Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 13-09-2017 Ran by Adrian (administrator) on ADRIAN-PC (13-09-2017 20:24:59) Running from C:\Users\Adrian\Desktop Loaded Profiles: Adrian (Available Profiles: Adrian & Guest) Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States) Internet Explorer Version 11 (Default browser: Chrome) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (Dell Inc.) C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE (Dell Inc.) C:\Program Files\Dell\DW WLAN Card\BCMWLTRY.EXE (SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe (Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Dell Inc.) C:\Program Files\Dell\DW WLAN Card\WLTRAY.EXE (Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe (Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe (SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Disc Soft Ltd) C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe (Oracle Corporation) C:\Program Files (x86)\Java\jre1.8.0_121\bin\jp2launcher.exe ==================== Registry (Whitelisted) ==================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6846096 2012-11-19] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1253520 2012-11-19] (Realtek Semiconductor) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2796272 2013-11-22] (Synaptics Incorporated) HKLM\...\Run: [Broadcom Wireless Manager UI] => C:\Program Files\Dell\DW WLAN Card\WLTRAY.exe [8921600 2014-07-23] (Dell Inc.) HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-30] (Intel Corporation) HKLM\...\Run: [QuickSet] => C:\Program Files\Dell\QuickSet\QuickSet.exe [5762408 2013-03-05] (Dell Inc.) HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292088 2013-02-23] (Intel Corporation) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-12-12] (Oracle Corporation) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\ScCertProp: wlnotify.dll [X] HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8551848 2015-10-19] (Piriform Ltd) HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\Run: [DAEMON Tools Lite Automount] => C:\Program Files\DAEMON Tools Lite\DTAgent.exe [4179288 2015-11-30] (Disc Soft Ltd) HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\Run: [HideMyIPSh] => "C:\Program Files (x86)\Hide My IP 6\HideMyIP.exe" /sh HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7963552 2017-07-12] (SUPERAntiSpyware) HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\Run: [TomTomHOME.exe] => "C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe" HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\Run: [MyDriveConnect.exe] => C:\Program Files (x86)\MyDrive Connect\TomTom MyDrive Connect.exe -startwithoutDA HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {4fe6a65d-9be5-11e5-b871-ecf4bb0c7e4f} - E:\autorun.exe HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {5c2ccd63-3cd8-11e4-be48-f82fa8dc94ee} - E:\AutoRun.exe HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {671b4005-fdf6-11e6-b49a-ecf4bb0c7e4f} - E:\Startme.exe HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {6ee1dae3-3cb5-11e4-a984-f82fa8dc94ee} - E:\AutoRun.exe HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {6ee1daf3-3cb5-11e4-a984-f82fa8dc94ee} - E:\AutoRun.exe HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {89376eda-793e-11e4-8c8b-f82fa8dc94ee} - E:\AutoRun.exe HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {9623956b-3b59-11e4-9af1-f82fa8dc94ee} - E:\AutoRun.exe HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {abf5f654-731c-11e4-8cb8-f82fa8dc94ee} - E:\unlock.exe autoplay=true HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {c17db7f3-ef63-11e4-9037-ecf4bb0c7e4f} - E:\autorun.exe HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {d4ae93aa-ae22-11e5-897c-ecf4bb0c7e4f} - F:\autorun.exe HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {e5909313-f7c6-11e4-aa6e-ecf4bb0c7e4f} - E:\Startme.exe HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {fafbe510-26ac-11e4-88ef-f82fa8dc94ee} - E:\LG_PC_Programs.exe Lsa: [Notification Packages] scecli C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll ShellExecuteHooks: No Name - {5F51FFFE-7463-4220-B711-E5B9ACB8EDFE} - C:\Users\Adrian\AppData\Roaming\tmp546.dat [1952256 2017-08-25] () Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2016-06-10] ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 Tcpip\..\Interfaces\{12AA26AC-4392-403A-9A14-02CD4B939AC0}: [DhcpNameServer] 192.168.2.1 Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = www.bing.com HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\Software\Microsoft\Internet Explorer\Main,Start Page = SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\ssv.dll [2017-03-14] (Oracle Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-03-14] (Oracle Corporation) StartMenuInternet: IEXPLORE.EXE - iexplore.exe FireFox: ======== FF ProfilePath: C:\Users\Adrian\AppData\Roaming\TomTom\HOME\Profiles\urd9ga9k.default [2017-06-01] FF ProfilePath: C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\xe3igf5m.default-1485454395780 [2017-09-13] FF Extension: (Save Images) - C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\xe3igf5m.default-1485454395780\Extensions\LDSI_plashcor@gmail.com.xpi [2017-09-06] FF Extension: (Video DownloadHelper) - C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\xe3igf5m.default-1485454395780\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2017-07-06] FF Extension: (Flash and Video Download) - C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\xe3igf5m.default-1485454395780\Extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a} [2017-09-06] FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_27_0_0_130.dll [2017-09-13] () FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll [2014-07-25] (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_27_0_0_130.dll [2017-09-13] () FF Plugin-x32: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-03-14] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-03-14] (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll [2014-07-25] (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN) FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN) FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN) FF Plugin-x32: @videolan.org/vlc,version=2.2.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-08-01] (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2016-12-23] (Adobe Systems Inc.) Chrome: ======= CHR Profile: C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default [2017-09-13] CHR Extension: (Skype) - C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2017-09-11] CHR Extension: (Paiements via le Chrome Web Store) - C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-09-11] CHR Extension: (Chrome Media Router) - C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-09-11] CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-10-12] Opera: ======= OPR Extension: (Adult Blocker) - C:\Users\Adrian\AppData\Roaming\Opera Software\Opera Stable\Extensions\neopaobcplailacdmjplehdnhhdacocl [2016-11-03] OPR Extension: (Adblock Plus) - C:\Users\Adrian\AppData\Roaming\Opera Software\Opera Stable\Extensions\oidhhegpmlfpoeialbgcdocjalghfpkp [2017-01-16] ==================== Services (Whitelisted) ==================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [173472 2017-01-31] (SUPERAntiSpyware.com) R3 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe [1368408 2015-11-30] (Disc Soft Ltd) R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-30] (Intel Corporation) S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation) R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201872 2012-11-23] (Realtek Semiconductor) R2 wltrysvc; C:\Program Files\Dell\DW WLAN Card\bcmwltry.exe [6170624 2014-07-23] (Dell Inc.) [File not signed] R2 wtmkussrv; C:\Windows\SysWow64\wtmkussrv.dll [473384 2016-03-18] () ===================== Drivers (Whitelisted) ====================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) S3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [31920 2014-04-09] (Wondershare) S3 atrfiltr; C:\Windows\System32\DRIVERS\atrfiltr.sys [16224 2014-09-11] (Windows (R) Win 7 DDK provider) S3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [170200 2014-07-23] (Broadcom Corporation.) S3 cxbu0x64; C:\Windows\System32\DRIVERS\cxbu0x64.sys [191224 2014-05-14] (HID Global Corporation) R3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [30264 2015-12-06] (Disc Soft Ltd) R3 dtliteusbbus; C:\Windows\System32\DRIVERS\dtliteusbbus.sys [46392 2015-12-06] (Disc Soft Ltd) R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [44744 2015-05-08] (AnchorFree Inc.) R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-08-30] (Intel Corporation) S3 jakstaVA; C:\Windows\System32\DRIVERS\jaksta_va.sys [103816 2014-12-09] (e2eSoft) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation) S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-06-18] (Malwarebytes Corporation) R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com) R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-13] (SUPERAdBlocker.com and SUPERAntiSpyware.com) S4 secdrv; C:\Windows\SysWow64\Drivers\secdrv.sys [11973 2016-12-28] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [File not signed] R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [31472 2013-11-22] (Synaptics Incorporated) R3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42064 2016-05-27] (Anchorfree Inc.) U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] () R1 wtmksyssrv; C:\Windows\system32\drivers\wtmhdnkernel.sys [226856 2016-03-18] () S3 EsgScanner; system32\DRIVERS\EsgScanner.sys [X] S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [X] S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X] S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X] S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X] S1 LanmaMaster; \??\C:\Windows\system32\drivers\lanmamaster.sys [X] <==== ATTENTION ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2017-09-13 20:24 - 2017-09-13 20:28 - 000017556 _____ C:\Users\Adrian\Desktop\FRST.txt 2017-09-13 20:24 - 2017-09-13 20:24 - 000000000 ____D C:\FRST 2017-09-13 20:23 - 2017-09-13 20:24 - 002397696 _____ (Farbar) C:\Users\Adrian\Desktop\FRST64.exe 2017-09-11 10:27 - 2017-09-11 10:27 - 000000000 ____D C:\Users\Adrian\Downloads\OMD 2017-09-10 13:31 - 2017-09-10 13:31 - 000000000 ____D C:\Users\Public\Documents\XMUpdate 2017-09-09 14:26 - 2017-09-09 14:26 - 000197017 _____ C:\Users\Adrian\Downloads\1991_Catfish_Rising.pdf 2017-09-09 13:16 - 2017-09-09 13:16 - 000000114 _____ C:\Users\Adrian\Documents\Boston.txt 2017-09-09 11:34 - 2017-09-09 11:35 - 000000000 ____D C:\Users\Adrian\Downloads\Stone Of A Bitch 2017-09-09 11:33 - 2017-09-11 13:43 - 000000000 ____D C:\Users\Adrian\Downloads\Daisy Driver 2017-09-09 11:32 - 2017-09-09 11:44 - 418696037 _____ C:\Users\Adrian\Downloads\OMD.zip 2017-09-09 11:22 - 2017-09-09 11:23 - 000000000 ____D C:\Users\Adrian\Downloads\Stömb 2017-09-09 10:59 - 2017-07-13 13:39 - 000000000 ____D C:\Users\Adrian\Downloads\L'Anima 2017-09-09 10:59 - 2016-03-31 17:39 - 000000000 ____D C:\Users\Adrian\Downloads\1988 - The tenement year [2007, Mercury, 9846251] 2017-09-09 10:55 - 2017-09-02 05:37 - 000000000 ____D C:\Users\Adrian\Downloads\Kaipa__Children_Of_The_Sounds 2017-09-09 10:26 - 2017-09-09 10:26 - 000004100 _____ C:\Users\Adrian\Desktop\AdwCleaner[S2].txt 2017-09-09 10:06 - 2017-09-09 10:06 - 008182736 _____ (Malwarebytes) C:\Users\Adrian\Downloads\adwcleaner_7.0.2.1.exe 2017-09-09 09:57 - 2017-09-09 09:57 - 000010902 _____ C:\Users\Adrian\Desktop\ZHPCleaner2.txt 2017-09-09 09:34 - 2017-09-09 09:43 - 000010902 _____ C:\Users\Adrian\Desktop\ZHPCleaner.txt 2017-09-08 09:16 - 2017-09-08 09:16 - 002869632 _____ C:\Users\Adrian\Downloads\zhpcleaner_2017.8.31.148.exe 2017-09-07 18:41 - 2017-09-07 18:41 - 000120381 _____ C:\Users\Adrian\Desktop\ZHPDiag.txt 2017-09-07 17:50 - 2017-09-07 17:50 - 002827136 _____ C:\Users\Adrian\Downloads\zhpdiag_2017.8.31.148 (1).exe 2017-09-07 14:06 - 2017-09-07 18:05 - 000000000 ____D C:\Users\Adrian\AppData\Local\ZHP 2017-09-07 14:03 - 2017-09-07 14:04 - 002875776 _____ C:\Users\Adrian\Downloads\ZHPCleaner.exe 2017-09-06 20:52 - 2017-09-09 09:21 - 000000000 ____D C:\ProgramData\DataCache 2017-09-06 20:28 - 2017-09-06 20:49 - 000000000 ____D C:\ProgramData\Cache 2017-09-06 20:28 - 2017-08-25 23:33 - 001952256 ___SH C:\Users\Adrian\AppData\Roaming\tmp546.dat 2017-09-06 20:28 - 2016-03-18 01:33 - 000473384 _____ C:\Windows\SysWOW64\wtmkussrv.dll 2017-09-06 20:27 - 2017-09-06 20:27 - 000140800 _____ C:\Users\Adrian\AppData\Local\installer.dat 2017-09-06 17:04 - 2017-09-09 10:26 - 000000912 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2017-09-06 17:04 - 2017-09-09 09:41 - 000000854 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk 2017-09-06 17:04 - 2017-09-06 17:04 - 000000000 ____D C:\Program Files\Mozilla Firefox 2017-09-06 17:04 - 2017-09-06 17:04 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2017-09-03 21:42 - 2017-09-03 21:52 - 000000000 ____D C:\Users\Adrian\Downloads\Pere Ubu - 1979 - New picnic time [1999, Cooking Vinyl, COOK CD 171] 2017-09-03 21:42 - 2017-09-03 21:52 - 000000000 ____D C:\Users\Adrian\Downloads\1981 - 390° of simulated stereo [Rough Trade, ROUGH CD 23] (VBR V0) 2017-09-03 21:42 - 2016-03-31 17:40 - 000000000 ____D C:\Users\Adrian\Downloads\1989 - Cloudland [Fontana, 838 237-2] (VBR V0) 2017-09-03 21:42 - 2016-03-31 17:39 - 000000000 ____D C:\Users\Adrian\Downloads\1982 - Song of the bailing man [1999, Cooking Vinyl, COOK CD 158] 2017-09-02 18:59 - 2017-09-02 19:00 - 000000000 ____D C:\Users\Adrian\Downloads\Martin Barre 2017-08-31 10:51 - 2017-08-31 10:51 - 000000000 ____D C:\Users\Adrian\Downloads\Martin Barre - Away With Words (2013) By Muro 2017-08-30 07:44 - 2017-08-30 07:44 - 000317056 _____ C:\Windows\system32\FNTCACHE.DAT 2017-08-29 22:40 - 2017-08-29 22:40 - 000070584 _____ C:\Users\Adrian\AppData\Local\GDIPFONTCACHEV1.DAT 2017-08-28 16:18 - 2017-08-28 16:18 - 000000000 ____D C:\Users\Adrian\.QtWebEngineProcess 2017-08-28 16:18 - 2017-08-28 16:18 - 000000000 ____D C:\Users\Adrian\.BitLord 2017-08-27 22:23 - 2017-08-27 22:24 - 000000000 ____D C:\Users\Adrian\Desktop\Charlélie Couture - Discographie 2017-08-26 20:06 - 2017-08-26 20:06 - 000000000 ____D C:\Users\Adrian\Desktop\Panini 2017-08-23 20:32 - 2017-08-23 20:34 - 106531253 _____ C:\Users\Adrian\Downloads\Le Grand Livre des idées reçues - Insolite et Grandes Enigmes.pdf 2017-08-22 22:07 - 2017-08-22 22:07 - 000192581 _____ C:\Users\Adrian\Downloads\video-1503428553.mp4 2017-08-20 19:34 - 2017-09-03 13:55 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hotspot Shield ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2017-09-13 20:29 - 2016-11-15 21:08 - 000000000 ____D C:\Users\Adrian\AppData\LocalLow\Mozilla 2017-09-13 20:27 - 2016-06-26 10:18 - 000004312 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2017-09-13 20:27 - 2015-12-22 01:42 - 000803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2017-09-13 20:27 - 2015-12-22 01:42 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2017-09-13 20:27 - 2015-12-22 01:42 - 000004454 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier 2017-09-13 20:27 - 2014-07-24 13:24 - 000000000 ____D C:\Windows\SysWOW64\Macromed 2017-09-13 20:27 - 2014-07-24 13:24 - 000000000 ____D C:\Windows\system32\Macromed 2017-09-13 20:26 - 2009-07-14 07:45 - 000025120 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2017-09-13 20:26 - 2009-07-14 07:45 - 000025120 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2017-09-13 20:16 - 2009-07-14 08:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT 2017-09-13 11:14 - 2009-07-14 08:13 - 000784286 _____ C:\Windows\system32\PerfStringBackup.INI 2017-09-13 11:14 - 2009-07-14 06:20 - 000000000 ____D C:\Windows\inf 2017-09-11 14:36 - 2014-08-23 14:32 - 000000000 ____D C:\Users\Adrian\Documents\Chroniques 2017-09-11 13:14 - 2014-08-01 15:32 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\Mp3tag 2017-09-11 12:58 - 2015-08-16 21:19 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\ZHP 2017-09-10 13:46 - 2017-07-06 16:22 - 000000000 ____D C:\Users\Adrian\Documents\Depart' Aimant 2017-09-10 13:24 - 2016-06-04 14:37 - 000000000 ____D C:\AdwCleaner 2017-09-09 12:28 - 2017-02-03 20:54 - 000000000 ____D C:\Users\Adrian\Downloads\Films 2017-09-09 12:28 - 2014-07-24 17:31 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\vlc 2017-09-09 12:08 - 2014-07-30 10:34 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\FileZilla 2017-09-09 10:26 - 2017-02-02 20:15 - 000002129 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk 2017-09-09 09:41 - 2017-02-02 20:15 - 000001210 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2017-09-08 09:16 - 2014-07-24 16:42 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\uTorrent 2017-09-07 15:13 - 2016-06-05 17:10 - 000000832 _____ C:\Users\Adrian\Desktop\ZHPCleaner.lnk 2017-09-06 20:35 - 2014-08-22 19:55 - 000000000 ____D C:\Users\Adrian\Downloads\Pas finis 2017-09-03 22:33 - 2014-08-31 22:51 - 000000000 ____D C:\Users\Adrian\Documents\Tallinna Prantsuse Lutseum 2017-09-03 13:55 - 2017-04-15 09:35 - 000000000 ____D C:\ProgramData\Package Cache 2017-08-31 13:13 - 2017-08-06 19:25 - 000000000 ____D C:\Users\Adrian\Downloads\Correction 2017-08-31 13:13 - 2014-10-13 20:32 - 000000000 ____D C:\Users\Adrian\Downloads\Photos 2017-08-31 13:13 - 2014-10-13 20:31 - 000000000 ____D C:\Users\Adrian\Downloads\Installations 2017-08-31 10:52 - 2017-06-05 15:01 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam 2017-08-30 07:58 - 2017-04-14 11:33 - 000002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk 2017-08-29 18:18 - 2016-06-03 17:33 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\MPC-HC 2017-08-28 16:21 - 2014-08-04 19:47 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\Skype 2017-08-28 16:18 - 2014-07-23 19:30 - 000000000 ____D C:\Users\Adrian 2017-08-27 22:20 - 2014-07-24 14:39 - 000001030 _____ C:\Users\Public\Desktop\VLC media player.lnk 2017-08-27 20:53 - 2016-06-04 21:40 - 000000000 ____D C:\Users\Adrian\Desktop\Discographie Bernard Lavilliers - (28 cds) 1968-2003.www.zone-telechargement.com 2017-08-27 18:18 - 2015-04-30 22:03 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\DAEMON Tools Lite 2017-08-25 22:15 - 2014-07-30 10:34 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client 2017-08-25 22:15 - 2014-07-30 10:34 - 000000000 ____D C:\Program Files (x86)\FileZilla FTP Client 2017-08-25 06:50 - 2009-07-14 08:08 - 000032548 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2017-08-22 13:21 - 2016-08-19 22:21 - 000000000 ____D C:\Users\Adrian\Documents\My Travel Quest 2017-08-17 13:42 - 2014-12-06 11:00 - 000000000 ____D C:\Users\Adrian\Documents\Livre Jethro Tull 2017-08-16 19:16 - 2014-10-13 20:32 - 000000000 ____D C:\Users\Adrian\Downloads\Vidéos ==================== Files in the root of some directories ======= 2017-09-06 20:28 - 2017-08-25 23:33 - 001952256 ___SH () C:\Users\Adrian\AppData\Roaming\tmp546.dat 2015-12-06 19:47 - 2017-08-06 13:32 - 000011264 _____ () C:\Users\Adrian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2017-09-06 20:27 - 2017-09-06 20:27 - 000140800 _____ () C:\Users\Adrian\AppData\Local\installer.dat 2016-07-17 10:44 - 2016-07-17 10:46 - 000002222 _____ () C:\Users\Adrian\AppData\Local\WiDiSetupLog.20160717.104454.txt 2016-07-17 10:55 - 2016-07-17 10:55 - 000011200 _____ () C:\Users\Adrian\AppData\Local\WiDiSetupLog.20160717.105514.txt ==================== Bamital & volsnap ====================== (There is no automatic fix for files that do not pass verification.) C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\dnsapi.dll => File is digitally signed C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-12-17 13:22 ==================== End of FRST.txt ============================