012-01-25] ()
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\S-1-5-21-3143673030-1198614311-2239899035-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9292504 2016-12-21] (Piriform Ltd)
HKU\S-1-5-21-3143673030-1198614311-2239899035-1000\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [23819304 2017-03-21] (Google)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2017-01-22] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [  GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
GroupPolicy\User: Restriction - Chrome <======= ATTENTION
CHR HKU\S-1-5-21-3143673030-1198614311-2239899035-1000\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: Hosts file not detected in the default directory
Tcpip\Parameters: [DhcpNameServer] 8.8.8.8 8.8.4.4
Tcpip\Parameters: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{057B9A7B-561D-4ACD-8D2C-05A306779140}: [DhcpNameServer] 8.8.8.8 8.8.4.4
Tcpip\..\Interfaces\{1E68AC20-88BA-40AC-9035-8D014CC9F03F}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{F03328D1-8D42-4795-9908-1531D75BC836}: [DhcpNameServer] 8.8.8.8

Internet Explorer:
==================
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office16\OCHelper.dll [2015-07-31] (Microsoft Corporation)
BHO: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll [2015-08-25] (Logitech, Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office16\URLREDIR.DLL [2015-07-31] (Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office16\GROOVEEX.DLL [2015-07-31] (Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office16\OCHelper.dll [2015-07-31] (Microsoft Corporation)
BHO-x32: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll [2015-08-25] (Logitech, Inc.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office16\URLREDIR.DLL [2015-07-31] (Microsoft Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office16\GROOVEEX.DLL [2015-07-31] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2015-07-31] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2015-07-31] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\C Brindamour\AppData\Roaming\Mozilla\Firefox\Profiles\ut7sqc58.default-1489610351132 [2017-05-10]
FF NewTab: Mozilla\Firefox\Profiles\ut7sqc58.default-1489610351132 -> C:\\ProgramData\\Subairs\\ff.NT
FF Homepage: Mozilla\Firefox\Profiles\ut7sqc58.default-1489610351132 -> google.ca
FF Extension: (LastPass) - C:\Users\C Brindamour\AppData\Roaming\Mozilla\Firefox\Profiles\ut7sqc58.default-1489610351132\Extensions\support@lastpass.com [2017-05-10]
FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF Extension: (Logitech SetPoint) - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2017-03-27] [not signed]
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-07-31] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [No File]
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [No File]
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-04-04] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2015-07-31] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll [2011-12-09] (Nullsoft, Inc.)

Chrome: 
=======
CHR HomePage: Default -> hxxp://google.ca/
CHR StartupUrls: Default -> "hxxps://monportail.ulaval.ca/accueil/","hxxp://google.ca/"
CHR DefaultSearchKeyword: Default -> lp
CHR Profile: C:\Users\C Brindamour\AppData\Local\Google\Chrome\User Data\Default [2017-05-10]
CHR Extension: (Créateur QR Code) - C:\Users\C Brindamour\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaephdgbinagkeepamlbkhkfbiaedabm [2017-01-30]
CHR Extension: (Google Slides) - C:\Users\C Brindamour\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-01-28]
CHR Extension: (Google Docs) - C:\Users\C Brindamour\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-01-28]
CHR Extension: (Google Drive) - C:\Users\C Brindamour\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-01-28]
CHR Extension: (MEGA) - C:\Users\C Brindamour\AppData\Local\Google\Chrome\User Data\Default\Extensions\bigefpfhnfcobdlfbedofhhaibnlghod [2017-05-02]
CHR Extension: (YouTube) - C:\Users\C Brindamour\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-01-28]
CHR Extension: (Honey) - C:\Users\C Brindamour\AppData\Local\Google\Chrome\User Data\Default\Extensions\bmnlcjabgnpnenekpadlanbbkooimhnj [2017-05-09]
CHR Extension: (Logitech Smooth Scrolling) - C:\Users\C Brindamour\AppData\Local\Google\Chrome\User Data\Default\Extensions\dkpejdfnpdkhifgbancbammdijojoffk [2017-01-30]
CHR Extension: (SimpleClear) - C:\Users\C Brindamour\AppData\Local\Google\Chrome\User Data\Default\Extensions\dpbboilcojikdnfpponljmiohnhdjcaj [2017-03-27]
CHR Extension: (Dropbox pour Gmail) - C:\Users\C Brindamour\AppData\Local\Google\Chrome\User Data\Default\Extensions\dpdmhfocilnekecfjgimjdeckachfbec [2017-03-10]
CHR Extension: (Adobe Acrobat) - C:\Users\C Brindamour\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2017-03-10]
CHR Extension: (Gmail hors connexion) - C:\Users\C Brindamour\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejidjjhkpiempkbhmpbfngldlkglhimk [2017-01-30]
CHR Extension: (Mixcloud) - C:\Users\C Brindamour\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdcenekolminfbkcbchinlcgfhpmggpk [2017-01-30]
CHR Extension: (Google Sheets) - C:\Users\C Brindamour\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-01-28]
CHR Extension: (IBA Opt-out (by Google)) - C:\Users\C Brindamour\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbiekjoijknlhijdjbaadobpkdhmoebb [2017-01-30]
CHR Extension: (Google Docs hors connexion) - C:\Users\C Brindamour\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-01-28]
CHR Extension: (Click&Clean) - C:\Users\C Brindamour\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgabhipcejejjmhhchfonmamedcbeod [2017-05-01]
CHR Extension: (AdBlock) - C:\Users\C Brindamour\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2017-04-15]
CHR Extension: (Inbox by Gmail) - C:\Users\C Brindamour\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkljgfmjocfalijkgoogmfffkhmkbgol [2017-01-30]
CHR Extension: (converter) - C:\Users\C Brindamour\AppData\Local\Google\Chrome\User Data\Default\Extensions\gncebhdkjgopkmaklokjadihihfakeoi [2017-01-30]
CHR Extension: (LastPass: Free Password Manager) - C:\Users\C Brindamour\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd [2017-04-04]
CHR Extension: (Google Hangouts) - C:\Users\C Brindamour\AppData\Local\Google\Chrome\User Data\Default\Extensions\knipolnnllmklapflnccelgolnpehhpl [2017-05-05]
CHR Extension: (Antidote) - C:\Users\C Brindamour\AppData\Local\Google\Chrome\User Data\Default\Extensions\lbojggafdepnclikhiapkpinbfdhbdoi [2017-05-02]
CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\C Brindamour\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2017-01-30]
CHR Extension: (Boomerang for Gmail) - C:\Users\C Brindamour\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdanidgdpmkimeiiojknlnekblgmpdll [2017-04-04]
CHR Extension: (Ghostery) - C:\Users\C Brindamour\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlomiejdfkolichcflejclcbmpeaniij [2017-05-01]
CHR Extension: (Kindle Cloud Reader) - C:\Users\C Brindamour\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfcidnhfgllloclgemladhopcimnmokl [2017-01-30]
CHR Extension: (Paiements via le Chrome Web Store) - C:\Users\C Brindamour\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-10]
CHR Extension: (vTabs) - C:\Users\C Brindamour\AppData\Local\Google\Chrome\User Data\Default\Extensions\okpnlgbgcfchbicbhjmmhldhkbkfilce [2017-01-30]
CHR Extension: (Gmail) - C:\Users\C Brindamour\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-01-28]
CHR Extension: (Chrome Media Router) - C:\Users\C Brindamour\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-05-01]
CHR HKLM\...\Chrome\Extension: [lbojggafdepnclikhiapkpinbfdhbdoi] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-3143673030-1198614311-2239899035-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-3143673030-1198614311-2239899035-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lbojggafdepnclikhiapkpinbfdhbdoi] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S4 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2017-01-26] (Adobe Systems) [File not signed]
R2 EaseUS Agent; C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe [39616 2016-12-06] (CHENGDU YIWO Tech Development Co., Ltd)
R2 Everything; C:\Program Files\Everything\Everything.exe [1441792 2014-08-05] () [File not signed]
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4317648 2016-12-14] (Malwarebytes)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [119864 2016-11-14] (Microsoft Corporation)
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [361816 2016-11-14] (Microsoft Corporation)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [10888944 2017-04-25] (TeamViewer GmbH)
S3 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [36504 2017-01-22] (VIA Technologies, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 AdBlockerService; C:\Program Files (x86)\AdBlocker\AdBlockerService.exe [X]
S2 CORE Software Updater; no ImagePath <==== ATTENTION

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [77440 2017-04-25] ()
R0 EUBKMON; C:\Windows\System32\drivers\EUBKMON.sys [53240 2016-12-06] ()
R1 HWiNFO32; C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [27552 2017-01-22] (REALiX(tm))
R1 MBAMChameleon; C:\Windows\system32\drivers\MBAMChameleon.sys [176064 2017-01-23] (Malwarebytes)
S3 MBAMFarflt; C:\Windows\system32\drivers\farflt.sys [102856 2017-01-31] (Malwarebytes)
S3 MBAMProtection; C:\Windows\system32\drivers\mbam.sys [43968 2017-01-31] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [251832 2017-05-10] (Malwarebytes)
S3 MBAMWebProtection; C:\Windows\system32\drivers\mwac.sys [81696 2017-01-31] (Malwarebytes)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [295000 2016-08-25] (Microsoft Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2017-01-22] ()
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [135928 2016-08-25] (Microsoft Corporation)
R3 ALSysIO; \??\C:\Users\CBRIND~1\AppData\Local\Temp\ALSysIO64.sys [X] <==== ATTENTION
U0 aswVmm; no ImagePath
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-05-10 13:59 - 2017-05-10 13:59 - 00000000 ____D C:\FRST
2017-05-10 13:26 - 2017-05-10 13:26 - 00001170 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-05-10 13:26 - 2017-05-10 13:26 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-05-10 12:38 - 2017-05-10 12:38 - 00000005 _____ C:\Users\C Brindamour\AppData\Roaming\appud
2017-05-10 12:35 - 2017-05-10 12:35 - 00000035 _____ C:\Users\C Brindamour\AppData\Roaming\loc
2017-05-10 12:25 - 2017-05-10 12:25 - 00140800 _____ C:\Users\C Brindamour\AppData\Local\installer.dat
2017-05-10 12:25 - 2017-05-10 12:25 - 00011568 _____ C:\Users\C Brindamour\AppData\Local\InstallationConfiguration.xml
2017-05-10 12:09 - 2017-05-10 12:24 - 00000162 _____ C:\Windows\SysWOW64\lastupd.dat
2017-05-10 12:09 - 2017-05-10 12:09 - 07735428 _____ C:\Windows\youtube-dl.exe
2017-05-10 12:08 - 2017-05-10 12:23 - 00000000 ____D C:\Windows\SysWOW64\tmp
2017-05-10 12:08 - 2017-05-10 12:08 - 00000000 ____D C:\ProgramData\shimgen
2017-05-10 12:08 - 2017-04-24 15:46 - 02679858 _____ C:\Windows\SysWOW64\msblsn.exe
2017-05-10 12:07 - 2017-05-10 12:49 - 00000000 ____D C:\ProgramData\Microleaves
2017-05-10 12:06 - 2017-05-10 12:51 - 00000000 ____D C:\ProgramData\Subair
2017-05-10 12:06 - 2017-05-10 12:08 - 00000000 ____D C:\ProgramData\chocolatey
2017-05-10 12:06 - 2017-05-10 12:07 - 00015610 _____ C:\Windows\SysWOW64\findit.xml
2017-05-10 12:06 - 2017-05-10 12:06 - 00000000 ____D C:\Users\C Brindamour\AppData\Roaming\NuGet
2017-05-10 12:06 - 2017-05-10 12:06 - 00000000 ____D C:\ProgramData\PrefsSecure
2017-05-10 12:06 - 2017-05-10 12:06 - 00000000 ____D C:\ProgramData\Logic Cramble
2017-05-10 12:06 - 2017-02-20 20:38 - 41569792 _____ C:\Windows\ffmpeg.exe
2017-05-10 12:06 - 2017-02-20 20:38 - 00000003 _____ C:\Windows\SysWOW64\delay.dat
2017-05-10 12:05 - 2017-05-10 12:54 - 00000000 ____D C:\Program Files (x86)\PcRegBoost
2017-05-10 12:04 - 2017-05-10 12:53 - 00000342 _____ C:\Windows\Tasks\Online Application V2G1.job
2017-05-10 12:04 - 2017-05-10 12:52 - 00000342 _____ C:\Windows\Tasks\Online Application V2G2.job
2017-05-10 12:04 - 2017-05-10 12:49 - 00000000 ____D C:\Users\C Brindamour\AppData\Roaming\Microleaves
2017-05-10 12:04 - 2017-05-10 12:47 - 00000342 _____ C:\Windows\Tasks\Online Application V2G3.job
2017-05-10 12:04 - 2017-05-10 12:07 - 00000374 _____ C:\Windows\Tasks\Updater_Online_Application.job
2017-05-10 12:04 - 2017-05-10 12:04 - 00004042 _____ C:\Windows\System32\Tasks\{6A62082A-DDC9-BF81-1398-0C144AB7525F}
2017-05-10 12:04 - 2017-05-10 12:04 - 00003742 _____ C:\Windows\System32\Tasks\{A668F157-6833-536B-F6FA-C418BE177D11}
2017-05-10 12:04 - 2017-05-10 12:04 - 00003206 _____ C:\Windows\System32\Tasks\Updater_Online_Application
2017-05-10 12:04 - 2017-05-10 12:04 - 00003170 _____ C:\Windows\System32\Tasks\Online Application V2G3
2017-05-10 12:04 - 2017-05-10 12:04 - 00003170 _____ C:\Windows\System32\Tasks\Online Application V2G2
2017-05-10 12:04 - 2017-05-10 12:04 - 00003170 _____ C:\Windows\System32\Tasks\Online Application V2G1
2017-05-10 12:04 - 2017-05-10 12:04 - 00001996 _____ C:\Windows\System32\Tasks\VXVYWhBSVc
2017-05-10 12:04 - 2017-05-10 12:04 - 00000000 ____D C:\ProgramData\9729f04a
2017-05-10 12:04 - 2017-05-10 12:04 - 00000000 ____D C:\ProgramData\{FCF46683-4B5F-D128-384B-2BC8BB6DA958}
2017-05-10 12:04 - 2017-05-10 12:04 - 00000000 ____D C:\Program Files (x86)\Microleaves
2017-05-10 12:03 - 2017-05-10 12:05 - 00000002 _____ C:\END
2017-05-10 12:03 - 2017-05-10 12:03 - 00003582 _____ C:\Windows\System32\Tasks\One System Care Task
2017-05-10 12:02 - 2017-05-10 12:02 - 00016732 _____ C:\Windows\System32\Tasks\Loop Photo Recovery
2017-05-10 12:02 - 2017-05-10 12:02 - 00003018 _____ C:\Windows\System32\Tasks\RunAtStartup
2017-05-10 12:02 - 2017-05-10 12:02 - 00000000 ____D C:\Users\C Brindamour\AppData\Roaming\Event Monitor
2017-05-02 12:12 - 2017-05-02 12:12 - 00000000 ___RD C:\Users\C Brindamour\AppData\Roaming\Brother
2017-05-02 12:12 - 2017-05-02 12:12 - 00000000 ____D C:\Users\C Brindamour\AppData\LocalLow\Brother
2017-05-01 19:00 - 2017-05-01 19:00 - 00000000 ____D C:\Users\C Brindamour\AppData\Roaming\Google
2017-05-01 18:59 - 2017-05-01 18:59 - 00000000 ____D C:\ProgramData\Logitech

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-05-10 13:50 - 2017-01-21 21:04 - 00000000 ____D C:\Users\C Brindamour
2017-05-10 13:36 - 2017-03-15 15:22 - 00000000 ____D C:\Users\C Brindamour\AppData\LocalLow\LastPass
2017-05-10 13:36 - 2017-01-28 16:13 - 00000000 ____D C:\Users\C Brindamour\AppData\LocalLow\Mozilla
2017-05-10 13:31 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\inf
2017-05-10 13:26 - 2017-01-28 16:12 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-05-10 13:13 - 2017-01-22 23:27 - 00002287 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-05-10 13:02 - 2009-07-14 00:45 - 00016944 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-05-10 13:02 - 2009-07-14 00:45 - 00016944 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-05-10 13:00 - 2017-01-21 21:11 - 00745036 _____ C:\Windows\system32\perfh00C.dat
2017-05-10 13:00 - 2017-01-21 21:11 - 00148960 _____ C:\Windows\system32\perfc00C.dat
2017-05-10 13:00 - 2009-07-14 01:13 - 01667292 _____ C:\Windows\system32\PerfStringBackup.INI
2017-05-10 12:59 - 2017-01-22 23:33 - 00002912 _____ C:\Windows\System32\Tasks\Driver Booster SkipUAC (C Brindamour)
2017-05-10 12:56 - 2017-01-23 01:55 - 00251832 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-05-10 12:55 - 2017-01-30 00:12 - 00000000 ___RD C:\Users\C Brindamour\Google Drive
2017-05-10 12:54 - 2009-07-14 01:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-05-10 12:06 - 2017-01-22 23:26 - 00000000 ____D C:\Program Files (x86)\Google
2017-05-10 12:02 - 2017-03-10 09:46 - 00000000 ____D C:\Program Files\Microsoft Security Client
2017-05-10 12:02 - 2017-01-22 23:41 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2017-05-09 18:01 - 2017-01-28 16:08 - 00000000 ____D C:\ProgramData\TEMP
2017-05-09 16:47 - 2017-01-23 04:02 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Core Temp
2017-05-09 16:47 - 2017-01-23 04:02 - 00000000 ____D C:\Program Files\Core Temp
2017-05-09 16:45 - 2017-03-27 13:53 - 00018960 _____ (Logitech, Inc.) C:\Windows\system32\Drivers\LNonPnP.sys
2017-05-06 10:06 - 2017-04-04 16:41 - 00007891 _____ C:\Windows\BRRBCOM.INI
2017-05-05 13:15 - 2017-01-23 02:30 - 00000978 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 12.lnk
2017-05-05 13:15 - 2017-01-23 02:30 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2017-05-05 12:32 - 2017-01-23 13:33 - 00004476 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2017-05-02 12:13 - 2017-03-15 14:36 - 00000000 ____D C:\Users\C Brindamour\AppData\Local\ElevatedDiagnostics
2017-05-02 09:06 - 2017-03-12 21:30 - 00000000 ____D C:\Users\C Brindamour\AppData\Roaming\Winamp
2017-05-01 19:08 - 2017-01-22 23:26 - 00003500 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2017-05-01 19:08 - 2017-01-22 23:26 - 00003372 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2017-04-25 19:46 - 2017-01-23 01:54 - 00077440 _____ C:\Windows\system32\Drivers\mbae64.sys
2017-04-13 18:08 - 2017-01-23 13:32 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk

==================== Files in the root of some directories =======

2017-05-10 12:38 - 2017-05-10 12:38 - 0000005 _____ () C:\Users\C Brindamour\AppData\Roaming\appud
2017-05-10 12:35 - 2017-05-10 12:35 - 0000035 _____ () C:\Users\C Brindamour\AppData\Roaming\loc
2017-05-10 12:25 - 2017-05-10 12:25 - 0011568 _____ () C:\Users\C Brindamour\AppData\Local\InstallationConfiguration.xml
2017-05-10 12:25 - 2017-05-10 12:25 - 0140800 _____ () C:\Users\C Brindamour\AppData\Local\installer.dat

Some files in TEMP:
====================
2017-05-10 12:02 - 2017-05-10 12:02 - 1042800 _____ (Star Line                                                   ) C:\Users\C Brindamour\AppData\Local\Temp\AdBlocker.exe
2017-05-10 12:02 - 2017-05-10 12:02 - 29130696 _____ () C:\Users\C Brindamour\AppData\Local\Temp\AppTrailers.9.1.10amt.exe
2017-05-10 07:05 - 2017-05-10 07:05 - 3190104 _____ (Lead IT) C:\Users\C Brindamour\AppData\Local\Temp\EpUx1lzm-prog.exe
2017-05-10 12:01 - 2017-05-10 12:01 - 1465952 _____ () C:\Users\C Brindamour\AppData\Local\Temp\Intst_install.exe
2017-05-10 12:02 - 2017-05-10 12:02 - 0788464 _____ () C:\Users\C Brindamour\AppData\Local\Temp\mesafe.exe
2017-05-10 12:01 - 2017-05-10 12:02 - 0411945 _____ () C:\Users\C Brindamour\AppData\Local\Temp\NuvisionDataRemarketer2.exe
2017-05-10 12:03 - 2017-05-10 12:04 - 55578064 _____ (iNextITNetwork                                              ) C:\Users\C Brindamour\AppData\Local\Temp\pcregboost.exe
2017-05-10 12:01 - 2017-05-10 12:01 - 0491511 _____ () C:\Users\C Brindamour\AppData\Local\Temp\Setup.exe
2017-05-10 12:02 - 2017-05-10 12:02 - 1199825 _____ () C:\Users\C Brindamour\AppData\Local\Temp\unins000.exe
2017-05-10 12:02 - 2017-05-10 12:02 - 0596541 _____ (VideoBox                                                    ) C:\Users\C Brindamour\AppData\Local\Temp\vbsetup.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-05-05 13:32

==================== End of FRST.txt ============================